Trackback spammer (2nd update)

Topics

User Functions

Trackback spammer (2nd update)
Sunday, August 28 2005 @ 19:05 CEST Contributed by: Dirk
If your site supports trackbacks, I'd suggest you block 195.95.219.6. This guy has been posting porn trackback spam for a few days now. And it looks like I'm not the only one seeing those. The first trackback here on the site actually made it through and I didn't notice it right away since my email spam filter ate the site's notification email. D'oh! The spam itself is for zenno.info, which, on closer inspection, looks like it's only a Japanese subdomain provider. The spamvertized subdomains feature a JavaScript redirect that doesn't seem to work properly with my browser and I'm too lazy to decode it by hand now ... The sites are hosted on 195.95.219.2 through 195.95.219.4 (notice the vicinity to the IP sending the trackback spam) on a server in the Ukraine and on 69.50.170.92 and 69.50.170.94 which belong to ESThost (despite being listed as belonging to Atrivo).
Filed under: Comment Spam ()

What's Related

Story Options

Printable Story Format

Trackback

Trackback URL for this entry: http://spam.tinyweb.net/trackback.php/porn-trackback-spam

Here's what others have to say about 'Trackback spammer (2nd update)':

Damn Spam! - Porn Trackback Spam Overdrive
Tracked on Thursday, December 08 2005 @ 20:15 CET

Damn Spam! - Geocities trackback spam
Tracked on Tuesday, July 10 2007 @ 19:46 CEST

Trackback spammer (2nd update) | 4 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

Switched subdomains

He's still spamming from the same IP address but now switched to spamvertizing subdomains at server.us

Authored by: Dirk on Tuesday, August 30 2005 @ 10:02 CEST

[ Reply to This | # ]

Changed IP address

He's posting from 85.255.113.78 now and he keeps on switching subdomain providers.

Authored by: Dirk on Thursday, September 01 2005 @ 09:14 CEST

[ Reply to This | # ]

I've Been Hit Too

I've been hit too from
69.50.176.219
69.50.176.220
69.50.176.221
69.50.176.222
85.255.113.78
85.255.113.158

I've decided to block the 69.50.176.x and 85.255.133.x.

Authored by: Anonymous on Friday, October 21 2005 @ 11:54 CEST

[ Reply to This | # ]

New address range

They are now also spamming from the 85.255.114.* address range, in addition to 85.255.113.*, which they still seem to be using.

They've also changed the user agent string from "Net::Trackback/1.01" to "Movable Type" (sneaky!)

Authored by: Dirk on Wednesday, December 07 2005 @ 21:34 CET

[ Reply to This | # ]