|
What do we have here? Referrer spam for various domains that include the words "fact" or "facts". All coming from a single IP, 58.11.0.65 (Truenet, an ISP in Thailand). lasik-facts.org is registered with GoDaddy to a certain Registrant Name:Johan Zata
Registrant Street1:Soi 89
Registrant Street2:Sukhumvit rd
Registrant City:Bangkok
Registrant State/Province:
Registrant Postal Code:10260
Registrant Country:TH
Registrant Phone:+66.65558085
Registrant Email:johanz@tjohoo.se
Hmm, a Swedish email address for someone living in Bangkok? Odd.
The other spamvertized "facts" domains (lasik-centers, mesothelioma-cancer-facts, student-loan-facts, etc.) are .info domains, registered with RegisterFly.com and use their Whois Protection Service. The .info domains all seem to be on 72.37.140.143 (Lunarpages.com), while lasik-facts.org is on 72.29.71.127 (HostDime.com).
Payload: All the sites feature GoogleAds (ID: pub-6762128133711332) and next to no content.
|