|
Charming: First he visited us, then he referrer-spammed us:
82.209.210.141 - - [26/Sep/2005:04:21:24 -0400] "GET /article.php/20031001042710526 HTTP/1.1" 200 18829 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU; rv:1.7.10) Gecko/20050717 Firefox/1.0.6"
[...]
82.209.210.141 - - [26/Sep/2005:07:05:01 -0400] "HEAD / HTTP/1.1" 200 0 "http://apo-cyclobenzaprine.timezero.biz" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
82.209.210.141 - - [26/Sep/2005:07:27:06 -0400] "HEAD / HTTP/1.1" 200 0 "http://cozaar-100mg.timezero.biz" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
82.209.210.141 is somewhere in Belarus, which goes with the Russian version of Firefox and the whois information for timezero.biz: Administrative Contact Name: Zeleny
Administrative Contact Organization: Zeleny
Administrative Contact Address1: Belarus Gomel
Administrative Contact City: Gomel
Administrative Contact Postal Code: 247500
Administrative Contact Country: Belarus
Administrative Contact Country Code: BY
Administrative Contact Phone Number: +375.0294312951
Administrative Contact Email: i_green@tut.by
The interesting bit about all this is that the article he read on our site is about a link referrer plugin for Geeklog (i.e. it displays one of those blocks showing which URLs led the visitors to your site). We don't use it on our site, but he just had to try ...
Actually, it looks like this is the bracelet spammer from last week, as that was the exact article that he sent all his referrer spam to (from 82.209.210.76 back then). The whois info for that domain is also identical.
|