Charming: First he visited us, then he referrer-spammed us:
82.209.210.141 - - [26/Sep/2005:04:21:24 -0400] "GET /article.php/20031001042710526 HTTP/1.1" 200 18829 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU; rv:1.7.10) Gecko/20050717 Firefox/1.0.6"
[...]
82.209.210.141 - - [26/Sep/2005:07:05:01 -0400] "HEAD / HTTP/1.1" 200 0 "http://apo-cyclobenzaprine.timezero.biz" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
82.209.210.141 - - [26/Sep/2005:07:27:06 -0400] "HEAD / HTTP/1.1" 200 0 "http://cozaar-100mg.timezero.biz" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
82.209.210.141 is somewhere in Belarus, which goes with the Russian version of Firefox and the whois information for timezero.biz:
Administrative Contact Name: Zeleny Administrative Contact Organization: Zeleny Administrative Contact Address1: Belarus Gomel Administrative Contact City: Gomel Administrative Contact Postal Code: 247500 Administrative Contact Country: Belarus Administrative Contact Country Code: BY Administrative Contact Phone Number: +375.0294312951 Administrative Contact Email: i_green@tut.by
The interesting bit about all this is that the article he read on our site is about a link referrer plugin for Geeklog (i.e. it displays one of those blocks showing which URLs led the visitors to your site). We don't use it on our site, but he just had to try ...
Actually, it looks like this is the bracelet spammer from last week, as that was the exact article that he sent all his referrer spam to (from 82.209.210.76 back then). The whois info for that domain is also identical.
Comments (0)
Damn Spam!
http://spam.tinyweb.net/article.php/visit-first-spam-later