Just got a bunch of new users on one of my sites. They all used email adresses from porn-related sites and usernames like messiah8055, hough9150, credential8403, etc.

The domain names used for the email addresses are all hosted on the same server: 195.225.176.115, which belongs to NetcatHosting in the Ukraine. In other words: Nothing good will be coming from there.

Domain names used so far (all .com domains): realitypornhouse, topasianporn, webcam-home, orgy-reality.

More tomorrow, as I only get the logfiles for that site once per day. I'm interested in seeing if this was a bot or manual registrations.

A lot of the web spam (comments, trackbacks, forum posts, story submissions) we're currently seeing is misusing other people's websites to redirect to the spammer's actual site. TWiki, a link script named xLinks, and something called simpleforum are the most popular among spammers right now, it seems.

So, if you're running your own site based on some script: Please check for updates on regular intervals - and install them!

Otherwise, your site may fall victim to a spammer sooner or later. Every software has bugs and bugs on web applications will be exploited mercilessly. read more

... is a children's book by Janosch, in case you were wondering (English title: The Trip to Panama).

Not nearly as cute as that book is that idiot who's spamming us with his links for sites related to Panama (panamatravels, vacationtopanama, thepanamareport, panamarealestatepros, etc. - all as a .com). IP address of the last spam: 200.75.244.136 - which actually is in Panama, so at least he's from there.

We're seeing a slew of Trackback spam attempts all using the user agent string

Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.7) Gecko/20040626 Firefox/0.9.1

The attempts are coming via proxies all over the place and since Bad Behavior is blocking them, I can't tell what they're trying to spam for. Since nobody would seriously use such an old Firefox version any more, it should be safe to block that user agent if you don't have any other protection against these trackbacks.

For the last 48 hours or so, some idiot is spamming this site with his pills/drugs trackback spam. About one trackback every 5 minutes. And every single one of it has been caught and rejected, of course.

The funny part is that most of the URLs he's using aren't even working. For example, he's posting links to a now defunct (thankfully) HyperNews board at vcsun.org - but none of those links work. So I can't even do some digging to see who's behind this. Oh well.

One interesting observation: The trackbacks are all coming from the US: Comcast, SBC / Pacbell, AOL, Optimum Online - you name it. I'm more used to this stuff coming from the far east. Hmm ...

P.S. No, I haven't given up spam hunting - I simply don't have a lot of time to blog about it.