And here I thought referrer spam was dead by now ... Well, someone in Russia doesn't seem to think so and is happily referrer spamming us right now.

Stupidity #1: He's spamming for subdomains of kokdod.info. None of those resolve right now.

Stupidity #2: kokdod.info is supposedly registered to "Amazon Technologies, Inc." and even uses "hostmaster[AT]amazon.com" as the email address. What a blatent case of a fake address (and why don't the registries care about these things?).

Stupidity #3: In addition to the referrer spam, he's also sending POST requests for all sorts of URLs on our site. Including HTML pages that don't contain any forms and even for PNG images.

Can someone in Perm, Russia, please check who's currently using the IP address 81.177.14.41 and smack that person really, really hard?

And here I thought the spammers had given up on referrer spam by now. Seriously, I haven't even looked at our logfiles in weeks - nobody even sees that stuff any more (or cares).

However, I stumbled upon referrer spam for bestofferguide.info. Oh well, let's block it then. IP addresses involved: 66.175.212.5, 66.175.212.16, and 66.175.212.112, belonging to Nibble Information Systems Inc.

What I missed at first, though, were these nice URLs: http://fuck-you-all.bestofferguide.info/fuck-you-all.html

Charming. What on earth did they try to accomplish with that?

And another case where Bad Behavior saved the day: I just noticed a bunch of referrer spams for completely idiotic URLs ending in hop.clickbank - that's not even a valid domain name, you numbnut!

It's all coming from a single IP address, 70.188.121.186, i.e. Cox. That same IP address has been spamming for 3brothersonline.com on the 23rd and 25th - all nicely caught by Bad Behavior. read more

And here I was wondering why our site was so slow ... Turns out we have a massive case of referrer spam for, AFAICS, four domains:

• makesearch4me.com
• searchweb4me.com
• hq-pictures.net
• sexybabes-online.com

The requests seem to be coming in from a lot of different IP addresses, so I'd suggest blocking by referrer. They also seem to use the same user agent string on all requests: Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU; rv:1.7.5) Gecko/20041108 Firefox/1.0

Russia, it seems. Why doesn't that suprise me at all? read more

Not sure what "kaupferd" means in Danish, but in German, it would mean something like "chewing horse". So much for the amusing aspect of this particularly clueless spammer (a newbie, I assume).

Spamming for kaupferd.com and kaspersmovies.com, both of which are registered to a Kasper Anderson from Denmark, and using a Danish ISP for that (83.88.234.156) is really, really stupid. We'll see how good their abuse department is.

On the first site (hosted at 195.47.247.66 with B-One Network in - again - Denmark), he wants to sell flats in Spain and the other site (hosted at 64.246.168.162, Swift Ventures Inc.) is a porn site (actually a WordPress blog with porn links, complete with affiliate IDs, of course).