Got a few referrer spams for milf.homepc.it. homepc.it is one of a few domains used by DynDNS.it (not sure if they're related to dyndns.org, but they offer the same sort of services). My non-existent Italian didn't exactly help in interpreting their Terms Of Use, but the word "spam" stood out pretty clearly. So I fired off an email to their abuse department and got a response back 5 hours later: "The account milf.homepc.it has been terminated".

Thanks, DynDNS.it. Good work.

Not sure which spammer was behind this. read more

On 2005-05-22, 07:32:47 EDT, geeklog.net was hit by the first of several waves of referrer spam from 84.109.108.246. This first wave lasted only 4 seconds, but consisted of 20 requests, with the first 13 requests in the first second alone. Every single request came with a different user agent string, including silly things like "Mozilla/4.0 (compatible; X 10.0; Commodore 64)".

The reason for this? Referrer spam for a blog at blogspot.com. Fortunately, the blog's URL contained the phrase "online-casino", which we already block, for obvious reasons.

Strangely enough, the blog itself only contained a few sentences about online poker, but no links, JavaScripts, or other tricks. read more

Now this is a nice and inconspicuous URL to use for referrer spam: http://forums.linux.dk/movie-forum.html. But wait a minute - a Linux movie forum? Ah, here's more of the same: http://forums.linux.dk/porn-forum-.html. Okay, something's fishy here ...

Of course it is. Those URLs do a JavaScript redirect to a porn site. linux.dk itself seems harmless enough - it appears to be the homepage of the Danish Linux user group. So unless the open source community is looking for new ways of income, I can only assume that their server was hacked and those redirect pages uploaded there somehow.

So what else can we find about this case? read more

This must have been going on for a while, but it only caught my eye today: We're getting occasional referrer spam for porn sites where the spamvertized URL always contains id=ballaire.

All the domains are registered with RK Netmedia, Inc., Florida. It's unlikely that they're spamming themselves, it's probably only one of their affiliates. Couldn't find an obvious address to report the abuse to. But at least it's easy to block ...

"Dumb", indeed. For quite some time now, I've been seeing referrer spam for a porn site hosted at free.dumb1.com. I usually just block those and hope that they go away. Well, not in this case.

On Saturday morning, on checking the logfiles, I found more of the same. So I decided to finally do something about it - and succeeded. read more