I’ve been getting a very wierd attack on my sites recently,
including this blog, the SpamAssassin websites, and http://jmason.org/ ,
whereby some luser is sending lots of requests, using made-up URLs in the
referral field. Initially, I thought it was some kind of underpowered
retaliation for SpamAssassin, but if that’s the case, they need to bone
up a bit more on how these things work ;)
Alternatively, it could be an attempt to gain Googlejuice, by getting
links from public referrer logs (my
ones are).
Up ’til about a month
ago, it was all porn sites. Recently, though, it’s been a selection
of real domains that sound like they were put together by combining
dictionary words or something.
All the attempts have come from IP address 216.127.68.58, owned by
Everyone’s Internet, Inc. in Houston, TX:
216.127.68.58 – – [31/Mar/2003:00:01:53 +0100] “GET / HTTP/1.1” 200 72143 “http://www.aircheckfactory.com” “User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)”
Here’s the domains in question:
-
AIRCHECKFACTORY.COM
-
ALTOTECHNOLOGY.COM
-
BAIDYANATHINDIA.COM
-
NXTCENTURY.COM
-
TIMEART.NET
-
WOTEVA.COM
Perhaps they’re recent lapsed domains which the spammer has picked up.
Otherwise, what’s the connection between Baidyanath (a manufacturer of
Ayurvedic products in India, thx Suresh) and ‘woteva’ (which sounds like
‘whatever’ in a UK english accent)?
I’ve whois’d them all, and they all seem to share two things: the name ‘Robert
Woodley’ (or its initials), and the number (772) 594-2421. Area code 772 is —
guess where — Florida. They should just cut to the chase and put ‘The Spammer
State’ on their numberplates.
The pages on those sites are automatically-generated using what looks like
USENET postings and google image search results, with a link to Commission
Junction.
None of the names are in ROKSO, it seems. Do they ring a bell with
anyone reading?
Artprice/artlist: winners of the address-scraping spammer speed record
Wow. A spammer has already scraped my blog and caught that one-use cdt_comment_go address I posted a week or so ago. That has to be a record. Ah well, Bayes and the SBL are catching it nicely…
The spammer in question is artprice.com, aka. artlist.com, aka a bunch of unrepentant spammers who’ve been out-and-out spamming for years, from France. Nothing worse than a full-time spamhaus. My consolation is that if they do this after August, I can prosecute them for it, since France is in the EU ;)
Just for reference, if anyone finds this on a Google search: the address was a one-use disposable job, for comments on a survey, posted once, and never used for sign-ups or even to send a single mail message. This is 100% spam, through and through.