Russian Referrer Bot on 2017 Aug 31: 43 Unique IPs

I can only label this a Russian referrer bot because it uses predominantly Russian referrers, used for referrer spam. In fact I have no evidence of its origin. The list of 46 unique requesting IPs are from around the world, seemingly random. While it is easy to ban these 43, there is no way to find the originator of this bot.

Referrer spam is unique in that the originating IP does not care about returned data. All the IP request wishes to do is insert their referrer info into the request. This request goes back to and therefore affects and pollutes your Google Analytics. The requesting IPs, not wanting any information in return, could be from anywhere and could well be faked.

https might prevent this misuse of IP addresses, as there is a handshake between the server and the IP.

The referrer web sites, however, are real. They try to entice the webmaster to click on them, out of curiosity, to see who is visiting their site. On the server end of these referrer sites are malware, ready to infect the webmaster’s computer.

With this type of spam, if you don’t click on them and ignore them in your Google Analytics, they will not affect you. They do, however, take up server resources. I witnessed a marked uptick in mine, though not enough to worry.

Their UA is pretty anonymous: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

101.37.79.125	missing	ALISOFT
103.250.144.42	missing	GUJARATKUTCHNETWORK
104.131.118.88	missing	DIGITALOCEAN-9
104.131.132.131	missing	DIGITALOCEAN-9
113.57.35.60	missing	UNICOM-HB
138.68.16.252	missing	DIGITALOCEAN-15
149.56.45.152	152.ip-149-56-45.net
159.203.123.120	missing	DIGITALOCEAN-12
160.218.186.152	gprs186-152.eurotel.cz
163.172.217.103	nl-02.kingdebrid.com
165.227.124.88	missing	DIGITALOCEAN-19
177.32.197.231	b120c5e7.virtua.com.br
181.112.218.146	146.218.112.181.static.anycast.cnt-grms.ec
182.253.179.21	missing	Biznet-MetroNET
185.101.218.213	missing	BUDGETNODE
185.62.188.240	hosted-by.blazingfast.io
189.122.200.47	bd7ac82f.virtua.com.br
195.154.77.130	195-154-77-130.rev.poneytelecom.eu
201.91.82.158	201-91-82-158.customer.tdatabrasil.net.br
209.45.108.175	missing	LACNIC-209-45-0-0
210.16.121.16	missing	HOSTUS-SGP-NET4
210.61.209.197	210-61-209-197.HINET-IP.hinet.net
212.237.60.208	host208-60-237-212.serverdedicati.aruba.it
212.237.9.64	host64-9-237-212.serverdedicati.aruba.it
217.17.46.162	w3cache.atman.pl
41.217.148.151	host-151-148-217.ringonet.info
41.87.86.51	missing	PH3TEL
42.202.130.246	missing	CHINANET-LN
45.32.83.100	45.32.83.100.vultr.com
45.76.100.147	45.76.100.147.vultr.com
45.77.103.164	45.77.103.164.vultr.com
5.188.211.13	missing	inf-net
5.188.211.16	missing	inf-net
5.196.68.47	ns3000234.ip-5-196-68.eu
52.80.102.212	ec2-52-80-102-212.cn-north-1.compute.amazonaws.com.cn
54.222.222.113	ec2-54-222-222-113.cn-north-1.compute.amazonaws.com.cn
59.145.117.26	missing	I2IE-1575848-New-Delhi
81.17.80.246	missing	BAKINTER-NET-ADSL
85.99.245.163	85.99.245.163.dynamic.ttnet.com.tr
89.236.17.106	89-236-17-106.customer.t3.se
91.226.35.93	missing	DVS-SAT
92.222.106.199	115.rbx3.ovh.abcd.network
93.104.210.29	vmi109216.contaboserver.net

Referrer Spam List
01adv.ru
afeqopcw.top
all-sport-shoes.ru
alphard.top
anastasiya-center.ru
chitatelbalakovo.ru
den-denich.ru
doman-energy.ru
fabrikamebeli2.ru
ferroprettyuop.site
gusto-i-gusto.ru
hapir.ru
hwqntdpa.top
lex-dnevnik.ru
locution.top
ncpstwyv.top
onixproject.ru
onlain-invest-igra.ru
ooorusprodukt.ru
ooosevers.ru
ooosystem.ru
optimabt-nn.ru
paduanism.top
potolokigomel.ru
rembrand74.ru
romerussia.ru
sakura-ye.ru
sb-rk.ru
skyself.ru
strophiole.top
topiclink.ru
tuningelement.ru
ventri.top
wrzqfxnc.top
wzicpuhr.top
xxyzzyy.xyz

Leave a Reply