This kosmetik-freaks.blogspot is a referrer spammer that has been harassing me for quite a long time. I have tried to ban them with an HTTP_REFERER ban but this does not work. My ISP, Site5, will not help me. They are predominantly out of Indonesia. They are pret103.47.135.43
103.47.135.50
103.47.135.7
103.47.135.72
too sophisticated to evade my detection for so long.
The sister referrer spammer is tanyadokterkeluarga.blogspot, which uses the identical method and largely shares the same IP ranges. When you kill one you kill the other. Almost all these UAs are mobile devices, leading me to believe these are mobile customers that have downloaded the same spam app.
This bot may be related to kwpublisher.com, which acts similarly.
Pattern:
There is no obvious pattern here, other than they are all sat and cell phones. Maybe they are attached to a rogue app. Tracked in a single month there is no pattern, but tracked over a couple of months and a pattern appears.
The actual name of this bot is:
kosmetik-freaks.blogspot.co.id
kosmetik-freaks.blogspot.de
kosmetik-freaks.blogspot.my
kosmetik-freaks.blogspot.co.id resolves to 172.217.6.33, a google server
tanyadokterkeluarga.blogspot.co.id resolves to 172.217.6.33
Conclusion: For Kosmetik-freaks I killed it with htaccess: SetEnvIf. For Tanyadoktor I have launched a DMCA request to Google to have them remove the hotlink.
Observations:
8.37.225.157 8.0.0.0 – 8.255.255.255 Level 3 8.37.225.0/24 8.37.226.0/24
8.37.225.182
8.37.226.135
8.37.226.226
8.37.226.7
8.37.230.232 8.37.230.0/23 8.37.232.0/22
8.37.230.38
8.37.230.54
8.37.231.207
8.37.231.224
8.37.231.244
8.37.232.101
8.37.232.18
8.37.232.185
8.37.233.230
8.37.233.24
8.37.233.55
8.37.234.148
8.37.234.50
8.37.234.50
8.37.235.120
8.37.235.165
8.37.235.194
8.37.237.168
8.37.237.28
8.37.237.66
36.80.105.111
36.80.105.134
36.80.105.44
36.84.13.12 36.84.0.0 – 36.84.15.255 TELKOM INDONESIA
36.84.13.13
36.84.13.206
36.84.69.145
36.84.69.145
36.84.69.189
45.121.217.10
45.121.217.28
45.121.217.8
49.236.220.150
49.236.220.150
49.236.220.150
64.233.172.158 64.233.160.0 – 64.233.191.255 Google
64.233.172.158
64.233.172.166
64.233.173.151
64.233.173.151
64.233.173.152
66.102.6.111
66.102.6.111
66.102.6.113
66.249.85.183 66.249.64.0 – 66.249.95.255 Google
66.249.85.183
66.249.85.185
68.171.236.6
68.171.246.146
68.171.246.48
68-171-246-143.rdns.blackberry.net 68.171.224.0 – 68.171.255.255 BlackBerry 68.171.246.0/24
68-171-246-192.rdns.blackberry.net
68-171-246-74.rdns.blackberry.net
subs07-103-10-66-13.three.co.id 103.10.64.0 – 103.10.67.255 Hutchison In
subs07-103-10-66-20.three.co.id
subs07-103-10-66-28.three.co.id
103.47.135.43 103.47.135.0 – 103.47.135.255 Eka Mas Republik Id
103.47.135.50
103.47.135.7
103.47.135.72
103-246-201-12.rdns.blackberry.net 103.246.200.0 – 103.246.203.255 Blackberry
103-246-200-24.rdns.blackberry.net
103-246-200-36.rdns.blackberry.net
103-246-200-61.rdns.blackberry.net
103-246-201-12.rdns.blackberry.net
103-246-201-20.rdns.blackberry.net
103-246-201-45.rdns.blackberry.net
103-246-201-53.rdns.blackberry.net
107.167.98.67 107.167.96.0 – 107.167.127.255 Opera-mini, so don’t ban
107.167.98.71
107.167.98.154
107.167.102.141
107.167.102.178
107.167.102.178
107.167.103.51
107.167.103.211
107.167.103.237
107.167.112.80
107.167.112.152
107.167.112.148
114.125.104.45
114.125.104.56
114.125.104.7
??? 120.188.78.234 120.188.78.0 – 120.188.78.255 Isubs13-223-255-229-1.three.co.id
subs13-223-255-229-10.three.co.id
subs13-223-255-229-2.three.co.id
subs13-223-255-229-30.three.co.id
subs14-223-255-230-31.three.co.id
subs14-223-255-230-31.three.co.id
subs14-223-255-230-36.three.co.id
subs14-223-255-230-36.three.co.id
subs14-223-255-230-45.three.co.id
subs14-223-255-230-59.three.co.id
subs14-223-255-230-66.three.co.id
NDOSAT In
112.215.36.143 112.215.0.0 – 112.215.255.255 XL-AXIATA In
112.215.36.143
112.215.36.144
112.215.45.109
112.215.45.125
112.215.45.239
112.215.63.13
112.215.63.15
112.215.63.16
112.215.65.29
112.215.65.41
112.215.65.41
112.215.123.151
112.215.123.197
112.215.123.91
112.215.124.131
112.215.124.134
112.215.124.180
112.215.147.123 112.215.147.0/24
112.215.147.126
112.215.147.94
112.215.148.111 112.215.148.0/24
112.215.148.132
112.215.148.164
112.215.151.15 112.215.151.0/24 112.215.152.0/23 112.215.154.0/24
112.215.151.182
112.215.151.231
112.215.152.162
112.215.152.193
112.215.152.52
112.215.153.120
112.215.153.137
112.215.153.241
112.215.154.139
112.215.154.204
112.215.154.218
112.215.170.193 112.215.170.0/23 112.215.172.0/22
112.215.170.55
112.215.170.74
112.215.171.107
112.215.171.157
112.215.171.205
112.215.172.128
112.215.172.249
112.215.172.96
112.215.173.137
112.215.173.217
112.215.173.53
112.215.174.166
112.215.174.186
112.215.174.237
112.215.175.226
112.215.175.254
112.215.175.92
112.215.200.101
112.215.200.194
112.215.200.22
114.4.21.197 114.4.21.0 – 114.4.21.255 Indosat
114.4.21.200
114.4.21.201
114.4.76.136
114.4.76.148
114.4.76.199
114.4.78.51
114.4.78.64
114.4.78.96
114.4.79.174
114.4.79.223
114.4.79.233
114.4.82.168
114.4.82.38
114.4.82.59
114.79.29.113
114.79.29.3
114.79.29.35
114.120.195.75
114.120.195.76
114.120.195.78
114.120.232.189 114.120.0.0 – 114.126.255.255 Telekomunikasi Selular (Telkomsel) Indonesia
114.120.232.79 114.120.232.0/21 14.120.232.0/23 114.120.234.0/24
114.120.232.86
114.120.233.104
114.120.233.156
114.120.233.204
114.120.234.170
114.120.234.172
114.120.234.72
114.120.235.174
114.120.235.222
114.120.235.253
114.120.236.212
114.120.236.255
114.120.236.50
114.120.237.164
114.120.237.250
114.120.237.35
114.120.238.135
114.120.238.235
114.120.238.253
114.120.239.134
114.120.239.16
114.120.239.160
114.121.129.1 114.121.129.0/24 114.121.130.0/23 114.121.132.0/23
114.121.129.138
114.121.129.233
114.121.130.100
114.121.130.130
114.121.130.64
114.121.131.184
114.121.131.41
114.121.131.71
114.121.132.143
114.121.132.184
114.121.132.204
114.121.133.177
114.121.133.92
114.121.133.92
114.121.135.148
114.121.135.55
114.121.135.84
114.121.152.147
114.121.152.187
114.121.152.242
114.121.154.112
114.121.154.15
114.121.154.78
114.121.152.87
114.121.157.15
114.121.157.243
114.121.157.82
114.121.159.129
114.121.159.142
114.121.159.237
114.121.164.105
114.121.164.201
114.121.164.48
114.121.232.193 114.121.232.0/21
114.121.232.245
114.121.232.42
114.121.233.110
114.121.233.18
114.121.233.78
114.121.234.228
114.121.234.229
114.121.234.78
114.121.235.100
114.121.235.144
114.121.235.239
114.121.236.14
114.121.236.144
114.121.236.148
114.121.237.167
114.121.237.187
114.121.237.208
114.121.238.175
114.121.238.233
114.121.238.70
114.121.239.38
114.121.239.52
114.121.239.72
114.124.2.121
114.124.2.174
114.124.2.38
114.124.6.130
114.124.6.172
114.124.6.78
114.124.7.119
114.124.7.138
114.124.7.5
114.124.25.17
114.124.25.171
114.124.25.3
114.124.35.127
114.124.35.183
114.124.35.238
114.124.38.186
114.124.38.193
114.124.38.46
114.125.8.108 114.125.8.0/23 114.125.10.0/24
114.125.8.116
114.125.8.122
114.125.9.137
114.125.9.148
114.125.9.217
114.125.10.103
114.125.10.105
114.125.10.105
114.125.10.138
114.125.10.31
114.125.12.133 114.125.12.0/22
114.125.12.145
114.125.12.160
114.125.13.128
114.125.13.147
114.125.13.220
114.125.14.209
114.125.14.50
114.125.14.63
114.125.15.133
114.125.15.53
114.125.15.96
114.125.27.200 114.125.27.0/24 114.125.28.0/22
114.125.27.242
114.125.27.76
114.125.28.123
114.125.28.143
114.125.28.99
114.125.29.69
114.125.29.71
114.125.29.92
114.125.30.177
114.125.30.217
114.125.30.237
114.125.30.177
114.125.30.217
114.125.30.237
114.125.31.119
114.125.31.128
114.125.31.144
114.125.40.110 114.125.40.0/21 114.125.48.0/22
114.125.40.74
114.125.40.97
114.125.41.149
114.125.41.217
114.125.41.220
114.125.42.111
114.125.42.228
114.125.42.44
114.125.43.119
114.125.43.205
114.125.43.222
114.125.44.168
114.125.44.171
114.125.44.76
114.125.45.117
114.125.45.121
114.125.45.181
114.125.46.180
114.125.46.190
114.125.46.63
114.125.47.128
114.125.47.204
114.125.47.93
114.125.48.159 114.125.48.0/23
114.125.48.164
114.125.48.75
114.125.49.0
114.125.49.109
114.125.49.139
114.125.50.228
114.125.50.254
114.125.50.6
114.125.51.126
114.125.51.126
114.125.51.246
114.125.60.15 114.125.60.0/23
114.125.60.48
114.125.60.71
114.125.61.189
114.125.61.228
114.125.61.232
114.125.62.238
114.125.62.238
114.125.62.28
114.125.77.100 114.125.77.0/24 114.125.78.0/24
114.125.77.121
114.125.77.33
114.125.78.157
114.125.78.71
114.125.78.95
114.125.46.180 114.125.46.0/23 114.125.48.0/23
114.125.46.190
114.125.46.63
114.125.47.128
114.125.47.204
114.125.47.93
114.125.48.147
114.125.48.159
114.125.48.164
114.125.49.0
114.125.49.109
114.125.49.109
114.125.60.15 114.125.60.0/23
114.125.60.48
114.125.60.71
114.125.61.189
114.125.61.193
114.125.61.228
114.125.73.115
114.125.73.29
114.125.73.30
114.125.77.100
114.125.77.121
114.125.77.33
114.125.80.195
114.125.80.59
114.125.80.83
114.125.82.15 114.125.82.0/23 114.125.84.0/23
114.125.82.239
114.125.82.57
114.125.83.22
114.125.83.235
114.125.83.28
114.125.84.234
114.125.84.28
114.125.84.77
114.125.85.127
114.125.85.212
114.125.85.234
114.125.108.198
114.125.108.43
114.125.108.58
114.125.168.123 114.125.168.0/22 114.125.172.0/23
114.125.168.47
114.125.168.66
114.125.169.129
114.125.169.134
114.125.169.249
114.125.170.137
114.125.170.238
114.125.170.244
114.125.171.0
114.125.171.56
114.125.171.67
114.125.172.179
114.125.172.45
114.125.172.5
114.125.173.192
114.125.173.247
114.125.173.52
114.125.175.117
114.125.175.178
114.125.175.202
114.125.177.118 114.125.177.0/24 114.125.178.0/23
114.125.177.14
114.125.177.94
114.125.178.140
114.125.178.253
114.125.178.3
114.125.179.12
114.125.179.126
114.125.179.56
114.125.185.195
114.125.185.225
114.125.185.229
114.125.186.172
114.125.186.175
114.125.186.49
114.125.188.163
114.125.188.31
114.125.188.6
114.125.190.138
114.125.190.152
114.125.190.170
114.125.190.30
115.178.195.209
115.178.195.213
115.178.195.53
115.178.215.163 115.178.192.0 – 115.178.223.255 Wireless Indonesia
115.178.215.163
115.178.215.209
115.178.235.117
115.178.235.139
115.178.235.80
115.178.237.150 115.178.224.0 – 115.178.255.255 Wireless Indonesia
115.178.237.189
115.178.237.213
115.178.238.12
115.178.238.190
115.178.238.195
120.161.0.134 120.161.0.0/23
120.161.0.141
120.161.0.246
120.161.1.54
120.161.1.54
120.161.1.54
120.164.40.155
120.164.40.162
120.164.40.61
120.164.42.152 120.164.44.0 – 120.164.44.255 INDOSAT 120.164.42.0/23 120.164.44.0/23
120.164.42.164
120.164.42.198
120.164.43.246
120.164.43.42
120.164.43.56
120.164.44.126
120.164.44.23
120.164.44.66
120.164.45.114
120.164.45.140
120.164.45.32
120.164.47.195
120.164.47.216
120.164.47.23
120.168.0.96 120.168.0.0 – 120.168.0.255 INDOSAT
120.168.0.96
120.168.0.100
120.169.254.159 120.169.254.0 – 120.169.254.255 INDOSAT 120.169.254.0/23
120.169.254.245
120.169.254.60
120.169.255.138
120.169.255.203
120.169.255.47
120.188.0.205
120.188.0.205
120.188.0.229
120.188.2.136 120.188.2.0/23
120.188.2.24
120.188.2.67
120.188.3.182
120.188.3.222
120.188.3.222
120.188.7.160
120.188.7.199
120.188.7.205
120.188.35.194
120.188.35.31
120.188.35.35
120.188.72.185
120.188.72.212
120.188.72.41
120.188.78.234
120.188.78.234
120.188.78.245
120.188.79.119
120.188.79.198
120.188.79.85
120.188.81.0 120.188.81.0/24 120.188.82.0/23 120.188.84.0/23 20.188.86.0/23
120.188.81.216
120.188.81.47
120.188.82.122
120.188.82.183
120.188.82.187
120.188.83.159
120.188.83.203
120.188.83.246
120.188.84.114
120.188.84.178
120.188.84.183
120.188.85.163
120.188.85.201
120.188.85.242
120.188.86.142
120.188.86.17
120.188.86.42
120.188.87.120
120.188.87.139
120.188.87.36
120.188.94.175
120.188.94.193
120.188.94.252
120.188.95.104
120.188.95.216
120.188.95.39
124.153.32.21 124.153.32.0/23 Hutchison In
124.153.32.72
124.153.32.97
124.153.33.4
124.153.33.43
124.153.33.45
124.195.117.191
124.195.117.50
124.195.117.80
168.235.196.128 168.235.196.0/23
168.235.196.130
168.235.196.136
168.235.197.100
168.235.197.102
168.235.197.105
168.235.205.119 168.235.205.0/24 168.235.206.0/23
168.235.205.126
168.235.205.130
168.235.206.122
168.235.206.122
168.235.206.164
168.235.207.122
168.235.207.159
168.235.207.166
168.235.195.116 168.235.192.0 – 168.235.207.255 QUANTIL 168.235.196.0/23
168.235.195.120
168.235.195.191
168.235.196.130
168.235.196.136
168.235.196.197
168.235.197.100
168.235.197.102
168.235.197.105
168.235.205.105
168.235.205.57
168.235.205.67
168.235.206.122
168.235.206.179
168.235.206.200
168.235.207.122
168.235.207.166
168.235.207.176
subs02-180-214-232-27.three.co.id 180.214.232.0 – 180.214.235.255 Hutchison In 180.214.232.0/23
subs02-180-214-232-27.three.co.id
subs02-180-214-232-48.three.co.id
subs02-180-214-232-49.three.co.id
subs02-180-214-232-54.three.co.id
subs03-180-214-233-1.three.co.id
subs03-180-214-233-125.three.co.id
subs03-180-214-233-17.three.co.id
subs03-180-214-233-73.three.co.id
180.214.232.13
180.214.232.49
180.214.232.90
180.214.233.10
180.214.233.10
180.214.233.10
180.249.17.106
180.249.17.106
180.249.17.106
180.251.127.56 x 4 180.251.64.0 – 180.251.127.255 TELKOM INDONESIA
202.62.16.0 202.62.16.0 – 202.62.31.255 INTERNUX In 202.62.16.0/23
202.62.16.207
202.62.16.217
202.62.17.146
202.62.17.59
202.62.17.92
202.67.33.41 202.67.32.0 – 202.67.47.255 PT Hutchison In 202.67.33.0/24 202.67.34.0/23 202.67.36.0/22 202.67.40.0/21
202.67.33.45
202.67.35.18
202.67.35.23
202.67.35.25
202.67.35.25
202.67.36.244
202.67.36.246
202.67.36.249
202.67.37.33
202.67.37.33
202.67.37.33
202.67.37.39
202.67.38.19
202.67.38.19
202.67.38.27
202.67.39.17
202.67.39.19
202.67.39.25
202.67.40.20
202.67.40.209
202.67.40.248
202.67.41.4
202.67.41.5
202.67.41.5
202.67.42.1
202.67.42.33
202.67.42.35
202.67.43.35
202.67.43.37
202.67.43.41
202.67.44.17
202.67.44.19
202.67.44.22
202.67.45.19
202.67.45.22
202.67.45.22
202.67.46.34
202.67.46.34
202.67.46.34
202.67.47.18
202.67.47.18
202.67.47.6
202.73.225.121
202.73.225.39
202.73.225.41
202.80.212.102
202.80.212.2
202.80.212.73
202.80.215.156
202.80.215.46
202.80.215.64
203.106.150.189
203.106.150.205
203.106.150.6
subs13-223-255-229-10.three.co.id 223.255.224.0 – 223.255.231.255 Hutchison In 223.255.229.0/24 223.255.230.0/23
subs13-223-255-229-30.three.co.id
subs14-223-255-230-31.three.co.id
subs14-223-255-230-31.three.co.id
subs14-223-255-230-36.three.co.id
subs15-223-255-231-107.three.co.id
subs15-223-255-231-132.three.co.id