Tag: referrer spam
Hetmanship Referrer Spam Campaign: Case Study
As is typical, multiple IPs from around the world: Indonesia, China (8), Russia/UA (5), Mexico, Columbia, Peru, Germany, US. They are indeed difficult to track.
Referrer: http://hetmanship.(will not publish)
UA: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Documenting A Referrer Spam Campaign
Combating Blogspot Referrer Spam, Hosted by Google
Using Blogger as a Referrer Spam Platform
tanyadokterkeluarga.blogspot Referrer Spam: Research, Ban
tanyadokterkeluarga.blogspot is a persistent referrer spammer. They use a huge amount of Ip addresses that do not repeat the third octet. It has similar strategies to kosmetik-freaks.blogspot, in fact sharing identical IP ranges. They are sister referrer spammers. Both are not banned by the HTTP_REFERER in htaccess. If you kill one you kill the other, a nice double prize. As with the sister, this spammer runs out of Indonesia.
These are the referrers:
kosmetik-freaks.blogspot Referrer Spam: Research, Ban
This kosmetik-freaks.blogspot is a referrer spammer that has been harassing me for quite a long time. I have tried to ban them with an HTTP_REFERER ban but this does not work. My ISP, Site5, will not help me. They are predominantly out of Indonesia. They are pret188.8.131.52
too sophisticated to evade my detection for so long.
The sister referrer spammer is tanyadokterkeluarga.blogspot, which uses the identical method and largely shares the same IP ranges. When you kill one you kill the other. Almost all these UAs are mobile devices, leading me to believe these are mobile customers that have downloaded the same spam app.
kwpublisher.com Referrer Spam: Research, Ban
kwpublisher.com is a long-time referrer spammer that I would like to remove. I have tried to ban them with an HTTP_REFERER ban but this does not work. My ISP, Site5, will not help me. This guy seems to have a similar method to kosmetik-freaks.blogspot. They seem to be out of Pakistan mostly, but have gone to Indonesia and China. I am now tracking them closely.
Conclusion: Tracked down the code hotlinking to my site. Complained to their domain names provider. Them they disappeared. Goodbye.
184.108.40.206 x 4 220.127.116.11 – 18.104.22.168 Pakistan Tel
Host Name 0 Zero or localhost in your Raw Access Log
Does your raw access log display a host name of “0”, or zero? Very odd, is it not? I have been struggling with this for a couple of months, and my ISP Site5 had no answers. It turns out that one of my spammers, NFORCE_ENTERTAINMENT, puts an unprintable character into their host table, so that when my ISP looks them up, they display the unprintable character in my log as “0”.
Trying to control your site’s spam can be challenging. If you try to ban an IP that is simply 0, or a host name of “0” you will fail, because there is no zero in their host name, but an unprintable character. Ban these guys instead.
no-ptr.as20860.net Comment Spammer: Research, Ban
no-ptr.as20860.net is a dual Ip spammer with a twist. The originating IP hostname lookup returns three IPs! You’ll need to ban all three, but there’s a lot more. They use IOMart, GB as their ISP.
It seems like this hostname also morphs to numerous IP addresses, making them difficult to track down.
no-ptr.as20860.net hostname lookup 22.214.171.124 126.96.36.199 188.8.131.52
no-ptr.as20860.net not only uses the dual ip spammer strategy, but also changes its host name through many ip addresses, making it double difficult to ban.
fvds.ru Content Spammer: Research, Ban
fvds.ru spammed me, so I researched them. A good portion of their IPs are in the range of 184.108.40.206/24 but there are others. They use a wide variety of names.
t-testing.fvds.ru host lookup 220.127.116.11 is bogus. Research revealed 18.104.22.168 and 22.214.171.124.