9 Responses to “A Light Analysis of Referral Spammers”

1. 1
   Ann Elisabeth Says:
   January 23rd, 2005 at 9:08 pm

   I believe I tracked down the spammer’s real identity. On my blog, today.

   Appreciate the table with whois info. I’ve found that info tends to change after a while for some domains.

2. 2
   Paulo Querido Says:
   February 12th, 2005 at 1:53 am

   I clean up my blog platform everyday. I have thousands of spam-comments and trackbacks. I did the same you did: some whois-work.
   Laws just don’t work, I’d like to fight back spammers. I have some ideas, like trying some near-DoS on their websites.
   Any clues about this and other ways of fighting them back?

3. 3
   Rich Says:
   March 18th, 2005 at 11:53 am

   There are several possibilities, but mounting a DoS attack is not the solution.

   • It’s ethically and morally wrong.
   • It’s a waste of bandwith.

   I’m keeping this log so that there is a record, somewhere, that can help provide a trail which will show the history and association of these spam messages when we do eventually get them into a court. If, on that day, the law is ineffective, then the law must be changed. I cannot, and will not condone vigilante justice.

4. 4
   Spamhuntress Says:
   March 18th, 2005 at 10:12 pm

   Well, I guess you should lobby for better spam laws in Bulgaria, because that’s where they are…

   Meanwhile, I’m doing my best to make their tactics more expensive. Having a bit of luck, I hope, but still not enough. Getting them banned in Google, for starters. Educating bloggers and anyone else I can get hold of.

   Asking admins to tell their friends to check their servers to make sure they’re not open proxies.

   That sort of thing. Apart from getting Google to play ball, it’s still an uphill battle. It’s a numbers game. The more noise we make, the more the issue will be thought of as important.

5. 5
   Jon Says:
   April 11th, 2005 at 11:13 pm

   Any angle on the single related entity - Gandi.net ? Seeing that they manage to throw a spammer in jail the other day (I hope some of his fellow inmated have/had email addresses) - I wonder how long it’ll be before this sort of spamming is deemed worth a stint in the slammer.

   Any judges with wordpress blogs =) ?

6. 6
   Jarad Says:
   May 27th, 2005 at 3:42 pm

   seems Jane Phill has a few more I didn’t see in the list…

   razordude.net, juris-net.com, http://www.teriandersonandassoc.com and i’m sure a million others…

7. 7
   Chris Says:
   June 9th, 2005 at 7:03 pm

   You can add: play-e-poker.com, shivapage.com, e-poker-777.com,
   sheratonnorthcharleston.com, texas-hold-em-world.com, e-online-poker-777.com, lisaandjamie.com, bentrecords.net, warrenzanes.com, pileband.com.

   2 interestings thing is the pattern of traffic; They seem to run a spam campaign for either 1 or 2 site mixed, generally for 24 hours. More interesting though was that at least on our server (Sun1 Enterprise server) the log entries show a 200 success but - bytes transmitted every single time, which for this server means that the remote disconnected pretty early in the session. Has anyone else noticed this type of activity? If consistent with other servers, it should be fairly easy to use that type of activity to generate dynamic block lists for a router, firewall or webserver.

8. 8
   rich boakes Says:
   June 10th, 2005 at 9:26 am

   Indeed - I’ve also seen some of these. Anyone interested in knowing what the latest spam domain I’m seeing are should refer to this automatically (regularly) generated text file which lists the latest referral spam domains: http://boakes.org/referral-spam-domains

9. 9
   Trackback from: The War Against Spam Bots | When minds collide
   January 15th, 2008 at 8:43 pm

Have your say...

Name (required)

Email (will not be published) (required)

Your website (if you have one)