Hammering German
The German spammer I wrote about in the two preceding posts, has really been hammering annelisabeth during the night.
I found a few instances of my own site being the referrer, and dug deeper.
Turns out there was ONE referrer from a different site than the spamvertized ones. A “rude” domain (guess what), and owned by Richard Bracam/Inseosite. I saved the page he came from, and looked at it.
Turns out it’s a saved Google search with this search term:
+12.163.72.13
My site is number 5 in that search, so of course I get spammed… It’s a search with 100 results per page. Cindy is also on it, and got spammed.
And since that IP number was spammed not that long ago (by someone else), a lot of referrer pages was in the search result. Quite smart. You can’t fake that search term. Few would have it on their sites unless they have open referrer pages. Unless they’re spamhunters like Cindy and me, of course.
The user agent for those accesses were:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Seopolo; i-NavFourF; .NET CLR 1.0.3705; .NET CLR 1.1.4322)
The IP number:
82.207.242.39
March 10, there was another instance of that user agent (IP: 82.207.255.95). That time he was searching the German version of Google for:
+217.160.161.6
And my site and tuxedojack’s were the only results. Mine from a comment on the page. Turns out that’s one of the webservers connected to this spammer.