« Norwegian phishing
African sucker »

Gizmo

I had some accesses in my log today from gizmo.org

IP address:
81.57.108.63 (car75-1-81-57-108-63.fbx.proxad.net)

User agent:
Schizozilla/666 (GNU Hurd 0.2)

The machine is running thttpd, which is a small webserver, and the bot is fetching HEAD, then GET requests. Proxad is in France.

The owner, Dag Spicer, was working in California in 2004. There’s lots of stuff on the server. Papers he’s written, etc.

I’ve written him and asked for an explanation. The whole thing is weird. The page seems to have been online for a long time, and not spammy in nature. So why is a bot advertizing that page?

This entry was posted on Friday, March 18th, 2005 at 6:05 am and is filed under Referrer spam. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

10 Responses to “Gizmo”

  1. Manni Says:
    March 20th, 2005 at 7:36 pm

    I’ve seen this one on chongqed.org recently. Did you get a response yet?

  2. Administrator Says:
    March 21st, 2005 at 4:58 am

    Nope, nothing.

    Did get a spam to one of my addresses that had previously been almost spam free, though. I’ve been using it on blogs when I post comments. Irritating…

  3. Manni Says:
    March 21st, 2005 at 9:52 am

    OK. I guess that means a place in my .htaccess for him then.

  4. Administrator Says:
    March 21st, 2005 at 9:54 am

    Definitely. The question for me is whether or not I report him to Google for banning…

  5. Guillaume Says:
    April 19th, 2005 at 4:43 pm

    hi,

    I had the same experience on my homepgae with the IP adress you named. After a few research, aspecially by seeking the IP through google, i found this: a french guy with tunisian root, IT engineer with focussing on security tasks (see http://michel.arboi.free.fr/). He is participating to a open source programm of a security scanner, as far as discoveed.

    I am relatively new in thi kind of thing, but i am mindy… what is he really trying to do… i don’t know.. i would like to understand and to know i little bit more about this. Would you please explain me?

  6. Administrator Says:
    April 19th, 2005 at 5:05 pm

    I have no idea what the deal is, sorry.

    Even poking around, I couldn’t even formulate a theory on what was happening.

  7. Michel Arboi Says:
    June 10th, 2005 at 2:49 am

    It would be simpler if you just asked me, wouldn’t it?

  8. Administrator Says:
    June 10th, 2005 at 2:57 am

    Hmmm, IP address from proxad. What’s your relation to Dag Spicer and Gizmo?

  9. Michel Arboi Says:
    June 10th, 2005 at 3:33 am

    None. I put the first funny name that crossed my mind as “Referer”, I did not even check if it were used. I removed it by the way, as it seems 1) to increase paranoia among the few people who read their logs, 2) to generate unnecessary e-mail trafic to the owner of the domain.
    Last, this crawler is my personal “Netcraft”.

Leave a Reply