genaholincorporated
I got an e-mail from Tom Raftery about some referrer spam. I found that there were two domains spamvertized by the same outfit:
genaholincorporated.com
firsthorizonmtg.com
Different whois info, but same webhost and IP number:
81.3.150.161
Russian webhost
abuse at peterstar.net
genaholincorporated.com
Chuck Tracy (chucktrcy@yahoo.com)
Adis-Abeba
New York, NY 10002
US
firsthorizonmtg.com
dave borgisson
NA NA (daveborgisson@yahoo.com)
South Brooklyn, 29th str. 34
New York, NY 10002
US
- firsthorizonmtg has lots of links, including a linkfarm culled from Google.
- genaholincorporated redirects to affiliate ID 2171394 at empirepoker, and some Google meat (text about poker) that no human will see.
Both domains use nameservers from
nextimedns.com
Ded Moroz Company
Ded Moroz (nextimedns@yahoo.com)
Severniy Polus 2-15
Velikiy Ustug
null,123456
RU
Tel. +912.4325432
If you access the website for that domain name, it has the same content as genaholincorporated. The name is also interesting. Resembles Morozov, although that may not mean anything.
One of them has the same IP number as the webhost, while the other points to another machine at the same webhost.
Also, a Google search reveals that the nameservers are used also for andrewsaluk.com, which has been spamvertized forever. It’s hosted on the same Russian webhost.
Update
I found lots of other domains hosted on that same server, and also some new spam comments for many variations of poker/gambling domains. These domains were on the same machine also, and had this whois info:
home
Fill Kollins (kollins_fill@yahoo.com)
+2.6513713646
Fax: +2.6513713646
Marabu st. 15
Panama, ST 98532
UY
March 31st, 2005 at 6:35 pm
I am getting what looks like traffic on my stats page from h*tp://www.andrewsaluk.com/
Total hits Files Pageview Bytes sent | Referrer URL
————————————————————————————————–
246 1.46% 243 246 7325271 7.44% | h*tp://www.andrewsaluk.com
Yet my link is not on these peoples page. Do you know what is going on?
Thank you for any insight you might have.
April 1st, 2005 at 4:14 am
I took the liberty of editing your post so the URL wouldn’t hyperlink.
You’ve been referrer spammed. You’ll never see your link on that page. It’s just the price you have to pay for owning a blog or website these days. Check if the spam comes from different IP numbers (proxies), or from the same IP number or same ISP. If it does, you could try blocking it, if it becomes a problem.
April 7th, 2005 at 9:03 am
We’re seeing this too.. and it’s starting to irritate me. I think that they are trying to damage site’s PR by doing this somehow.
Look at: http://www.phpfreaks.com/stats/page/usage_200504.php
You’ll see that we’ve had quite a few referrers from these domains. I think that they should be taken out! Our PR dropped to a 6 when these people started messing around like this.
April 7th, 2005 at 11:27 am
You need to put the stats pages under lock and key, man. Having them open like that is inviting trouble.
All it takes is for you to click on ONE link on there. If the site whose link you click on has open stats, that’s all it takes for Google et al to find your stats pages, even if they’re not linked to elsewhere on your site.
April 21st, 2005 at 9:32 am
[…] his spammer with at least some of the domains on the server I’m talking about in the Genaholincorporated post. This entry was posted o […]
April 28th, 2005 at 9:28 am
[…] ent, and find this: 82.103.65.225 Exact same pattern, except he’s interested in the Genaholincorporated post, and this time, the ISP info is peculiar: inetnum: 82.103. […]
July 1st, 2005 at 3:55 am
My log files show that I’ve had 51 visits so far this week from genaholincorporated. Should I check my site for any corruptions? If so, what should I be looking for?
July 7th, 2005 at 1:50 pm
Dear Ann,
I left a note last week about Genaholincorporated. I was worried that such spooging behaviour may have a negative impact. Any feedback.
July 7th, 2005 at 3:03 pm
I doubt there would be any ill effects. Are you saying he’s spamvertizing the domain again, or is it same spammer different domain?
July 26th, 2005 at 6:55 am
Ann,
many thanks for your reassurance. I was worried the visits may be connected to inbound links that may corrupt my website’s standing with Google.
A worthy website by the way. Keep up the good work.