Faking spambot

One of my grep queries filters out known referers and empty referers.

So when one bot fakes the empty referer, it’s included in my results.

One such bot is:
70.84.210.42
42.70-84-210.reverse.theplanet.com
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
It’s a webserver, but no websites recorded.

My guess is this one is associated with the trackback spamrun recently.

The script that does the trackback spamming also has faked empty referrers.

So I’d block that IP address in .htaccess…

Leave a Reply