Spamhuntress

A referrer spammer that always came from
80.58.20.173
got blocked by my .htaccess file

That’s when I noticed what came prior to the referrer spam:
Accesses with the user agent:
PHP/4.0.5RC1

The referrer spams had a list of different user agents. But there would always be an access from that PHP thingy first.

So when I blocked the IP number, there was no more referrer spam, but repeated attempts by the bot to access the site.

Frankly, I think blocking the user agent might be just as smart. Or maybe something we could do in addition to the IP number.

More about the spammer

The spamvertized URL’s are German. And the topics are search engine marketing and health insurance. The URL’s always end in: -1.de.vu

And the real site is served inside a frame on the spamvertized site.

Which means us conscientious spam hunters will ask Google to ban the sites served inside the frames as well as the spamvertized sites - of course!

———

I have seen some other accesses to my site from that IP number that puzzle me:

April 1 - A firefox user reads the blog, and prankster-having-fun
April 6 - A user with the same user agent as the maths trackback spammer reads the blog and the referrer spam category
April 7 - repeat of April 6. And a few hours later the spamming starts.

————–

Update

A word of warning. I was shocked when I discovered how many times they’ve loaded the blog page on annelisabeth. I’d say the bandwidth hit should be rather significant. More than 4 megabytes. So ban that IP number sooner rather than later. Eh, I found an earlier spamrun from the same spammer. Different IP number:
202.157.176.102
v5.webnetsecure.com

Might be a good idea to block their bot by user agent, then.

This entry was posted on Saturday, April 9th, 2005 at 10:53 am and is filed under Referrer spam. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.