Spamhuntress

I’ve had my first case of wiki spam on spamhuntress. My own fault for not protecting the main page.

I’ll probably just roll back the changes, so you can have a look. Just check the history of the main page, and click on the date (May 17) of the entry made by 81.214.103.203 (the spammer) to see the results of his edit. My wiki is set up so this shouldn’t end up in the search engines, but it’s still there for us to examine.

Spamming IP:
81.214.103.203
dsl.dynamic81214103203.ttnet.net.tr
Turkey

Spam domain (check the history page for that) has IP number
69.57.128.45
That’s on EV1

whois info:
Registrant Name:security ONI
Registrant Organization:soni
Registrant Street1:k. mah. kizilay. cad.
Registrant City:bpasa
Registrant Postal Code:81100
Registrant Country:TR
Registrant Phone:+90.5358845695
Registrant FAX:+90.5358845695
Registrant Email: never_land_10@yahoo.com

That Yahoo ID is from October 2003

This is a new one to me (but then I haven’t had a wiki long).

I examined one of the pages that were spammed. There was a javascript redirect to a domain on the same IP number.

whois info:

Administrative Contact:
oni, security unbiko@yahoo.com
kukurtlu mah. cekirge cad.
no:130
BURSA, OS 16080
TR
+905352377042

The Yahoo ID is from September 2004

That site has links to one affiliate program.

This entry was posted on Tuesday, May 17th, 2005 at 3:30 pm and is filed under Wiki spam. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.