Spamhuntress

We hear a lot about SEO (Search engine optimization), SEM (Search engine marketing) and linkbuilding, not to forget link popularity.

And we see a lot of shady schemes designed to get lots of links quickly, with automated tools. That’s something the search engines frown on, and webhosts are beginning to see the light as well. So it could get your domain or blog blacklisted with Google, and it could mean lost hosting, including clean up fees.

So, some of you may want to know how it’s done the right way?

Most of us bloggers know, but just in case some clueless newbies come by here, this is my take on how it’s done.

Start writing your blog with interesting content. Be generous with links to other bloggers and other sites. Link whenever you can. And make sure you click on each link in your post at least once, just in case you have no visitors who click on them (I tend to forget that, but then I have readers). Bloggers are quite often sitting on top of their referrer logs, and will check out any blog linking to them, unless the URL seems sleazy (pills, porn, gambling, affiliate marketing). Bloggers get a bit jaded after seeing too much referrer spam.

If they like what you write, they might reblog it or comment on it or otherwise use your content. That’s a good thing, because it normally (according to blogger ethics) means a link back to you.

If another blogger writes about your topic, comment on the blog or reblog/comment on your blog. You can find other bloggers via Technorati and Pubsub.

Remember one thing: Comments and trackbacks normally have rel nofollow, so those links won’t count towards link popularity. That shouldn’t be your goal anyway. A comment is only to help someone out, and to introduce yourself. Your goal should be to get readers and links from other bloggers because your content and comments are interesting. Links from posts and blogrolls normally don’t have nofollow.

So, blog SEO eventually comes down to this:

1)Valuable content
2)Network building

If you succeed, you’ll have your readers depositing links to your blog on forums and blogs here and there!

And of course: This method won’t work for the regular crappy affiliate site. It works for original opinions, knowledge and content.

I’m sniffing at the heels of a spammer who’s active now (just left a comment at annelisabeth), and has been for a long time.

Atlantida Marketing

Note that the company information in the whois looks suspicious. The spammer is most likely somewhere else entirely. It might be a shell company, fake address or whois protection.

I caught some comment spam on annelisabeth.com

Got a corner, and started tugging.

Scraper sites with stolen content (about four partial articles per page that lead on to full articles).

Unusually enough, I didn’t see any Adsense. I did see affiliate links of various types. Including real estate, which is one of the main things for this guy. Also one 302 to a poker affiliate. The 888 entity, affiliate: 362832

What’s interesting about this one, is that one machine seems full of his domains:
69.44.156.204

The domains are either comment spamvertized, or have lots of links from a previous life.

Whois info:

TRIPATHI, NITIN (39248913P) support@reallyrics.com
M-59 Indralok Market
null
Krishna Nagar, Lucknow 226005
IN
+91.5223299537 fax: null

Spamvertized from:
66.135.34.148
This machine has a domain belonging to the suspected spammer. Conclusion: Spamming bot leased or owned by the spammer.

This guy and Vandana Tripathi, is behind reallyrics.com and allperson.com, which are innovative sites that are popular. Ad supported. Too bad they decided to go down the slippery slope of spamming!

I’ve found some other ventures tied to Nitin Tripathi and the same name servers. However, in the interest of being careful, I won’t jump to conclusions just yet. There are several people with these names on the net.

Looks like Angelsfucked/Zolotko got hold of a latin dictionary.

I’m assuming the dynamic IP providers are filtering porn type words now, so he got creative.

He’s using words from a latin dictionary for his subdomains…

Got a trackback on annelisabeth.com today.

It advertized many subdomains on
purichee.info

And when I checked earlier trackbacks, I found some more June 15:
tellskin.info

And spamvertized on other sites:
cartmark.info
cheesquare.info
cheesquare.info
kesktown.info
kesktown.info
malknight.info
mapledark.info
minismall.info
netistar.com
plexsky.com
suptarg.com
tresdin.info
valitest.info
radcoin.info
dreamstin.info
samtailo.com
spritkin.com
kingdest.com
nexshine.com
synckin.com

I did some digging:

He’s been at this at least since June 1, 2005.

The point is to present a dead end to surfers, so they’re redirected to a page that just displays the name of the site (including subdomain).

However, spiders will see a directory with links. Googlebot is specifically instructed to not index the page, but is expected to follow the links.

The next layer of pages are also protected with javascript to throw off human visitors - same purple page.

The next layer is the final layer, and has Adsense on it:
pub-9219922125396009

It also contains what must be random text. In one case information about Mars.
One part of the text was scarfed from an encyclopedia article. Another from Biology Daily. A third section is from Biography

And the final section is scraper search engine results. Many of the links are dead.

I checked a page for another topic altogether. That one also had an astronomical article as the middle content.

Conclusion: This is a scheme to get pages to rank for high paying Adwords. There’s no other point to the pages. In other words, it’s both search engine spam and Adsense spam.

Whois:

Domain Name:PURICHEE.INFO
Created On:14-Jun-2005 00:26:06 UTC
Last Updated On:15-Jun-2005 23:45:52 UTC
Expiration Date:14-Jun-2006 00:26:06 UTC
Sponsoring Registrar:R171-LRMS
Registrant Name:Freddy Dirkson
Registrant Street1:PO Box 3411 345 Nesville Ave
Registrant City:Toronto
Registrant State/Province:Ontario
Registrant Postal Code:M3L 3K9
Registrant Country:CA
Registrant Phone:+1.4164542655
Registrant Email: afflink@hotmail.com

The phone number is from Toronto, Rogers Cantel wireless. Might be legit.

One of the dynamic IP subdomain providers has a statistics page that’s global. IE, it’s across all subdomains.

Pretty chilling reading, considering all the spammers on there. Hopefully they’ll do something about this, but from the looks of the referrer page, they’re sleeping on the job.

Dyn agat

Bird calls for action against the proxies on the internet, with Alestra leading the bunch. She’s sick and tired of the strain the spammers are putting her server through, and feels we should call legislators etc to start a process regarding harassment and threat to national security because of the proxies.

We occasionally talk to really clueless webhosts and ISP’s, who say spam isn’t spam because it isn’t e-mail.

Duh, wake up!

Anyway, I checked some of my hosts, and found they had fearsome AUP’s. Well, if you’re a spammer that is. They mean business about staying spam free.

Have a look:

Totalchoice hosting

Any account terminated for spam is subject to a $500 administration fee

Doorhost

First violations of this policy will result in an “Administrative Fee” of $250 and your account will be reviewed for possible immediate termination. A second violation will result in an “Administrative Fee” of $500 and immediate termination of your account. Users who violate this policy agree that in addition to these “Administrative” penalties, they will pay “Research Fees” not to exceed $175 per hour that DoorHost.net personnel must spend to investigate the matter.

A spammer once upon a time hit mainly forums. Maybe some forum owners subjected him to their wrath? So he decided to try some honey. Here’s the message he put at the top of his spams, lightly munged:

If you don’t need these messages at your guestbook, email us to abuse@mungedxxxxx.com.
Include your guestbook’s url and all your mirrors urls in the letter. Your website will be taken off our list in 48 hours.

His brand of spam is incest and beastiality, along with straight porn. So it should be common sense that most people wouldn’t want his “ads”.

I found some of his ads on a forum that had been long abandoned. Absolutely filled with porn and other spam. Including a redirect in the subject field of one of the spam posts.

Do me a favor. If you find a forum of that sort, send off an e-mail to someone in a position to remove the forum. The scripts are often Matt’s wwwboard or variants of it. That stuff should be banned! A forum for today is phpBB or Simple Machines (free ones), or Invision Power Board or vBulletin (paid ones).

If you know of useful tutorials regarding spam hunting, please post them here:

Spam Hunting Tutorials

I started with the previous post on finding downstream webhost provider, so you can complain to the right company.

But I’m sure there are many other great tutorials on tracing and other topics out there.