Linkspammer migration
I’ve got a regular wikispammer, who likes spamming his own profile page.
I traced his latest spam URL to
69.50.188.132
Just check the history tab for the constant ballet of spammer edits and spamhunter reverts.
It’s part of the Intercage IP block. I also found nameservers belonging to ESThost in that range:
69.50.188.130
69.50.188.131
I don’t know? Maybe there’s a migration happening? I haven’t seen dyndns spam domains in that range in the past. I’ve copied both Intercage and ESThost on the abuse mail. Update: The user account seems to have been suspended.
And about the IP address he was spamming from. It was on a socks proxy list a while ago, as having a proxy port of 8790. It’s a small list, and most of the machines on it have high number proxy ports. And many of them do not appear to be webservers. So I’m wondering if maybe they are compromised in some way? I also found that particular IP address on a spam list that appear to be tallying spam mail received (the site is in German, and I didn’t read the whole thing).
BTW, I guess you guys are tired of my sudden obsession with mail spam, eh?