Adsoft-Development and Andrew Kartashov
It’s been a while since I’ve busted a spamming operation. I’ve had limited time, and busting takes time. I processed some spam today, and came upon an operation a little bigger in scale than some.
Adsoft Development is a webdesign company headed by Andrew Kartashov from Russia.
This company designed the pages, and e-mail addresses from a domain they own are used in the whois info of most of these domains. It looks to me like fake whois info apart from the e-mail addresses, but I haven’t checked.
I’ve seen forum posts from Andrew more or less admitting to linkspam, so chances are good he’s the spammer.
November 2nd, 2005 at 9:43 am
I’m impressed
January 19th, 2006 at 11:10 pm
I have had a problem with this lately - someone posting links to porn and other web riff raff at my son’s Pop Warner football guestbook for 7,8, and 9 year olds. I did some coding to try to stop it and now I see an interest in just this page only from a site tracking back to Mr. Andrew Kartashov. Guys… this is a site for kids… please give me a break.
January 20th, 2006 at 6:04 am
There’s nothing you can do to stop them from trying to post their junk in your guestbook. The only responsible action you can take, is to move to a pre-moderated guestbook. While you’re at it, archive the stuff from the old guestbook (the clean stuff), disable the scripts, then point to the new guestbook which is moderated.
January 20th, 2006 at 12:30 pm
Thank you very much. The latest garbage this morning tracks back to a Konstantin Chibrikov 63.246.146.60.
January 20th, 2006 at 5:17 pm
Another thing you can try is to change the name of the script that runs your guestbook. Many spammers search for specific guestbook scripts so if yours doesn’t use the standard name it will be a bit harder to find. That would help, but moderation is really your only choice for completely protecting the kids.
January 4th, 2007 at 12:15 am
Should I expect to see my response posted?
November 3rd, 2007 at 5:51 am
The website 74.86.176.75 owned by Spamsoft was today banned automatically by my servers for flooding. So be aware of this outfit of spammers.
December 15th, 2007 at 11:52 pm
I am currently seeing this online on our website.
74.86.171.82 16:14:39 16:14:50
Time Since Clicked:
00:11:36 ago Session ID:
Host: adsoft-development.com
User Agent: Mozilla/5.0 (compatible; Googlebot/2.1;+http://www.google.com/bot.html)
Looks like adsoft are trying to pretend to be the googlebot.
April 13th, 2008 at 2:34 am
74.86.176.75 and 74.86.171.82 just wandered through parts of my site and claimed at various times to be the following:
Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)
Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt; MRA 4.0 (build 00768))
Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MRA 4.1 (build 00975))
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; MyIE2; MRA 4.4 (build 01348))
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Mozilla/5.0 (compatible; Googlebot/2.1;+http://www.google.com/bot.html)
Mozilla/5.0 (Windows NT 5.1; U) Opera 7.54 [ru]
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50
That’s quite a selection and obviously from an outfit trying to avoid detection. Both IP addresses are now blocked in my firewall.