<?xml version="1.0" encoding="UTF-8"?><!-- generator="wordpress/2.0.7" -->
<rss version="2.0" 
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
<channel>
	<title>Comments on: Picking on guestbook spammers</title>
	<link>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/</link>
	<description>Just another WordPress weblog</description>
	<pubDate>Fri, 21 Nov 2008 04:29:44 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.0.7</generator>

	<item>
		<title>by: Evan Camilleri</title>
		<link>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-120541</link>
		<pubDate>Mon, 05 Feb 2007 08:36:29 +0000</pubDate>
		<guid>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-120541</guid>
					<description>How can we stop them?</description>
		<content:encoded><![CDATA[<p>How can we stop them?
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: tmaster</title>
		<link>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-33158</link>
		<pubDate>Sun, 20 Aug 2006 16:02:41 +0000</pubDate>
		<guid>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-33158</guid>
					<description>I dont show that you have Bad Behaviour installed. I don't see its cookie.

If you use Wordpress you should install BB and SpamKarma.</description>
		<content:encoded><![CDATA[<p>I dont show that you have Bad Behaviour installed. I don&#8217;t see its cookie.</p>
<p>If you use Wordpress you should install BB and SpamKarma.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Wayne Porter</title>
		<link>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-24506</link>
		<pubDate>Fri, 14 Jul 2006 02:48:44 +0000</pubDate>
		<guid>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-24506</guid>
					<description>Huntress,

We have been following this group- I am pretty sure it is connected.

Check out http://www.revenews.com/wayneporter/archives/002069.html

You'll see ties to searchmeup/ Yap Browser / and our topsearch10 gang.

Thanks a lot for your great intel!

regards,
Wayne</description>
		<content:encoded><![CDATA[<p>Huntress,</p>
<p>We have been following this group- I am pretty sure it is connected.</p>
<p>Check out <a href="http://www.revenews.com/wayneporter/archives/002069.html" rel="nofollow">http://www.revenews.com/wayneporter/archives/002069.html</a></p>
<p>You&#8217;ll see ties to searchmeup/ Yap Browser / and our topsearch10 gang.</p>
<p>Thanks a lot for your great intel!</p>
<p>regards,<br />
Wayne
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Scott</title>
		<link>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-6323</link>
		<pubDate>Fri, 14 Apr 2006 18:05:49 +0000</pubDate>
		<guid>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-6323</guid>
					<description>We're a host of the "throwaway" sites you mention.  

These losers are constantly finding ways around our signup confirmation scripts, and abuse the crap out of our system - then half the people who get spammed think we're responsible.  I've taken some really nasty phone calls from people who's blog or guestbook had been spammed thousands of times.

We've recently added "topsearch10.com" to our list of "instan-ban" keywords.  If that, or a javascript-encoded version of it appears in a hostee's content (as determined by our in-house automated content scan) the site is instantly terminated. 

Its been hard to work this one in, because the spamvertisers encrypt the function to do the redirect in one, sometimes two, and once I found 3 layers of encoding, which really makes it hard to find them, and I'm sure every time we figure it out, they'll find a new way to encode the redirect to make it harder to find.</description>
		<content:encoded><![CDATA[<p>We&#8217;re a host of the &#8220;throwaway&#8221; sites you mention.  </p>
<p>These losers are constantly finding ways around our signup confirmation scripts, and abuse the crap out of our system - then half the people who get spammed think we&#8217;re responsible.  I&#8217;ve taken some really nasty phone calls from people who&#8217;s blog or guestbook had been spammed thousands of times.</p>
<p>We&#8217;ve recently added &#8220;topsearch10.com&#8221; to our list of &#8220;instan-ban&#8221; keywords.  If that, or a javascript-encoded version of it appears in a hostee&#8217;s content (as determined by our in-house automated content scan) the site is instantly terminated. </p>
<p>Its been hard to work this one in, because the spamvertisers encrypt the function to do the redirect in one, sometimes two, and once I found 3 layers of encoding, which really makes it hard to find them, and I&#8217;m sure every time we figure it out, they&#8217;ll find a new way to encode the redirect to make it harder to find.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: 419buster</title>
		<link>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-5136</link>
		<pubDate>Wed, 22 Mar 2006 22:02:39 +0000</pubDate>
		<guid>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-5136</guid>
					<description>Ann,

Right there wil 'ya. 

Will keep the data above and set a flag to watch for him in one of our site's spam logs. Our rule: Second violation, they're toast.

PS:
Would have never left a post here, but I used to work for Kongsberg N.A.
The Norwegian Spam Huntress? Great, just great!</description>
		<content:encoded><![CDATA[<p>Ann,</p>
<p>Right there wil &#8216;ya. </p>
<p>Will keep the data above and set a flag to watch for him in one of our site&#8217;s spam logs. Our rule: Second violation, they&#8217;re toast.</p>
<p>PS:<br />
Would have never left a post here, but I used to work for Kongsberg N.A.<br />
The Norwegian Spam Huntress? Great, just great!
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Jani</title>
		<link>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-3933</link>
		<pubDate>Wed, 01 Mar 2006 23:33:36 +0000</pubDate>
		<guid>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-3933</guid>
					<description>Me too are spammed by this punk and startes looking this is what i found out about him, any help on how to stop this kinda spam is nice. Thanks.

Found this info on TopSearch10 at http://www.alexa.com/data/details/?url=topsearch10.com

UmaxSearch Ltd
Arch. Makarios III str./22
Nicosia 2406,

CYPRUS
+35799841423
noc@ctel.ru</description>
		<content:encoded><![CDATA[<p>Me too are spammed by this punk and startes looking this is what i found out about him, any help on how to stop this kinda spam is nice. Thanks.</p>
<p>Found this info on TopSearch10 at <a href="http://www.alexa.com/data/details/?url=topsearch10.com" rel="nofollow">http://www.alexa.com/data/details/?url=topsearch10.com</a></p>
<p>UmaxSearch Ltd<br />
Arch. Makarios III str./22<br />
Nicosia 2406,</p>
<p>CYPRUS<br />
+35799841423<br />
<a href="mailto:noc@ctel.ru">noc@ctel.ru</a>
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: William</title>
		<link>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-3577</link>
		<pubDate>Tue, 21 Feb 2006 14:59:14 +0000</pubDate>
		<guid>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-3577</guid>
					<description>Dear Spam Huntress,

My guestbook just got spammed for the first time this last weekend and I decided to fight back. I called the hosting site where the spammer had a redirect site (brinkster.com) and told them that I was get getting a spam message with their domain name in it. Brinkster.com, that night, shut down the site and the redirect. This loser's redirect went to (topsearch10.com) which is obviously a fake search engine with a bunch of "canned" (no pun intended) advertising links.  I looked up the topsearch10 site in whois and it says it is owned by "Jaan Randolph" in the city of Victoria, in the state of Mahe, which is an Island in the Indian Ocean. This guy sure has a lot of time on his hands. 

I have also restricted my guestbook to not accept any URLs in the message body. This should discourage any more of my would-be guestbook spammers. Thank you for letting me know that I am not alone in this fight. Keep up the good work. -William</description>
		<content:encoded><![CDATA[<p>Dear Spam Huntress,</p>
<p>My guestbook just got spammed for the first time this last weekend and I decided to fight back. I called the hosting site where the spammer had a redirect site (brinkster.com) and told them that I was get getting a spam message with their domain name in it. Brinkster.com, that night, shut down the site and the redirect. This loser&#8217;s redirect went to (topsearch10.com) which is obviously a fake search engine with a bunch of &#8220;canned&#8221; (no pun intended) advertising links.  I looked up the topsearch10 site in whois and it says it is owned by &#8220;Jaan Randolph&#8221; in the city of Victoria, in the state of Mahe, which is an Island in the Indian Ocean. This guy sure has a lot of time on his hands. </p>
<p>I have also restricted my guestbook to not accept any URLs in the message body. This should discourage any more of my would-be guestbook spammers. Thank you for letting me know that I am not alone in this fight. Keep up the good work. -William
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Jon</title>
		<link>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-2642</link>
		<pubDate>Sat, 21 Jan 2006 15:38:18 +0000</pubDate>
		<guid>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-2642</guid>
					<description>Hi Huntress, I know just the punk you're referring to in this blog! He's been going nuts and seems easily identifiable, yet nobody is doing anything, presumably because he's in Russia.

I posted this page because I got tired of manually deleting "WGAGA" pages submissions from my guestbook. I actually don't know why they kept me in their list, because not a single one of their posts ever displayed on my site! Well, not untill I put this page up:

www.maxwaterholter.com/spamreporter.asp

But then they figured out how to include a snippet of javascript in their submission so that the user is just quickly redirected, so I HTML encoded their code so that it would be displayed.

I periodically flush the database out, but I capture as much info as I can about the spam submission, and could even go a step further to show statistics on IP addresses, etc... 

This might narrow them down to a particular gateway which is complicit in allowing this to go on!</description>
		<content:encoded><![CDATA[<p>Hi Huntress, I know just the punk you&#8217;re referring to in this blog! He&#8217;s been going nuts and seems easily identifiable, yet nobody is doing anything, presumably because he&#8217;s in Russia.</p>
<p>I posted this page because I got tired of manually deleting &#8220;WGAGA&#8221; pages submissions from my guestbook. I actually don&#8217;t know why they kept me in their list, because not a single one of their posts ever displayed on my site! Well, not untill I put this page up:</p>
<p><a href="http://www.maxwaterholter.com/spamreporter.asp" rel="nofollow">www.maxwaterholter.com/spamreporter.asp</a></p>
<p>But then they figured out how to include a snippet of javascript in their submission so that the user is just quickly redirected, so I HTML encoded their code so that it would be displayed.</p>
<p>I periodically flush the database out, but I capture as much info as I can about the spam submission, and could even go a step further to show statistics on IP addresses, etc&#8230; </p>
<p>This might narrow them down to a particular gateway which is complicit in allowing this to go on!
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Anonymous</title>
		<link>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-2125</link>
		<pubDate>Mon, 19 Dec 2005 21:43:44 +0000</pubDate>
		<guid>http://spamhuntress.com/2005/12/18/picking-on-guestbook-spammers/#comment-2125</guid>
					<description>&lt;strong&gt;The seo view on belgium free domain registration offer.&lt;/strong&gt;

The seo view on belgium free domain registration offer.</description>
		<content:encoded><![CDATA[<p><strong>The seo view on belgium free domain registration offer.</strong></p>
<p>The seo view on belgium free domain registration offer.
</p>
]]></content:encoded>
				</item>
</channel>
</rss>
