« Block libwww-perl with POST
Dimago overseas »

Broken posting

Another spammer, this one with a broken comment spam tool

IP address:
87.248.167.57
Starnet in Moldova
This might be the spammer’s own address. I believe it might be worth complaining to the ISP.

User agent:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1

Here’s the whole string:
POST /wp-comments-post.php?author=Goe&email=ivan%40mail.ru&url=http%3A%2F%2Fbig-cook.dj12o.com%2F&comment=Everything%20for%20cooking.%20right%20herel!!%0D%0Ahttp%3A%2F%2Fbig-cook.dj12o.com%2F%0D%0A&comment_post_ID=204 HTTP/1.0

He consistently posts to the googlepray post.

And it’s yet another topsearch10 affiliate: 42482
This one embedded in a javascript and encoded.

This entry was posted on Sunday, February 5th, 2006 at 8:16 am and is filed under Comment spam. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

One Response to “Broken posting”

  1. Olliver Says:
    February 6th, 2006 at 10:58 pm

    If that’s the way it’s actually in your server logs, the offending spammer has forgotten to properly encode his POST string before submitting it. Once again, my presumption is someone who just got started, because forms usually belong to the first nuisances a PHP/Perl novice has to master… :-)

    Olliver

Leave a Reply