Nope, not Norwegian
I was checking the spam comments, and saw the word Flytevest. It’s Norwegian, so I started wondering if this was a Norwegian spammer.
The IP number was Swedish, but it turns out to belong to a geek who’s got a webserver on his linux server. My guess: Open proxy.
The final touch was the use of the word inside the English text, in ways that didn’t make grammatical sense. A Norwegian wouldn’t do that, even if he was using a script.
So, who’s this joker?
He’s using .be domains. And he’s got cloaking going on. The text seen by spiders is visible in grey at the bottom of the pages, but what you’ll actually SEE, is the javascript induced affiliate linkmap at the top.
life-vests.byterfer.be/flytevest.html
There’s only one access from the Swedish IP number, and it’s got this user agent:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1″
A fake one, in other words, complete with typo (missing bracket at the end).
I guess now it’s time to tell the hapless Swede…