216.195.58.20
A referrer spamming bot that was active through most of November, and had it’s last recorded hit December 1st, is:
216.195.58.20
It resolves to dns237.3fn.net, which is a known entity around here. We’ve had a lot of porn coming from customers on there. Check a Google search for it on my site to see details. But the IP block belongs to APS Telecom in Portland. However, the abuse section is from 3fn, and it’s a pretty big IP block.
This outfit has been referrer spamming for some digg stories that have been removed by now.
There’s some spam to a University forum post that’s been hijacked by a method I’ve never seen before. The spammy site is placed within a cell in a table! The site is top7.biz, which is also registered with ESTdomains, and has DNS at f3n.net. The next hop is findroll.com, which is registered at Register Services, which has a calling code belonging in Estonia. The DNS servers are again from 3fn. The next hop goes through 216.195.44.106, which is also at 3fn. The link is encrypted, and goes through lightask.com or goclick.com and affiliatetracking.com
The latest spam is for sites ending in .ua, and is in Russian, so I gave that a miss.