Spamhuntress

cybe at iki.fi found some curious pages in Swedish IP space. I saw pages served from 93.158.86.1 to 93.158.89.254. They’re possible served from all IP’s in that range, and possibly even further - I can’t check them all.

He told me he saw nonsensical page with names and placeholders, no ads. I saw fake biographies of Swedish people. Why do I know they’re fake? One guy was said to have been born 1952 and died at age 62. That’s more than ten years in the future? Another biography made me laugh, it was so funny. It’s all in Swedish, so I’ll translate:

Andreas Fyrqvist:

Andreas worked with Prof. em and was born 1777 in Gothenburg. Andreas favorite color was grey and his interests were skateboard and music. He was doing Perk (whatever that is?) at elite level in Närke. Andreas lived for sport and sports and was doing cross country skiing until he went down 53 years old.

93.158.87.56/Andreas%20Fyrqvist

Give me a break, skateboarding before year 1800? All bios of men include their favorite color and some sport, as well as some profession.

All bios of women say that it was a really accomplished lady, girl or wife. It looks like a script that dips into a few arrays for colors, professions, places, ages, years, words for women, etc.

Staffan found some other IP buried in one page pointing to another country. 193.200.51.235. It’s in Romania, and is responsible for a good deal of comment spam for about a year.
Since the pages are filled with garbage in Swedish, the pages are spread around several hundred IP addresses, I assume it’s either a test, or they’re up to no good. The question is, what kind of no good? The pages have the form of a blog, with code from Yahoo’s YUI’s project (visible in the CSS files). There’s plenty of ad code in the CSS, so it’s possible they’re planning an ad driven splog system? Since we don’t see any ads or anything else of interest right now, we don’t know what the plan is. All we know is that WE think it looks phishy, and we’re not happy this is happening in Swedish IP space.

Does it work? As in, does it place in Google? Yeah. Search Google for “riktigt bra dam”, which is a common phrase on those pages, and see what you get…

The pages are in IP space belonging to Port80. The website of Port80.se redirects to Phonera. Phonera.se is a Swedish company that sells telephony and hosting services. I checked the Swedish company registry, and they’re actually registered as two different companies, though there may be some connection between them - I can’t tell.