Fake biographies
cybe at iki.fi found some curious pages in Swedish IP space. I saw pages served from 93.158.86.1 to 93.158.89.254. They’re possible served from all IP’s in that range, and possibly even further - I can’t check them all.
He told me he saw nonsensical page with names and placeholders, no ads. I saw fake biographies of Swedish people. Why do I know they’re fake? One guy was said to have been born 1952 and died at age 62. That’s more than ten years in the future? Another biography made me laugh, it was so funny. It’s all in Swedish, so I’ll translate:
Andreas Fyrqvist:
Andreas worked with Prof. em and was born 1777 in Gothenburg. Andreas favorite color was grey and his interests were skateboard and music. He was doing Perk (whatever that is?) at elite level in Närke. Andreas lived for sport and sports and was doing cross country skiing until he went down 53 years old.
93.158.87.56/Andreas%20Fyrqvist
Give me a break, skateboarding before year 1800? All bios of men include their favorite color and some sport, as well as some profession.
All bios of women say that it was a really accomplished lady, girl or wife. It looks like a script that dips into a few arrays for colors, professions, places, ages, years, words for women, etc.
Staffan found some other IP buried in one page pointing to another country. 193.200.51.235. It’s in Romania, and is responsible for a good deal of comment spam for about a year.
Since the pages are filled with garbage in Swedish, the pages are spread around several hundred IP addresses, I assume it’s either a test, or they’re up to no good. The question is, what kind of no good? The pages have the form of a blog, with code from Yahoo’s YUI’s project (visible in the CSS files). There’s plenty of ad code in the CSS, so it’s possible they’re planning an ad driven splog system? Since we don’t see any ads or anything else of interest right now, we don’t know what the plan is. All we know is that WE think it looks phishy, and we’re not happy this is happening in Swedish IP space.
Does it work? As in, does it place in Google? Yeah. Search Google for “riktigt bra dam”, which is a common phrase on those pages, and see what you get…
The pages are in IP space belonging to Port80. The website of Port80.se redirects to Phonera. Phonera.se is a Swedish company that sells telephony and hosting services. I checked the Swedish company registry, and they’re actually registered as two different companies, though there may be some connection between them - I can’t tell.
The example you gave (”Andreas Fyrqvist”) serves a totally blank page now. Maybe they moved the store elsewhere?
Googled pages redirect to a page that says:
“Klicka här för att ta ett lån! Bara ett klick bort!”
They seem to point to h++p://www.lanefakta.se/lana_nu.php
Some form of lame evil at work, I think.
My theory is that the sites aren’t responding because they get their contents from 193.200.51.235 (”the mother ship”) and it’s not responding.
Perhaps “Klicka här för att ta ett lån! Bara ett klick bort!” you saw was a google ad?
Ok, I can confirm the “lanefakta . se” stuff too. Some of the IP’s take me to http://ppc.trafficgenerator.rrty.net/ which whisks me away to lanefakta
rrty.net is dns hosted at crystone.se and hosted at rp80.se (phonera)
nice spamming tactics phonera…
Interesting - my last name “Astevall” is actual for “Fake biographies”. In a couple of case together with my first name “Sven”. When click I reach “lanefakta.se”.
Pls, explane where do these “Scripts” come from? And how to stop them.
Once I was used under the adress
93.158.94.107/Valto%20Sven%20Tomas%20Alfred%20Astevall
butt it seems to be away today.
However, it is harmless, but I do not like it.
Hi Folks,
i googled myself and guess what i found… a fake biographie of me…arkward…where did they get my name from? i´m neither swedish nor can i understand swedish very good (i´m able to speak a bit danish).
Any ideas?
Regards from Hamburg / Germany
Nils
I contacted Phonera about this phenomena, Phonera is one of the bigger vendors in the swedish telecom market - pretty well-known, so I dont think they are behind this, and also think they are believable - and they say that this ip-span no longer belongs to them. But , really, I dont know. Accordring to the ip-lookup port80 are connected to phonera.
However I think this is not very nice to people, taking their names and use in fake biographies and state they are dead. But in the same times it pretty bizarre to read theese crazy notes, someone born in 1754 went to the doctor, the get an answer, and moved to another town, He loved ping-pong and the colour blur.. I mean.. WHAT? haha.
I have mailed phonera about this, and they claim that the ip-span is no longer belonging to them. Phonera is one of the bigger telecom vendors on the swedish mobile phone market, so I think that it may be true , because spam is not really a tactic from bigger companys. But I dont know who to trust in this.
However the texts is bizarre. I myself have found people I know stated as dead in theese texts, and the descriptions is repetetive and strange . Often someone feels ill, goes to the doctor, get an ansver (we are not told what “ansver”!!) and after that moves to another town.. The decriptions is also filled with anacronistic stuff, like people in the 1700s loving scateboard and bowling..
So, what to do? I have melded this to the swedish Datainspektionen, but they have not reacted. May be try the police.
This phenomena is also happening when searched for yourdomain.se on almoast every domain under .se Fake descriptions is occouring in about 3 different nonsence descriptions. About 36 spam hits is occouring under
.se domains.
This is a very strange behaviour by Swedish port80, Phonera and i have made a post about this at my blog:
http://alternativenergi.blogspot.com/2008/11/port-80-phoneraspamfretag.html
Its in Swedish, but it can be interesting for a lot of Swedish domain owners, i have around 10 domains that have been caused of this some kind of spam-attack.
(sorry for the double-post earlier)
Sven - I dont think you can do so much if the hits is just google cache-hits. This implies, I think, that theese texts are going to dissapear from the search engines if we just wait a little more. Maybe you could try to contact google about it - this is the only thing I think could be done - so they can remove them from their cache
A swedish site with discussion in this subject:
http://www.seo-forum.se/google/4352-konstiga-soekresultat-i-index-1.html
I have heard with the swedish autority Datainspektionen that has an officer that work with this problem and have even give the case a diary no. We will se.
Again - I have had another unpleasent and much stronger attack of scripts. !00 of them damage our integrity. Could anyone, please, advice how to stop this legal?
Or how to contact relevant department at Google Sweden or Google international?