Spamhuntress

I found a referrer and checked it out. It turns out to belong to a guy who gives away free 50 meg Linux kernels to spammers.

Yeah, you heard right…

The Zaharievs get their request redirected to a Linux kernel each time they request a page from his site!

Now that’s inspired!

Oh, and I caught a small sentence there about The Aggressive Self-Defence Book. He considers himself a good guy compared to that. Sounds like it’s worth reading for evil geniouses, and spam fighters?

Search Engines Web complained about Google giving the wrong signals on Matt Cutts’ post on the Jagger update.
Prstorm was on top of the second page of what could include any number of bad Adwords advertisers on the search term Link Popularity.

Matt, can you PLEASE get a top Adwords exec to take your call?

I don’t agree with SEW’s conclusion that Google should stop banning for linkspamming, but I do think they should stop taking spammers’ money!

I did a search for prstorm.com, and found an interesting link. When I clicking on it, there was nothing pertaining to prstorm there. So I checked the cache, and found the reference in a disgraceful place. Google Adwords at the top of the page. The cache was dated October 13. Correct me if I’m wrong, but I think that’s after Steve bought the site/software?

See for yourself.

And of course, Google’s dirty little secret is that they don’t have adequate checking of Adwords. One arm of Google is vehemently opposed to linkspamming, and another department hasn’t even caught/removed one of the worst commercial linkspamming applications when they started buying Adwords.

Matt, are you listening?

I wrote about a small time referrer spammer a while ago. This morning I found a comment from said spammer. Same spammer ethics I’ve seen so many times before.

Go give him a piece of your mind:

Swedish spammer

I got ONE referrer in my log that looked fairly clean.

multipointlocks.co.uk

No link back to me, so I investigated further.

Turns out the owner has hired a freelancer for SEO and other things, from one of those freelancer coding sites. I suppose the hired help is a blackhat.

I’ve notified the owner of the site. I’m sitting there with the finger over the trigger of reporting that domain to Google for blacklisting.

Why am I even talking about this? Do NOT hire freelancers to do SEO for your valuable domains, without knowing what they’re doing. If they talk about link building, you need to know EXACTLY what they’re doing. No linkspam of any sort, or you may find me on a cranky or bored day, where I report everything I find for blacklisting on Google.

And the blackhat SEO, oh excuse me, spammer?

67.19.96.34
34.67-19-96.reverse.theplanet.com

An IIS-6 server that has a history of spamming, at least since July 24.
There’s one active site on there that I can find: shaadioffice.com

Whois:
Citycircles International asim@asimbaig.com
186-8120 #2 Road Suite 328
Richmond, BC V7C 5J8
Richmond, BC V7C 5J8, BC V7C 5J8
Canada
+604.5372339
Fax- +604.5372339

However, that IP number spammed for this site:

indianelite.com

Whois:
indianelite
Ray, Ajit [AA-402]
11111111
calcutta, Westbengal 700107, IN
Phone: 1111111111111111
Email: webmaster@indianelite.com

The guy who owns that domain also put his e-mail address on other forum comment spam runs from that IP address.

You guys should block 84.240.28.167 right away. VERY aggressive referrer spammer.

I just checked my referrer script (and no, it can’t be indexed by Google. Got .htaccess blocks in place).

And I had a few pages of hits from a bot at 84.240.28.167. It was referrer spamming
9.klikni-suka.com/linkshare.html
Which has a simple 302 redirect to searchadv.com affiliate code: 35575.

Guys, block this one in your .htaccess files. It requested my index page, which means quite a bit of kb. And every request gets a 200 code, which means he/she loads the entire page each time. I had 80 instances in my raw log when I checked it. On the other hand, I see two distinctly different patterns in the log. For some accesses, the index page has around 10136 bytes, while for others it has around 32867. For this “user”, it’s the lighter version.

The user agent used by the script is:
Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)

That same IP number checked my site a few hours earlier, and the day before, using this user agent:
Mozilla/4.0 (compatible; MSIE 6.0; Win32)

It looks to me like the domain belongs to the spammer. Have a look:

individual
Konstantin Benkunskij (K.BENKUNSKIJ@POST.SKYNET.LT)
+370.68094867
Fax: +370.68094867
Seskines 35-12
Vilnius, none 2010 LT
LT

Note, he’s had that phone number for years!

Registration Service Provided By:
Contact: domain@nswebhost.com

Name Servers:
NS1.HOSTINGZOOM.COM
NS2.HOSTINGZOOM.COM

Creation date: 09 Aug 2005 13:58:00
Expiration date: 09 Aug 2006 13:58:00

It’s on The Planet, at
70.84.135.3

And I believe 84.240.28.167 is his home or work connection. It’s at:
lan-84-240-28-167.vln.skynet.lt

Ah, yes, he apparently has a history as a mail spammer:
Linux NMR mailing list - from August 2004. And two NANAS sightings.

Michael Pollit asked me to hold back some information about Mikie Rods when that case hit. He was going to write a story for an English newspaper, and wanted some info to come out then - Mikie lost his broadband internet connection. That part of the story was something Michael had ferreted out, so it was his to release.

Now, finally - after many delays, the story is out:

Michael Pollitt enters the murky world of referrer spam.
Moral maze
From loans and ringtones to pornography: Michael Pollitt enters the murky world of referrer spam

I’m actually surprised he held back when it came to M0nkey. I know who the guy is. That may be why he more and more hid behind other people, changed the name of the software and eventually sold it.

Old stories about Mikie Rods:

No more anonymous
Photo of a spammer

I found a link in my referrer stats today and checked it out. It was a project page for an Indian company. Sort of a resume.

chrisranjana.com/projects-showcase.html

The referrer came in from 70.85.237.66. Guess what? That’s their IP number on The Planet.

I guess an example needs to be set. Try referrer spamming, just once, and kiss your Google standing goodbye!

Krin has been referrer spamming annelisabeth.com all August. Dozens of domains. He’s got some referrer software that’s misconfigured. It includes a bit more in the user agent than is normally there. You’ll recognize it if you see it.

And just so we’re clear on this:

Referrer spamming will get you banned in Google if you get caught.

Krin/Romzes - consider yourself caught…

Here’s a guy who says he’s a SEO. Yet he referrer spams his main domain.

Shakes head…

Update September 18:

I’ve removed the name, since he’s REALLY sorry he spammed, and wovs never to do it again.

BTW, he used PRstorm, without being aware of the riks.

Nobody told him Google could (and did) ban his domains.

He used referrer spamming on his MAIN domains!

He wishes other people would NOT use PRstorm, because it really isn’t worth the agony!