Irony is a Referer spammer spamming my entry on how affiliate marketing is undead for something that sure looks like an affiliate marketing scheme. More irony is that this is the first Referer spammer in a donkey's age; all the old ones seem to have given up months ago.

This just goes to show that I can find amusing things from reading my server logs.

An analysis of the spammer

The spammer came from 217.15.96.18, an unremarkable DataStream Malta IP address that appears to have been doing other Referer spam (based on a Google search). It was pushing the website for imcmake-money-fast-online.com, which is registered to a 'Karl Sultana' of Zebbug in Malta (who has very interesting results in a Google search I will let you do yourself).

His website is just a frame around a marketingtips.com URL that has an embedded number in it, a typical sign of an affiliate scheme in action; the number carries through several pages into what looks like 'order something' URLs. (I lack the interest to crawl extensively.)

Sultana's website is at 209.197.103.186, hosted by pair Networks.

marketingtips.com is registered to 'Internet Marketing Center' of 1123 Fir Ave, Blaine, WA, aka imcinternet.com, which hosts its websites out of 216.57.212.192/26 (under FiberCloud of Bellingham WA) and has other tendrils in 65.110.16.0/27 (under Data Fortress Group of Vancouver).

None of the websites et al are in any DNS blocklists I could spot.