Irony in a Referer spammer
Irony is a
Referer spammer spamming my entry
on how affiliate marketing is undead for
something that sure looks like an affiliate marketing scheme. More irony
is that this is the first Referer spammer in a donkey's age; all the old
ones seem to have given up months ago.
This just goes to show that I can find amusing things from reading my server logs.
An analysis of the spammer
The spammer came from 18.104.22.168, an unremarkable DataStream Malta IP address that appears to have been doing other Referer spam (based on a Google search). It was pushing the website for imcmake-money-fast-online.com, which is registered to a 'Karl Sultana' of Zebbug in Malta (who has very interesting results in a Google search I will let you do yourself).
His website is just a frame around a marketingtips.com URL that has an embedded number in it, a typical sign of an affiliate scheme in action; the number carries through several pages into what looks like 'order something' URLs. (I lack the interest to crawl extensively.)
Sultana's website is at 22.214.171.124, hosted by pair Networks.
marketingtips.com is registered to 'Internet Marketing Center' of 1123 Fir Ave, Blaine, WA, aka imcinternet.com, which hosts its websites out of 126.96.36.199/26 (under FiberCloud of Bellingham WA) and has other tendrils in 188.8.131.52/27 (under Data Fortress Group of Vancouver).
None of the websites et al are in any DNS blocklists I could spot.