Irony in a Referer spammer

February 19, 2006

Irony is a Referer spammer spamming my entry on how affiliate marketing is undead for something that sure looks like an affiliate marketing scheme. More irony is that this is the first Referer spammer in a donkey's age; all the old ones seem to have given up months ago.

This just goes to show that I can find amusing things from reading my server logs.

An analysis of the spammer

The spammer came from, an unremarkable DataStream Malta IP address that appears to have been doing other Referer spam (based on a Google search). It was pushing the website for, which is registered to a 'Karl Sultana' of Zebbug in Malta (who has very interesting results in a Google search I will let you do yourself).

His website is just a frame around a URL that has an embedded number in it, a typical sign of an affiliate scheme in action; the number carries through several pages into what looks like 'order something' URLs. (I lack the interest to crawl extensively.)

Sultana's website is at, hosted by pair Networks. is registered to 'Internet Marketing Center' of 1123 Fir Ave, Blaine, WA, aka, which hosts its websites out of (under FiberCloud of Bellingham WA) and has other tendrils in (under Data Fortress Group of Vancouver).

None of the websites et al are in any DNS blocklists I could spot.

Written on 19 February 2006.
« Weekly spam summary on February 18th, 2006
More on regular expression performance »

Page tools: View Source, Add Comment.
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Sun Feb 19 05:20:00 2006
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.