Irony in a Referer spammer

February 19, 2006

Irony is a Referer spammer spamming my entry on how affiliate marketing is undead for something that sure looks like an affiliate marketing scheme. More irony is that this is the first Referer spammer in a donkey's age; all the old ones seem to have given up months ago.

This just goes to show that I can find amusing things from reading my server logs.

An analysis of the spammer

The spammer came from, an unremarkable DataStream Malta IP address that appears to have been doing other Referer spam (based on a Google search). It was pushing the website for, which is registered to a 'Karl Sultana' of Zebbug in Malta (who has very interesting results in a Google search I will let you do yourself).

His website is just a frame around a URL that has an embedded number in it, a typical sign of an affiliate scheme in action; the number carries through several pages into what looks like 'order something' URLs. (I lack the interest to crawl extensively.)

Sultana's website is at, hosted by pair Networks. is registered to 'Internet Marketing Center' of 1123 Fir Ave, Blaine, WA, aka, which hosts its websites out of (under FiberCloud of Bellingham WA) and has other tendrils in (under Data Fortress Group of Vancouver).

None of the websites et al are in any DNS blocklists I could spot.

Comments on this page:

From at 2006-06-02 06:14:50:

Dear Sir,

Please remove my personal information from your blog.

My name is Karl...

To be able to display personal information of others on your site you have to ask for permission.

You have no rights to display information of other people on your site. I will take all actions to remove my personal information from your blog.


By cks at 2006-06-02 12:57:31:

The alleged 'personal information' is public information, available to all who view the WHOIS registration data for the domain In fact I have mentioned less information than is available in the WHOIS data.

WHOIS information such as this is public precisely so that interested and concerned people, such as those who have been spammed by a domain, can see who is responsible for the domain.

From at 2006-06-03 04:09:02:


Now can you state what and how did I spam?

You just mentioned my personal information but not the problem.

What sort of spam did I send or do? Mark that down as well then.


From at 2006-06-03 04:17:03:

Dear Sir,

Sorry for my other comment. Now I changed the information

on so that I no longer advertise

Now I am advertising an ebook called The Rich Jerk. That is not a scam in any way and people can buy only if they think the ebook will help them.

I don't send any spam emails. I don't own the ebook. All I do is advertise as an affiliate which I find nothing wrong with that.


From at 2006-06-03 12:12:59:


I am receiving spam emails because of you displaying personal information

on your website...

Can you please at least remove my name and address and display the website address or anything else your like? Send them to the whois link so they can find out everything else themselves.

Why do you like my website out of all that spam, scam, phising attacks, spoofs etc etc?

Why don't you report some of the "paypal spoof emails" everyone else receives. I repeat that I am just an affilaite of The Rich Jerk. He has probably 100's other affilaites like me.


By cks at 2006-06-03 15:46:05:

While this is vaguely amusing to see, I am not interested in spending my time arguing with a spammer. Your questions are more or less answered by the entry. I will not be changing the entry or spending my time to elaborate on it; further comments from you reiterating this matter will likely be removed.

By DanielMartin at 2006-06-29 11:10:35:

Aw. Please let him keep commenting. They're funny!

From at 2006-11-03 06:13:48:

I already said a couple of times that is a honest, genuine company, not an MLM.

By DanielMartin at 2006-11-08 13:27:26:

Hey! The referrer spammer came back. Isn't he cute?

Written on 19 February 2006.
« Weekly spam summary on February 18th, 2006
More on regular expression performance »

Page tools: View Source, View Normal, Add Comment.
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Sun Feb 19 05:20:00 2006
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.