Mutating Referer Spammers

August 21, 2005

Last week's Referer spammers have changed what they're shilling for and mutated their methods. Currently they seem to be shilling for online poker, although instead of clickthrough payments they seem to be angling for 'affiliate' payouts when they get people to sign up at places like pacificpoker.com, fairpoker.com, partypoker.com, and 888.com (which seem unrelated to each other).

All of the websites being Referer-spammed for are still at the IP address 64.4.195.62. Domains they've used so far include webimagineer.net, blevensdamman.com, computerxchange.com, hebei-gelatin.com, casino-solution.com, upthekazoo.com, and homesbysellers.net. Usually (but not always) they use subpages. (As with last week's domains, these also appear in blog comment spam.)

As last week, they continue to hit only the spam category blog page. However, two other bits have changed:

  • they've switched over to URL-encoding the '~' in the blog's URL; since they're the only visitors to do this, it makes their requests quite distinctive.
  • they are now making the requests from XBL-listed IP addresses (and from some that are on other DNS blocklists as compromised hosts).

Using zombies and other compromised machines slides them well over the line into black-hat territory and criminality. I suspect that anet.net (aka 'ANET Solutions Inc'), their web host, will continue to not do very much to deal with their spammers.

Given their current obliviousness to the lack of success that their attempts are having here, I'm not sure that making DWiki return error messages on their attempts would have any effect. Their software is probably pretty 'fire and forget and ignore'.

Updated Aug 23rd: they've now stopped entity-encoding the '~' in the blog's URL. Probably a software setting got changed again.

Some DNS blocklist stats on web requests

Over the past 28 days and change, we've had web requests from about 9,250 different IP addresses. Of those, only 250 IP addresses are currently listed in the XBL, and only 32 IP addresses were in the SBL. The leading SBL listing is SBL26426, which seems to be SAIX's web-cache proxies, listed for being a 'Nigerian 419' source; many of the other SBL listings are for the same thing.

Overall, I doubt I'm going to be using any DNS blocklist in front of our web server any time soon.

Written on 21 August 2005.
« Disk setup in our Fedora Core 4 Kickstart environment
Weekly spam summary on August 20th, 2005 »

Page tools: View Source.
Search:
Login: Password:

Last modified: Sun Aug 21 01:08:44 2005
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.