Comments on: Foiling the comment spammer

By: ady

ady — Thu, 13 Jan 2005 16:37:42 +0000

On the 68.167.234.66 machine - that’s where all those referral spam URLs (things like 8gold, fidelityfunding, uaeecommerce, etc.) apparently lead to. But the actual referral spam comes from a variety of IP addresses.

By: Ann

Ann — Wed, 12 Jan 2005 20:26:33 +0000

Well, it’s interesting

68.167.234.66 is a webserver, though a weird one. It identifies itself as Apache. Just that. Instantly suspect… It’s putting up a 301 error message, which means it’s moved permanently. But the forward is pointing to itself…

The IP number is in Covad’s IP block, and the server identifies itself as h-68-167-234-66.ns3.xgforce.com

———–

216.187.239.35
is an actual proxy server!
It serves up a 502 (proxy error) when I access it with a browser type thingie.

It identifies itself as 216-187-239-35.ded.btitelecom.net

The last one 217.160.177.124
is an Apache/2.0.49 (Linux/SuSE)
Identifies itself as: animechat.de
I’ll send them an e-mail

By: ady

ady — Wed, 12 Jan 2005 19:38:42 +0000

The same scumbag didn’t succeed in spamming comments so proceeded to bombard me with loads of referral spam instead - all of which point to the same IP: 68.167.234.66.
Other IPs which tried to spam my comments are: 207.218.184.142
216.187.239.35
217.160.177.124

All with the same UA string: “Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)”

By: Ruth Kristin Thu

Ruth Kristin Thu — Fri, 07 Jan 2005 13:39:55 +0000

Hi! I’m writing to you because I saw your norwegian site where you asked bloggers to tell you about their blogs. I am also a christian blogger, like you, and here is my blog adress if you are interested: rudydudy.blogspot.com

May God bless you and let your blog be a blessing to many people!

Your sister in Christ - Ruth Kristin Thu.