The Reffy spammers - update
Just a little update on the spammers.
M0nkey just got himself a new site to sell his little referrer spammer tool, Reffy. Not hard to guess the URL: reffy dot net. The domain is hosted on the hosting service frogee.com. Their rep re spam could go either way. I’m thinking it’s worth complaining to them. S-PAN, you’ll need to e-mail service at frogee dot com. He didn’t spam my log, so I can’t send it - yet. Here’s the Frogee TOS
Since I last talked about them, I’ve found one of their hangouts.
They used to have a site called adultgods, where they sold spam software. But because they advertised the site URL in the user agent field, GoDaddy took their domain away from them (and somebody else owns it now). Since then they’ve changed registrar, and tells others that you’ll be able to keep your domain (I get the feeling no matter what you do) if you’re with the right registrar. I guess that should be put to the test soon, eh? At the time, the team consisted of Odin and Weigan. Weigan now usually goes by M0nkey. Even as early as October 29, there were links to adminshop and xopy, though. Xopy had the link text: Nationalist Network. Sounds faintly nazi…
(UPDATE: I’ve been thinking about Weigan. I think it’s a misspelling of Norwegian. A sort of joke)
Odin says he’s not really involved in the referrer spamming side of the business. That sounds about right, since it’s M0nkey that keeps doing that (NextGentel IP numbers), but Odin is often defending him in public.
They’re into the adult website business, although I think I’ve seen Odin claim he’s not. Or rather, a weak denial - that he doesn’t own any. I don’t believe him, though.
UPDATE: See the post below about blocking spammers. I’m wondering if Cindy’s block works against this software? From what she’s telling me, that’s a possibility. For those of you that are plagued, you could try it out?
More posts on the dynamic duo, also called “The Norwegian spammer”
Post 214
Post 216
Post 225
UPDATE: I checked the law in Norway, and the way I read it, M0nkey, who is a Norwegian citizen, is in breach of the law. He’s not allowed to send ANY kind of electronic advertisements to any physical person, except those he’s already in a business relationship with (ie his customers). In Norwegian law, that includes companies. M0nkey, I’m putting you on notice - I’m Norwegian, and you’ve been spamming me. You’re in breach of Norwegian law!
January 30th, 2005 at 12:34 am
Referral spam generator
Reffy - reffy dot net (I won’t even come close to giving them a link!)
Reffy dot net is dedicated to exposing the exciting potentialities of referrer marketing, a field that was pioneered with the powerful windows-based tool named Reffy, which we sell…
January 30th, 2005 at 10:10 am
Adminshop, Reffy, and Referrer Log “Marketing”
(A note to companies thinking of resorting to referrer log marketing: don’t. It’s annoying and unethical, it has little effect on your search engine rankings…
January 30th, 2005 at 2:13 pm
Looks like old reffy got a new IP address. Stuff is showing up from IP address: 220.244.224.171
Looks like some Australian internet provider. They have a link for abuse:
http://www.tpg.com.au/about/enquiry.php?type=Report%20Spamming
inetnum: 220.244.0.0 - 220.245.255.255
netname: TPG-AU
descr: TPG Internet Pty Ltd.
country: AU
admin-c: TH178-AP
tech-c: TH178-AP
status: ALLOCATED PORTABLE
remarks: Australian Internet Service Provider (ISP)
remarks: http://www.tpg.com.au
January 30th, 2005 at 2:28 pm
That IP number has a Squid server on it. Could just be a proxy. Not sure it’s an open proxy, though. It could be an ISP specific proxy. Either way, send the abuse message.
January 30th, 2005 at 6:08 pm
Reffy has a rival:
130.94.135.216 - - [30/Jan/2005:18:00:34 +0100] “POST /~arthur/cgi-bin/mt-comments.cgi?entry_id=773 HTTP/1.1″ 302 306 “http://www{DOT}php{DASH}soft{DOT}com” “”
Note their impertinent “Perfect submission engine for messages boards, guestbooks, blogs and other scripts with different submission form structure.” on their home page.
January 30th, 2005 at 6:30 pm
And notice how that domain is hosted at esthost…
I can’t find any prior listings for the IP number, though. Could be they’re doing it from an account at splitinfinity {dot} net?
Could you send them an abuse message? And include the log entries.
January 31st, 2005 at 4:54 pm
Oh, the Reffy folks have been nagging me for months. Since last August, at least, starting with webdevboard.com spam and then the adminshop spam and including xopy as well. See this post http://www.flashesofpanic.com/panic/000413.php and the comments for that history; it was my first case of referer spam. Note in the comments that someone linked them to the whiteguysgroup dot com domain, which sounds even more Nazi than what you’ve found.
This guy http://elliottback.com/wp/archives/2004/09/06/reef-v10-free-referrer-spam-tool/ was sufficiently annoyed that he… created a free referrer-spam tool to try to undercut their business. (Talk about cutting off one’s nose to spite one’s face.)
January 31st, 2005 at 5:27 pm
It’s their nameserver, so yeah, there’s a connection.