Trackback Spam From Inhoster
Been getting loads of Trackback spam attempts from 85.255.113.78 and 85.255.113.158. User agents for both are either "Net::Trackback/1.01" or "Mozilla/5.0." Again, both the IPs seem to be coming from the Ukraine.
Looking a little closer at the support email domains for those IP addresses, both ydav.com (IP: 66.230.164.69) and fwebhost.com (IP: 66.230.164.69) are registered via Estdomains and if you do a quick search of it on Google, you will see that a lot of dodgey sites seem to be registered by them. Inhoster.com (IP: 69.50.190.234) is also registered at the same place and sits at Intercage. What this all means, I'm not too sure... but they all seem interrelated somehow. Hopefully someone would be able to get to the bottom of it. Oh Spamhuntress, where art thou?
UPDATE: 21/10/2005
Similar Trackback attempts from 69.50.176.218 and 69.50.176.220, also from Intercage.
UPDATE: 24/10/2005
More from 69.50.176.43 and 69.50.176.46 from Intercage.
Comments
Hey,
i had similar problems with the inhoster trackback and comment spam, i take some time and write a small modrewrite rule, so every comment attemp from imhoster-net goes to the abuse script of imhoster.
its a little dirty, because they became mails from their own hosts but it works fine for me :)
[code]
RewriteCond %{REMOTE_ADDR} 85\.55\.11(3|4)\.[0-9]*
RewriteCond %{REQUEST_METHOD} ^POST$
RewriteRule ^/(.*)$ http://inhoster.com/abuse.php?name=test&email=abuse@inhoster.com&subject=
spam&message=a_lot_of_spam_from_%{REMOTE_ADDR} [L,R]
[/code]
best regards
micha
Posted by: micha | March 20, 2006 @ 19:35
Haha... thanks Micha! :-)
Posted by: ady | March 21, 2006 @ 08:56