« Mmm... Ramly Burger! | Main | More Ramadan Delights »


Friday, October 21, 2005

Trackback Spam From Inhoster

Been getting loads of Trackback spam attempts from 85.255.113.78 and 85.255.113.158. User agents for both are either "Net::Trackback/1.01" or "Mozilla/5.0." Again, both the IPs seem to be coming from the Ukraine.

Looking a little closer at the support email domains for those IP addresses, both ydav.com (IP: 66.230.164.69) and fwebhost.com (IP: 66.230.164.69) are registered via Estdomains and if you do a quick search of it on Google, you will see that a lot of dodgey sites seem to be registered by them. Inhoster.com (IP: 69.50.190.234) is also registered at the same place and sits at Intercage. What this all means, I'm not too sure... but they all seem interrelated somehow. Hopefully someone would be able to get to the bottom of it. Oh Spamhuntress, where art thou?


UPDATE: 21/10/2005

Similar Trackback attempts from 69.50.176.218 and 69.50.176.220, also from Intercage.


UPDATE: 24/10/2005

More from 69.50.176.43 and 69.50.176.46 from Intercage.

Comments

Hey,

i had similar problems with the inhoster trackback and comment spam, i take some time and write a small modrewrite rule, so every comment attemp from imhoster-net goes to the abuse script of imhoster.

its a little dirty, because they became mails from their own hosts but it works fine for me :)

[code]
RewriteCond %{REMOTE_ADDR} 85\.55\.11(3|4)\.[0-9]*
RewriteCond %{REQUEST_METHOD} ^POST$
RewriteRule ^/(.*)$ http://inhoster.com/abuse.php?name=test&email=abuse@inhoster.com&subject=
spam&message=a_lot_of_spam_from_%{REMOTE_ADDR} [L,R]
[/code]

best regards
micha

Haha... thanks Micha! :-)

Post a comment


Archives



Powered by
Movable Type 3.35