__/ On Friday 26 August 2005 11:46, [John Bokma] wrote : \__
> Roy Schestowitz <newsgroups@xxxxxxxxxxxxxxx> wrote:
>
>> Is that a new form of spamming?
>
> blog spamming? No
I haven't seen the story as a whole. I get hit by comment and news/link
submission spam myself so I assumed this was a case of comment spam with a
URL that is a SERP.
I know someone who was hit by big piles of comment spam with Yahoo as the
URL. Needless to say, this indicated a test run, of which I see plenty
recently. They also obfuscate words like p0ker and v1agra to get past the
filters. (change in encoding, not numbers and symbols which does not help
them with SERP's)
>> Is the OP the spammer (no offense
>> intended, but it's anonymous and comes from Holland) or somebody who
>> left a message in one of his/her sites?
>
> I get them too, 6 or so, so far.
>
>> Is it just a 'flatfish'?
>>
>> I haven't actually looked at the site, but it seems dodgy:
>>
>> http://toolbar.netcraft.com/site_report?url=http://bignews.com
>
> There is no webserver running. Contacted the owner, he has no clue what
> is happening. My best guess: a test run.
E-mail spammers have a similar way of interfering with innocent
people/businesses. Their reply-to addresses call for trouble with
boxtrappers and nasty replies from spam victims.
> I am afraid it uses a zombie network:
>
> 83.145.68.131 reverse.completel.net Thu Aug 18 23:48:43 2005
> 194.89.17.3 moe.datium.fi Fri Aug 19 05:43:23 2005
> 12.42.48.204 Fri Aug 19 10:32:33 2005
> 213.69.165.21 Wed Aug 24 18:03:27 2005
> 216.17.128.2 ns2.frii.com Thu Aug 25 02:34:01 2005
> 151.203.191.170 static-151-203-191-170.wma.east.verizon.net
> Thu Aug 25 02:35:52 2005
>
> And different URL:
> REMOTE_ADDR = 148.244.150.57
> REMOTE_HOST = host-148-244-150-57.block.alestra.net.mx
>
> Probably the best thing to do is send an abuse to the IP address block
> abuse address and ask them to investigate a possible zombie.
Roy
--
Roy S. Schestowitz Useless fact: Brazil spans 47.8% of S. America
http://Schestowitz.com
|
|
