I am your (insert spam word here) headquarters (Jim Carson) December 5, 2004

Categories

I am your (insert spam word here) headquarters

Sheesh. My site traffic was up over 20% in a month where I wrote very little because I was channeling my efforts into an SFD called NaNoWriMo. Work with me here, and try not to read too much into that last sentence. A random walk through my web logs shows bogus link referrals from over six hundred domains with phentermine, poker and mortgage in their names. As Debbie might say, "Buttsmurfs!"

Aside from the obvious bogus domain names, the clue it's a robot is when an html file is accessed but the friendly semi-profile on the top left corner of this page is not. The more asinine robots try to post comments or trackbacks directly into Movable Type, again without accessing any other content. Thankfully, this hasn't been a problem because of the changes I made last year, but it still pisses me off that this kind of stuff is rampant. If I were Bruce Banner, I would have ripped all of my shirts by now.

Most of the bogus link-spamming domains are using the .info and .us suffixes, because there are lots of names available here. I'm now blocking anyone who says they're referred from a host in these top level domains. If you're a legitimate business using a .info domain, and you happen to link to something on this site, I apologize for the inconvenience, though you're not going to be able to read this anyway. If you're using an .us domain, you're probably thinking this internet thing is still a fad, but you've believed the spam message saying you should reserve ImaLuddite.us before someone else did. You could have just sent me the $15 and saved everyone the effort.

I invite anyone else who's seeing this craptivity to share info on the culprits and working around it. Here's what I've added to my Apache server's .htaccess file:

RewriteEngine On RewriteCond %{HTTP_REFERER} ^http://(www\.)?.*\.info.*$ [NC,OR] RewriteCond %{HTTP_REFERER} ^http://(www\.)?.*thorcarlson.*\..*$ [NC,OR] RewriteCond %{HTTP_REFERER} ^http://(www\.)?.*valeofglamorganconservatives.*\..*$ [NC,OR] RewriteRule .* - [F,L]

I plotted out the IP addresses and came up with a cluster of worst offenders, but the distribution has a long tail. I don't know if this is some kind of nefarious spyware or hacked boxes... I haven't gotten that far. One of the worst culprits was a university in Spain, whom I wrote this evening in my best fourth-grade Spanish. I am not expecting a response, but I did feel better for writing. By virtue of my mentioning these miscreants, I'm expecting the little Google ad box in the top right corner will start serving objectionable content. Google permits opting out of particular URLS, I guess so eBay doesn't serve up ads for Yahoo and vice versa. This is impractical for my purposes, and there are no plans for a category opt-out. Really, no one comes to my site to learn about Texas Holdem (Though it's been purely serendipitous, I happen to know a lot about the mortgage business.) For those of you running Firefox on maximum paranoia mode, feel free to click on the ads and cost them some nickels.

Posted by Jim on December 5, 2004 | Permalink

5 Comments:

Debbie wrote on (December 5, 2004 4:57 PM)

Oh, the Texas Holdem buttsmurfs are the very worst. Michael is going to have to put the spam word back on the site for me. Ever since the transition to Word Press, I'm seeing a lot more spam than what I want to delete, and I don't like the idea of giving those internet thugs even two seconds worth of advertising on my site.

Funny post, Jim. I'm not laughing at your misery or anything, because I hate spammers too, but I do find it hilarious that you whipped out your fourth-grade Spanish on 'em. I have no Spanish, but I can easily visualize myself writing some uber scathing and questionably structured letters auf Deutsch.

Hey, even if you accomplished nothing else, maybe the wicked Spaniards had to strain really hard in an attempt to figure out your grammar and it gave them a bad headache. ;)

Hans wrote on (December 6, 2004 10:28 AM)

You perked my interest and I did a quick check in my logs. Yup, some of the same crap floating in there. I also checked for hits from ".info" and ".us" domains. Around 2400 for the first and only 50 for the second. A small percentage at the moment of all hits. But, if they are all spam hits then worthwhile to filter them out.

Also, if website owners would stop basking in their glory and not publish referrers then this problem might start going away.

jim wrote on (December 7, 2004 12:32 AM)

I'd be interested in comparative logs. I haven't checked too closely if there are legitimate accesses from .info or .us domains, but as little traffic as my site gets, anything more than a coupla refs and I'm curious. The other two filtered urls above were also link spammers.

Woodstock wrote on (December 7, 2004 1:46 PM)

I'm surprised at the amount of spam I do get given how few links in I actually have. Debbie's right, though, Texas Hold Em is the worst. I'm still running MT and, unfortunately, the master blacklist isn't getting updated very frequently. I'm just keeping my fingers crossed that the spam stays light.

jim wrote on (December 8, 2004 9:34 PM)

A Dutch-based ISP has been very helpful in shutting down one particular link spammer. The funny part is most of the domains they're spamming are no longer in service.

Meanwhile, I have banned 65.75.134.180 and 80.202.227.69 as a source for the especially obnoxious link spamming software that perpetuates all this nonsense.

Sun	Mon	Tue	Wed	Thu	Fri	Sat
						1
2	3	4	5	6	7	8
9	10	11	12	13	14	15
16	17	18	19	20	21	22
23	24	25	26	27	28	29
30	31

Jim Carson

This is the older blog.

Categories