The John Kerry referrer joe-job

27 02 2004

I had a look at my access log today and noticed a bunch of referrer entries from blog.johnkerry.com which were obviosly spam. I mean, how more obvious can it get if the user agent is “StarProse Referrer Advertising System 2004″ or even “Paid for by John Kerry“? (And why should an American candidate for president link to my blog? ;-))

This looked a bit too obvious to me and smelled much like a joe-job; a short `grep johnkerry access | cut -d' ' -f1 | host -x | awk -vRS='\n\n' '{print $4"\t"$2}' | sort | uniq -c | sort -nr` gave me:

2 209.91.207.161 bess-proxy.caribe.net
2 172.144.61.107 AC903D6B.ipt.aol.com
1 172.200.37.120 ACC82578.ipt.aol.com
1 172.155.141.2 AC9B8D02.ipt.aol.com
1 172.150.212.50 AC96D432.ipt.aol.com
1 172.142.166.154 AC8EA69A.ipt.aol.com
1 172.140.68.49 AC8C4431.ipt.aol.com

So those queries are obviously sent through open proxies, spamming random blogs with an obvious user agent string. Joe-job I say. And am not the only one who thinks so.


Actions

Informations

Leave a comment

You can use these tags : <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>