The John Kerry referrer joe-job
27 02 2004I had a look at my access log today and noticed a bunch of referrer entries from blog.johnkerry.com which were obviosly spam. I mean, how more obvious can it get if the user agent is “StarProse Referrer Advertising System 2004″ or even “Paid for by John Kerry“? (And why should an American candidate for president link to my blog?
)
This looked a bit too obvious to me and smelled much like a joe-job; a short `grep johnkerry access | cut -d' ' -f1 | host -x | awk -vRS='\n\n' '{print $4"\t"$2}' | sort | uniq -c | sort -nr` gave me:
| 2 | 209.91.207.161 | bess-proxy.caribe.net |
| 2 | 172.144.61.107 | AC903D6B.ipt.aol.com |
| 1 | 172.200.37.120 | ACC82578.ipt.aol.com |
| 1 | 172.155.141.2 | AC9B8D02.ipt.aol.com |
| 1 | 172.150.212.50 | AC96D432.ipt.aol.com |
| 1 | 172.142.166.154 | AC8EA69A.ipt.aol.com |
| 1 | 172.140.68.49 | AC8C4431.ipt.aol.com |
So those queries are obviously sent through open proxies, spamming random blogs with an obvious user agent string. Joe-job I say. And am not the only one who thinks so.






Recent Comments