http://forum.bbclone.de/index.php BBClone - A PHP based Counter RDF feed http://forum.bbclone.de/index.php?t=rview&goto=3309&th=883#msg_3309
But I'm still getting occasional referrals from that site - as well as a bunch of other similar domains - that all come back to the same IP address - 219.150.118.16 - which is from Bejing, China.

The referees are from all over: the US, Thailand, China, Bahrain, and so on. The visit the blog and then leave.

You click on the texas-holdem.reachcasino link, you get this, "Account Terminated, blag, blah, blah..." page - the same exact page for all the different domains.

What are the referees? Spambots disguised as normal people? The one thing they have in common is that for OS, they all have "Windows 2003." (which last I heard, does not exist).

Anyone have any experience with this?

I banned the IP. Perhaps this will end it all.

Thanks.]]> mike 2005-01-22T20:34:24-00:00 http://forum.bbclone.de/index.php?t=rview&goto=3336&th=883#msg_3336
I've had visits from

80.200.243.153
66.237.84.20
202.28.126.77
80.32.60.84
200.160.22.66
193.188.105.16
151.142.207.11
165.234.136.183
200.68.112.65
80.58.14.44
221.214.209.194
141.150.69.30
203.197.169.19
82.194.62.
192.138.82.196
47.124.212.114

They all have in common, the same referer IP: 219.150.118.16 (from Bejing, China), although they list a bunch of different but similar domain names:

poker-hands.freakycheats.
penis.learnhowtoplay.
texas-holdem.reachcasino

and a whole bunch of other, similar names.

They also all register as having Windows 2003 for an OS.

I've had them leave comment spam and phoney trackbacks with referrer spam.

The bitch is, none of the referrer sites work - if you go to any of the listed websites (texas-holdem.reachcasino) or whatever, you just get an "Account Terminated" message in bad English: example: "The Following strange article is term of service closing - Due to mis-proper use of the hosting account."

So I'm at a loss to understand why anyone would bother to leave referrer spam for a site that doesn't exist.

Am I missing something? They've got a whole lot of bots or people working on this - as soon as I ban one IP, another one comes.

Can someone tell me what's going on?

Thanks,

Mike Pellegrini]]> mike 2005-02-02T03:01:26-00:00 http://forum.bbclone.de/index.php?t=rview&goto=3363&th=883#msg_3363
No idea why they keep running when the site is dead. Maybe nobody told the guy hiding in the philipines that he isn't making money from it anymore?]]> Jon in Michigan 2005-02-07T17:21:33-00:00 http://forum.bbclone.de/index.php?t=rview&goto=3368&th=883#msg_3368
I set bbclone to ignore the referrer (219.150.118.16) and that worked for a while, now they're coming from all over - and somehow getting through (I think theyr're using a redirect).

Different domains:

free-online-poker.yelucie.
pacific-poker.yelucie.
casino.terashells.
poker-hands.freakycheats.

They still all resolve to the one IP address - 219.150.118.16.

They went heavy on comment referrer spam on my blog, then after I made it so you had to register to leave comments, they went to trackback referrer spam. So I turned off trackbacks, now they're just cruising my site, visiting different pages at random.

Every time one of them visits, I ban the IP on my server - so they can only come on once. But new IP's keep turning up every day (about six just today).

Here's a complete list of visitors with this referrer:

80.200.243.153
202.28.126.77
80.32.60.84
200.160.22.66
193.188.105.16
151.142.207.11
165.234.136.183
200.68.112.65
80.58.14.44
221.214.209.194
141.150.69.30
203.197.169.19
82.194.62. (multiple IP's)
192.138.82.196
47.124.212.114
148.243.43.199
209.234.75.48
208.63.116.194
196.28.48.100
211.46.197.60
200.114.228.183
69.148.200.14
168.209.98.35
217.6.75.11
148.223.132.121
81.17.108.123
67.107.199.104
203.112.194.83
66.237.84.20
66.144.4. (multiple IP's)
193.194.79.194

At first, like yours, it was all "Windows 2003" for the OS, but recently, there have been all sorts of different OS's - Win 98, Win 95, Win XP and so on. Even a Mac.

Since I turned off trackbacks and comments, they haven't been able to do any damage, but it still bugs the hell out of me that they're there.]]> mike 2005-02-08T00:24:04-00:00 http://forum.bbclone.de/index.php?t=rview&goto=3407&th=883#msg_3407
That's the way I keep most spam out on our servers. Using .htaccess has a huge performance advantage over a script based solution. In case you are interested in the syntax, there are some older posts scattered across the forums where I gave some examples. A search should make them reappear again.

Olliver]]> Olliver 2005-02-10T17:53:58-00:00 http://forum.bbclone.de/index.php?t=rview&goto=3419&th=883#msg_3419
Never heard of him, but I can sure see why folks would find him truly annoying.

Thanks, I'll see if I can track down those posts you were talking about.

But what is this dude hoping to accomplish? I just don't get it, and it bugs me.

All the urls he leaves in the spam comments resolve to the one IP - the 219.150.118.16 - which just gives you the stupid, "Account suspened for mis-proper use, etc..." page.

None of the 30 or so domains the urls refer to work. So what is this guy accomplishing? Why on earth spend your time spamming for urls that do not work?

Right now, he's not doing anything on my site, except just cruising different pages - I've made it so he can't leave comments or trackbacks - but he's still there. Why?

I just don't get it...

Thanks again for your wonderful product, by the way!
]]> mike 2005-02-11T05:00:49-00:00 http://forum.bbclone.de/index.php?t=rview&goto=3446&th=883#msg_3446
I found the htaccess scripts you were talking about, but I don't think they'll work for me. As I understand it, they were based on spambob using a fairly unique OS/browser combination.

He now uses multiple OS/Browsers - there's no pattern at all - it seems completely random. I've had Mac and Linux, and Win 95 through WinXP, with all sorts of different browsers.

Is there any was, using htaccess, that I can simply ban all traffic from his referrer IP, 219.150.118.16? All the different domains he spams for all resolve to that one IP.

Thanks again...

Mike Pellegrini]]> mike 2005-02-13T06:18:02-00:00 http://forum.bbclone.de/index.php?t=rview&goto=3500&th=883#msg_3500
Olliver]]> Olliver 2005-02-23T01:28:03-00:00