invasion of the blog snatchers

Something very weird is going on. Someone is copying existing weblog designs to set up 'dummy' sites on a variety of domain names, apparently to increase the hits/PageRank of some central site (there's a hidden link at the bottom of each site). Observe:

original: Kevin Sites Blog
copy: worldnewslog.com

original: Brian's Education Blog
copy: akksess.com

original: beta blog
copy: jennifersblog.com

original: UFO ON LINE
copy: wr18.com

original: Mark's Life
copy: 141.85.3.115

original: Jeremy Zawodny's blog
copy: 141.85.3.116

(I'm using javascript: to link to the copies to make sure they don't get any PageRank boost by my mentioning them here.)

All the fake sites have an ip-address in the range 141.85.3.* and are being spammed as fake referrer urls to a number of real weblogs (mine and Knurpslog, to name two).

I'm currently successfully filtering them out of my automated referrer list by checking for $REMOTE_ADDR != '217.73.164.106' && !strstr($REMOTE_ADDR, '141.85.3.'), which seem to be the hosts sending the fake referrers.

tags: posted Monday, November 17, 2003

comments

1. posted by alex at 21:11 on November 17, 2003

Same here, they are all over my referrers list as well.

2. posted by alex at 21:23 on November 17, 2003

Here are some more sites that are doing the same:

www. malixya.com
www. saulem.com
www. bongohome.com
www. mikesspot.com

3. posted by milov at 21:30 on November 17, 2003

(alex: I edited your comment to make the links non-clickable, to prevent them from getting any non-deserved PageRank boost.)

I found some more too:
www. a-b-l-o-g.com
www. kwlablog.com

4. posted by removeriffola.com,riffola,riffola at 21:46 on November 17, 2003

More info here: http://www.idly.org/2003/11/14/porn_sites_hiding_behind_blogs.php
Porn Sites Hiding Behind Blogs

5. posted by Calm_Pear at 23:17 on November 17, 2003

yep... getting the same referes here... that kind of sucks...

6. posted by 990000 at 08:55 on November 18, 2003

great sleuthing. I was baffled by those same referrers on my site.

7. posted by Tuuur at 10:39 on November 18, 2003

Found another one.

original: bigblog.com
fake: teoras.com

8. posted by Tuuur at 10:40 on November 18, 2003

btw, ip address from teoras.com is 141.85.3.107.

9. posted by Tuuur at 10:53 on November 18, 2003

Doing a simple reverse lookup reveals both 217.73.164.106 and the 141.85.3.* addresses are originating from Rumania:

217.73.164.106:
RoEduNet
Bucharest branch
Romanian Education Network

141.85.3.*:
RoEduNet
"Politehnica" University of Bucharest
Communication Center

10. posted by Tuuur at 23:30 on November 18, 2003

And there is a very elaborate discussion on the matter over here: http://www.idly.org/2003/11/14/porn_sites_hiding_behind_blogs.php

11. posted by Veronica at 01:17 on November 19, 2003

I found your website because I noticed that you're on the same IP block as the spammers. (I was going to each number in the spammers IP Block )Thanks for the information. I was wondering why I was getting strange referers from what seemed like legitimate weblogs.

12. posted by zak / betablog at 07:55 on November 19, 2003

wrote a bit about it here: http://www.betablog.com/archives/000237.html

13. posted by Jan! at 11:18 on November 19, 2003

> I found your website because I
> noticed that you're on the same IP
> block as the spammers. (I was going
> to each number in the spammers IP
> Block )
Ow? How's that? milov.nl resolves to 81.18.161.172

14. posted by Michael W. at 22:57 on November 19, 2003

My referral log is full of the same. If I was those people that had my site spoofed I would be pissed. No so much if they spoof the layout but some of the text is word for word.

15. posted by dimmy penny at 00:50 on December 14, 2003

http://www.pirated-sites.com/

hope this helps

« Rock Paper Scissors Championship | Main | photo: bricks »

weblog/photolog by Milo Vermeulen milov.nl

about

contact