Something very weird is going on. Someone is copying existing weblog designs to set up 'dummy' sites on a variety of domain names, apparently to increase the hits/PageRank of some central site (there's a hidden link at the bottom of each site). Observe:
original: Kevin Sites Blog
copy: worldnewslog.com
original: Brian's Education Blog
copy: akksess.com
original: beta blog
copy: jennifersblog.com
original: UFO ON LINE
copy: wr18.com
original: Mark's Life
copy: 141.85.3.115
original: Jeremy Zawodny's blog
copy: 141.85.3.116
(I'm using javascript: to link to the copies to make sure they don't get any PageRank boost by my mentioning them here.)
All the fake sites have an ip-address in the range 141.85.3.* and are being spammed as fake referrer urls to a number of real weblogs (mine and Knurpslog, to name two).
I'm currently successfully filtering them out of my automated referrer list by checking for
copy: worldnewslog.com
original: Brian's Education Blog
copy: akksess.com
original: beta blog
copy: jennifersblog.com
original: UFO ON LINE
copy: wr18.com
original: Mark's Life
copy: 141.85.3.115
original: Jeremy Zawodny's blog
copy: 141.85.3.116
(I'm using javascript: to link to the copies to make sure they don't get any PageRank boost by my mentioning them here.)
All the fake sites have an ip-address in the range 141.85.3.* and are being spammed as fake referrer urls to a number of real weblogs (mine and Knurpslog, to name two).
I'm currently successfully filtering them out of my automated referrer list by checking for
$REMOTE_ADDR != '217.73.164.106' && !strstr($REMOTE_ADDR, '141.85.3.'), which seem to be the hosts sending the fake referrers.comments
1. posted by alex at 21:11 on November 17, 2003
Same here, they are all over my referrers list as well.
2. posted by alex at 21:23 on November 17, 2003
Here are some more sites that are doing the same:
www. malixya.com
www. saulem.com
www. bongohome.com
www. mikesspot.com
www. malixya.com
www. saulem.com
www. bongohome.com
www. mikesspot.com
3. posted by milov at 21:30 on November 17, 2003
(alex: I edited your comment to make the links non-clickable, to prevent them from getting any non-deserved PageRank boost.)
I found some more too:
www. a-b-l-o-g.com
www. kwlablog.com
I found some more too:
www. a-b-l-o-g.com
www. kwlablog.com
4. posted by removeriffola.com,riffola,riffola at 21:46 on November 17, 2003
More info here: http://www.idly.org/2003/11/14/porn_sites_hiding_behind_blogs.php
Porn Sites Hiding Behind Blogs
Porn Sites Hiding Behind Blogs
5. posted by Calm_Pear at 23:17 on November 17, 2003
yep... getting the same referes here... that kind of sucks...
6. posted by 990000 at 08:55 on November 18, 2003
great sleuthing. I was baffled by those same referrers on my site.
7. posted by Tuuur at 10:39 on November 18, 2003
Found another one.
original: bigblog.com
fake: teoras.com
original: bigblog.com
fake: teoras.com
8. posted by Tuuur at 10:40 on November 18, 2003
btw, ip address from teoras.com is 141.85.3.107.
9. posted by Tuuur at 10:53 on November 18, 2003
Doing a simple reverse lookup reveals both 217.73.164.106 and the 141.85.3.* addresses are originating from Rumania:
217.73.164.106:
RoEduNet
Bucharest branch
Romanian Education Network
141.85.3.*:
RoEduNet
"Politehnica" University of Bucharest
Communication Center
217.73.164.106:
RoEduNet
Bucharest branch
Romanian Education Network
141.85.3.*:
RoEduNet
"Politehnica" University of Bucharest
Communication Center
10. posted by Tuuur at 23:30 on November 18, 2003
And there is a very elaborate discussion on the matter over here: http://www.idly.org/2003/11/14/porn_sites_hiding_behind_blogs.php
11. posted by Veronica at 01:17 on November 19, 2003
I found your website because I noticed that you're on the same IP block as the spammers. (I was going to each number in the spammers IP Block )Thanks for the information. I was wondering why I was getting strange referers from what seemed like legitimate weblogs.
12. posted by zak / betablog at 07:55 on November 19, 2003
wrote a bit about it here: http://www.betablog.com/archives/000237.html
13. posted by Jan! at 11:18 on November 19, 2003
> I found your website because I
> noticed that you're on the same IP
> block as the spammers. (I was going
> to each number in the spammers IP
> Block )
Ow? How's that? milov.nl resolves to 81.18.161.172
> noticed that you're on the same IP
> block as the spammers. (I was going
> to each number in the spammers IP
> Block )
Ow? How's that? milov.nl resolves to 81.18.161.172
14. posted by Michael W. at 22:57 on November 19, 2003
My referral log is full of the same. If I was those people that had my site spoofed I would be pissed. No so much if they spoof the layout but some of the text is word for word.