November 2003

invasion of the blog snatchers

Something very weird is going on. Someone is copying existing weblog designs to set up 'dummy' sites on a variety of domain names, apparently to increase the hits/PageRank of some central site (there's a hidden link at the bottom of each site). Observe:

original: Kevin Sites Blog
copy: worldnewslog.com

original: Brian's Education Blog
copy: akksess.com

original: beta blog
copy: jennifersblog.com

original: UFO ON LINE
copy: wr18.com

original: Mark's Life
copy: 141.85.3.115

original: Jeremy Zawodny's blog
copy: 141.85.3.116

(I'm using javascript: to link to the copies to make sure they don't get any PageRank boost by my mentioning them here.)

All the fake sites have an ip-address in the range 141.85.3.* and are being spammed as fake referrer urls to a number of real weblogs (mine and Knurpslog, to name two).

I'm currently successfully filtering them out of my automated referrer list by checking for $REMOTE_ADDR != '217.73.164.106' && !strstr($REMOTE_ADDR, '141.85.3.'), which seem to be the hosts sending the fake referrers.

alex wrote on 2003/11/17:: Same here, they are all over my referrers list as well.

alex wrote on 2003/11/17:: Here are some more sites that are doing the same:

www. malixya.com
www. saulem.com
www. bongohome.com
www. mikesspot.com

milov wrote on 2003/11/17:: (alex: I edited your comment to make the links non-clickable, to prevent them from getting any non-deserved PageRank boost.)

I found some more too:
www. a-b-l-o-g.com
www. kwlablog.com

riffola wrote on 2003/11/17:: More info here: http://www.idly.org/2003/11/14/porn_sites_hiding_behind_blogs.php
Porn Sites Hiding Behind Blogs

Calm_Pear wrote on 2003/11/17:: yep... getting the same referes here... that kind of sucks...

990000 wrote on 2003/11/18:: great sleuthing. I was baffled by those same referrers on my site.

Tuuur wrote on 2003/11/18:: Found another one.

original: bigblog.com
fake: teoras.com

Tuuur wrote on 2003/11/18:: btw, ip address from teoras.com is 141.85.3.107.

Tuuur wrote on 2003/11/18:: Doing a simple reverse lookup reveals both 217.73.164.106 and the 141.85.3.* addresses are originating from Rumania:

217.73.164.106:
RoEduNet
Bucharest branch
Romanian Education Network

141.85.3.*:
RoEduNet
"Politehnica" University of Bucharest
Communication Center

Tuuur wrote on 2003/11/18:: And there is a very elaborate discussion on the matter over here: http://www.idly.org/2003/11/14/porn_sites_hiding_behind_blogs.php

Veronica wrote on 2003/11/19:: I found your website because I noticed that you're on the same IP block as the spammers. (I was going to each number in the spammers IP Block )Thanks for the information. I was wondering why I was getting strange referers from what seemed like legitimate weblogs.

zak / betablog wrote on 2003/11/19:: wrote a bit about it here: http://www.betablog.com/archives/000237.html

Jan! wrote on 2003/11/19:: > I found your website because I
> noticed that you're on the same IP
> block as the spammers. (I was going
> to each number in the spammers IP
> Block )
Ow? How's that? milov.nl resolves to 81.18.161.172

Michael W. wrote on 2003/11/19:: My referral log is full of the same. If I was those people that had my site spoofed I would be pissed. No so much if they spoof the layout but some of the text is word for word.

dimmy penny wrote on 2003/12/14:: http://www.pirated-sites.com/

hope this helps