One thing I do know about is referrers. Referrers, if you don't know are pages that link to your site (in order for the pages to count as referrers, the links have to be followed). I've got a bunch--mostly Google and a handful of friends who link to me. The weird thing was I am also seeing sites I know nothing about. For a moment, I thought I was getting more popular without even trying--but then I pointed my browser at one of the URLs I didn't recognize. Where ever my link was originally, it wasn't there now. All that was there was:
The former story is currently under TOS closing - Due to miss-proper use of the hosting account
ACCOUNT TERMINATED !
This Following catalog is now under closing order - Due to miss-proper use of the hosting account
ACCOUNT TERMINATED !
The former scene is term of service closing - Due to miss-proper use of the hosting account
ACCOUNT TERMINATED !
So what's up with these damn sites?
This isn't where I stopped, however. A quick search of WHOIS and here's what I found for the domain "sportsparent.com":
Domain Name: SPORTSPARENT.COM
Registrant:
Reece, Thomas
249 W 89 Street
NYC
NY
US
10024
Administrative Contact:
Reece, Thomas (NIC-21871) contact100@team-support-24x7.net
Thomas Reece
249 W 89 Street
NYC
NY, US
10024
Phone: 2128732251
Billing Contact:
Reece, Thomas (NIC-21871) contact100@team-support-24x7.net
Thomas Reece
249 W 89 Street
NYC
NY, US
10024
Phone: 2128732251
Technical Contact:
Reece, Thomas (NIC-21871) contact100@team-support-24x7.net
Thomas Reece
249 W 89 Street
NYC
NY, US
10024
Phone: 2128732251
Domain ID:D105452293-LROR
Domain Name:TMSATHAI.ORG
Created On:20-Dec-2004 12:08:40 UTC
Last Updated On:24-Dec-2004 12:35:38 UTC
Expiration Date:20-Dec-2005 12:08:40 UTC
Sponsoring Registrar:Moniker Online Services Inc. (R145-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:moniker21871
Registrant Name:Thomas Reece
Registrant Organization:Thomas Reece
Registrant Street1:249 W 89 Street
Registrant Street2:
Registrant Street3:
Registrant City:NYC
Registrant State/Province:NY
Registrant Postal Code:10024
Registrant Country:US
Registrant Phone:+1.2128732251
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:contact100@team-support-24x7.net
Admin ID:moniker21871
Admin Name:Thomas Reece
Admin Organization:Thomas Reece
Admin Street1:249 W 89 Street
Admin Street2:
Admin Street3:
Admin City:NYC
Admin State/Province:NY
Admin Postal Code:10024
Admin Country:US
Admin Phone:+1.2128732251
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:contact100@team-support-24x7.net
Tech ID:moniker21871
Tech Name:Thomas Reece
Tech Organization:Thomas Reece
Tech Street1:249 W 89 Street
Tech Street2:
Tech Street3:
Tech City:NYC
Tech State/Province:NY
Tech Postal Code:10024
Tech Country:US
Tech Phone:+1.2128732251
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:contact100@team-support-24x7.net
Domain Name: HOUSEOFSEVENGABLES.COM
Registrant:
Reece, Thomas
249 W 89 Street
NYC
NY
US
10024
Administrative Contact:
Reece, Thomas (NIC-21871) contact100@team-support-24x7.net
Thomas Reece
249 W 89 Street
NYC
NY, US
10024
Phone: 2128732251
Billing Contact:
Reece, Thomas (NIC-21871) contact100@team-support-24x7.net
Thomas Reece
249 W 89 Street
NYC
NY, US
10024
Phone: 2128732251
Technical Contact:
Reece, Thomas (NIC-21871) contact100@team-support-24x7.net
Thomas Reece
249 W 89 Street
NYC
NY, US
10024
Phone: 2128732251
domain: GANDI.NET
owner-address: Gandi SARL
owner-address: 38 rue Notre-Dame de Nazareth
owner-address: F-75003
owner-address: Paris
owner-address: France
owner-phone: +33.1
owner-e-mail: bfe16a8b85d335aa8ac5f96b13f8ab46-286444@owner.gandi.net
admin-c: NG270-GANDI
tech-c: NG270-GANDI
bill-c: NG270-GANDI
nserver: dns0.gandi.net 217.70.177.39
nserver: dns1.gandi.net 80.67.173.2
nserver: dns2.gandi.net 80.67.173.21
nserver: dns3.gandi.net 217.70.179.36
reg_created: 1999-05-21 10:09:21
expires: 2010-05-21 10:09:56
created: 2000-02-23 12:12:59
changed: 2004-09-22 12:14:10
person: NOC Gandi
nic-hdl: NG270-GANDI
address: GANDI
address: 38 rue Notre-Dame de Nazareth
address: 75003
address: Paris
address: France
phone: +33.1
e-mail: 6f4ab1c83ad76f06c34c964adcd005af-ng270@contact.gandi.net
lastupdated: 2004-11-22 13:46:04
So, here's my theory: Thomas Reece gets Gandi.net a cheap hosting company in France to host his crappy gateway sites that then direct traffic to his Phentermine/Viagra scams that sucker people into giving up their scratch for drugs that may or may not show up. Regardless, the sites have violated Gandi's terms of service and are shut down. This is why the English above is so bad. (" This entire info is now in terminal closing") So, I wonder if I should take advantage of my free night-time long distance on my cell phone and call the bastard at 3:00am.
Ha, no, I shouldn't--after all, it's 6am in NYC right now.
Still, I'm puzzled as to how his sites referred to my site at all.
Very puzzling...
Of course, it didn't have to end there, so I did a quick Google search for "Thomas Reece" and "spam" and I found this post at JLuster.org. One thing he explains is that site spammers leave links in the comments section of posts--the thing is, I have this kick-ass anti-comment-spam-measure that has kept me from comment spam since I activated it. So, in the end, that's what this all is about. The catch is, there's this Thomas Reece dickweed out there still. Here's what JLuster.org says about him and Gandi.net:
While investigating the last round of about 5,000 such SPAMs, I found one very common pattern - all existing advertised domains are registered with Gandi. Gandi lists an email address ending in @team-support-24x7.net as the contact info, a domain that is parked at Gandi and supposedly belonging to a Monika Stanes in Aruba. I’m not sure, but I wouldn’t be surprised if that one was a fake.
There is, however, one fact that can be traced. New Yorkers, please help me here. One common pattern with @team-support-24x7.net domains is another name: Thomas Reece. And Mr. Reece, who is named as the registrant for a few commentSPAM for phentermine, Viagra, and Hold’em Poker, as well, claims to have residence at 249 W 89 Street in New York City, NY. He even used a phone number a few times. If anyone near that place could take a walk and tell me what that address is all about (take a phonepic and send it to me, and I’ll make you the first Golden Mallet recipient outside Usenet), we could take the next step.
SPAMMERS SUCK.
Thank you and good morning :)
Read part 2 of this post.
That's crazy man. I used a blacklist plugin and haven't gotten any spam since. I'm trying to find the plugin the wp gurus made out of that hack now. But you ever notice that NOBODY gets any hits from Russia! JLuster's Hitmap is all red sans Russia.
ReplyDeleteI just checked my referrers links and mine had the same notice but it was for this address: http://www.thatwhichis.com/
ReplyDeleteYeah, same guy. Well, the good thing is the both of us have decent protection. I just wish there was an electronic version of frontier justice. You know, where we could hire some cyber-gunman to go get this guy and take care of him. He can be on the 'net, he just shouldn't be able to do that kind of business. Of course, if people weren't so stupid, they wouldn't fall for this type of guy's scams.
ReplyDeleteOh well--just figured I'd blog about it in case anyone else noticed the same thing.
As for the Russia-thing--yeah, that is weird. I get hits from all sorts of different countries--Japan, China, Korea, even hits from what looks like Saudi Arabia, Iraq--wait a sec--I do see a hit from someplace that looks to far east to be Europe. Yeah, man--I just checked an atlas and I'm getting 1-2 hits from someone in Moscow and someone west of Moscow. So, in all, I'm getting 2-4 hits from Russians. :) I wonder if I should find a Russian translator program :)
I went one further. I checked the domains I got in my referrer log from the master spambot. Most of them had that termination notice. Problem is, I believe it's false. Virtually all of the domains pinged the same server, and it hasn't been terminated. Spammy name...
ReplyDeleteAnd there's a link to Alexander Morozov as well. Indirect, but still there. Remember him?
More on my blog.
Hi Ann, I just checked your site and wow--you know way more about this stuff than I do. Like you said in your comment, you took it one further--a LOT further. All I know how to do is do the simple stuff, but pinging servers and so on, that's over my head. Thanks so much for your efforts to get to the bottom of this. I find it frustrating though that even you can't solve this issue--not that I blame you. These spammers are devious and clever.
ReplyDeleteJust for giggles I did a google search for your pal Alexander Morozov and found that the name is very common. There's a marketting manager who works for JetBrains.com. There's also a bass player for the Leningrad Kirov Opera. There's yet another Alexander Morozov who is a theoretical physicist in the Netherlands. My favorite Alexander Morozov out there has to be the Alexander Morozov who works in the Economic Unit of the World Bank, Moscow Office. >shudder<
The whole thing is puzzling. I do have one question for you, Ann. If I'm not actually getting comment/trackback spam what harm are these people doing to my site? Is it just bandwidth clogging or is it something else? I'm new to this level of stuff.
And I found lots of posts from one of them in Russian usenet groups. Do a google usenet search and see for yourself. Sort by date, and you'll see very recent postings. One Alexander is a gamer.
ReplyDeleteHi
ReplyDeleteI run a WP site too, and I´ve been seeing the same sort of referers in my stats. I was wondering what it was so Google brought me here. Nice detective work. I was suspecting it to be comment-spammers, too. Thank God for anti-comment-spam measures. And thank you for digging up the dirt.
Nick / Oslo, Norway / <a href="http://sponbustion.com>Sponbustion Magazine</a>
I've decided those sites haven't been suspended at all--they're just pretending because I see that they keep coming in from the same domains. I'm going to send Gandi.net an email to complain about this. I'm sick of my traffic being falsely elevated by spamming bastards. I'll post more once I do this. If anyone else has any stories about this, please post here or use the trackback so we'll know you wrote about it. Thanks!
ReplyDeleteAnd thanks everyone for your comments--the more posts there are on this, the more everyone will know what's going on.
I finally got around to doing another post on this. Check it out here.
ReplyDelete