Black Hat

Comment SPAM From 94.102.60.150 – 94.102.60.153

27 Comments
November 12  |  Black Hat  |   Ryan Clark

I’ve noticed a HUGE increase today in spam coming from these four IP’s(94.102.60.150, 94.102.60.151
94.102.60.152, 94.102.60.153) which are originating from Amsterdam. To me it looks like someone is testing out a new comment spam tool and it’s now being reported across the Internet. I’ve already seen some active topics about this spammer from other bloggers and I’d like to here if any of you are experiencing the same thing. All the posts are generated from a random name and email but all are producing a weird “hash” mixed with numbers and letters.

My guess is that this person is gather a giant list of all the spammable WordPress blogs and we will soon be hit with an even larger comment spam attack. I know that the digital world is just coming over the hump of Xrumer spam, but I hope you all block these IP’s within wordpress to avoid getting dropped into some spammers comment list. You can use your .htaccess to block IP addresses, and if you don’t know how to do that click on this link for a tutorial. I’ve got over 20 postings just today from the same three ip addresses so it seems like things are heating up.Here are a few blog posts on the topic as well another good look at some of the SPAM;

http://wordpress.org/support/topic/217088

http://newyorktraveler.net/getting-spammed-like-crazy-today/

http://aldebaranwebdesign.com/blog/wordpress-comment-spam-from-amsterdam/

Tagged , , , , ,

Blackhats Are Using Mashable.com For Top SERPs

2 Comments
August 18  |  Black Hat  |   Ryan Clark

I spent the evening writing a bunch of new posts for tomorrow and eventually crashed and burned. I’ve been watching Seinfeld while browsing competitive keywords to see how the black hats are gaming Google. I did a quick scan for the top listings in Canada and the US and notice this link in the top 10 http://my.mashable.com/andy379. A quick search of that URL minus the http:// and you’ll see the typical handy work of Xrumer.

I’ve seen this member profile technique a bunch of PHPBB forums, but this is the first time I’ve seen Mashable used. I can’t imagine they will let this kind of nonsense to go on, but hey it gives me a good look into what’s going on. I followed the link in the profile and then checked to see what other domains were lurking on the same host. Well needless to say this person likes his Viagra :)

Now just incase you’re thinking, yes those links on the profile page are no follow, so there isn’t a real point of spamming good ol Mashable. I don’t quite get why they do this because they have to keep repeating this back link spamming process for a mere 2-5 days of ranking. Slow and steady wins the race folks…

Tagged , , , ,