Comment SPAM From –

November 12  |  Black Hat  |   Ryan Clark

I’ve noticed a HUGE increase today in spam coming from these four IP’s(,, which are originating from Amsterdam. To me it looks like someone is testing out a new comment spam tool and it’s now being reported across the Internet. I’ve already seen some active topics about this spammer from other bloggers and I’d like to here if any of you are experiencing the same thing. All the posts are generated from a random name and email but all are producing a weird “hash” mixed with numbers and letters.

My guess is that this person is gather a giant list of all the spammable WordPress blogs and we will soon be hit with an even larger comment spam attack. I know that the digital world is just coming over the hump of Xrumer spam, but I hope you all block these IP’s within wordpress to avoid getting dropped into some spammers comment list. You can use your .htaccess to block IP addresses, and if you don’t know how to do that click on this link for a tutorial. I’ve got over 20 postings just today from the same three ip addresses so it seems like things are heating up.Here are a few blog posts on the topic as well another good look at some of the SPAM;

Posted in Black Hat and tagged , , , , , . Bookmark the permalink.

About Ryan Clark

I'm the CEO of Linkbuildr Marketing and the brains behind our branding and blog content. I specialize in effective marketing strategies for hotels, luxury brands and real estate. If your brand is in need of a boost then don't hesitate to contact me for a free proposal. Follow me on Google+: +Ryan Clark Twitter: @Linkbuildr on Twitter. You can also come ask me a question on our Facebook Page.  

27 Responses to Comment SPAM From –

  1. admin says:

    I should also mention it’s getting past Askimet..go figure.

  2. Thanks for the htaccess tip, I am getting spam from these ips today as well.

    MrsDealFinders last blog post..Save on Coach Bags

  3. Ari Herzog says:

    Yep, more info on the issues: My Google Analytics indicates 20 Netherlands visitors in past 30 days, yet 4 hits in past 48 hours; those 4 all created a 16-character random bit of spam that Akismet was not trained to catch. Each came from IP I don’t believe in coincidences, so will be blacklisting the IP.

    Ari Herzogs last blog post..Social Media Advice: Connect and Empower

  4. Jamie Souef says:

    i’m getting the same ones! didn’t realize it was this wide spread! Thanks for the .htaccess tip

    Jamie Souefs last blog post..Linux Tip : Sorry, sudo must be setuid root

  5. I’ve been hit from this ip range as well

  6. Jess says:

    Yea, my 10 year old’s blog has been repeatedly spammed w/ the same today – which is what lead me to google the ip and ended me up here lol.

  7. admin says:

    Looks like is picking up a lot of this data.

    You can also see in their recent comment spam section that the whole class C is spitting out spam and along with it all the keywords they’re after. Well at least we can all peer a little more into the world of a blackhat even though this guy is doing some very simple comment spam. I think real blackhats would be upset with putting this jerk in the same user space.

  8. Bryant says:

    I noticed the same thing as well. I just blocked that range for now, but if this keeps going on, hopefully akismet will be able to take care of it.

    Bryants last blog post..SideShow in Windows 7

  9. Brandon says:

    I’ve had the same problems over the last few days. We’re working on the fix you suggested.

    Brandons last blog post..5 Church Tech Links

  10. SEOkevin says:

    Thanks for bringing this to our attention Ryan. I’ll keep my eyes open for any other chatter on this and report back.

  11. markowe says:

    Thanks for the heads-up – yeah, I got a bunch of these on one of my blogs, didn’t get picked up by Akismet. Sure we can live without those ip addresses…

  12. MTBGuru says:

    Same here…
    Comes from Netinternet (Turkey) through (Amsterdam)?

  13. Our network of sites has been fighting with spammers and scammers for the past couple of years. If you don’t care about non-US traffic, you can use htaccess to block most of the countries where this is coming from. I REALLY don’t like excluding other countries, but until they get a clue, they’re blocked.

    The tutorial mentioned in the OP is GREAT and has added to my tools. If any one would like my list of “deny from” IPs that includes many non-US, countries, but also does block some English-speaking ones, I would be happy to share it. It’s best for sites that have no use for any non-US traffic. Yeah, it’s strict, and also blocks some US hosting company servers that spammers like to use.

  14. Dennis Edell says:

    Thanks for the tip., I was wondering what the hell was going on.

  15. Bob says:

    yeah, same here. is just flooding my blogs with spam.

    I wonder why akismet (or the authorities?) can’t crack down on them, obviously thousands of people are affected.

    maybe it has to do with the spam servers that got taken down a couple of days ago? (thus less email spam – maybe they found a “new outlet” for their creativity)

  16. same with me bro… ! :-(( can u give me solution for clean this spam comment?

  17. admin says:

    Askimet is now taking them out for me? If not check the link in the writeup to block it with your .htaccess

  18. Bohack says:

    Yep I have the same problem… I just installed the wordpress plugin easyban to ban the range of IPs… I will let you all know how it works out…


  19. Bohack says:

    Yep the plugin EasyBan fixed the problem… I haven’t had another spamming from this offender above since it was put in place. I am getting general spam from other IP’s and haven’t decided to ban them yet. Does work though…


    Bohacks last blog post..Windows Version of the Linux / UNIX ‘which’ Command

Leave a Reply