Comments on: Getting Spammed Like Crazy Today

By: Charles Wetherall

Charles Wetherall — Mon, 17 Nov 2008 21:53:31 +0000

Several sites I manage are getting hit hard. I’ve blocked all of the junk, but this slippery bastard is elusive. Now he’s using various forums to pass along spam. I’ve alerted several (videogamers.com, Wikispaces and DirtRagMag.com. All were very cordial and immediately pulled the perpatrators membership.

But, the scumbag will just move on to another forum and continue sending. At least I’ll slow him up.

By: Gunderson Stratford

Gunderson Stratford — Mon, 17 Nov 2008 21:21:17 +0000

Me too. It started about a week or two ago. I’m really glad I have one more thing I have to take care of every day now.

By: Jon Buhagiar

Jon Buhagiar — Mon, 17 Nov 2008 18:08:43 +0000

I have had the same on my sites. Gibberish spam I recommend that you check your logs and use a .htaccess file to deny this block of IPs. It is the same senseless spam we see on email side, all it is doing is filling the spam database with useless junk. Anyway that is my take on this.

Jon B.

By: Ty

Ty — Mon, 17 Nov 2008 10:46:18 +0000

I to have been wearing spam from the same system, its odd i myself cannot see the point to posting lists of url’s that dont point anywhere.

I first thought it was to test if your blog was “spammable” but it just makes no scene to do it like that..

My other thought is there maybe a wordpress bug they have caught on to? i have been watching my systems tightly and cannot see any evidence of anything other then comment spam.

this has been confusing me for days now!

By: Chris

Chris — Sun, 16 Nov 2008 11:40:37 +0000

The Whois information posted above is slightly misleading… the IP is actually registered to a company called Ecatel Limited, not RIPE.

ARIN maintain North American IP addresses, RIPE maintain the ones in Europe. LACNIC, AfriNic and APNIC handle the rest of the world.

So if you do a Whois query on ARIN for a European IP address, you’ll get referred to RIPE’s database and also get something like the comment “These addresses have been further assigned to users in the RIPE NCC region. Contact information can be found in the RIPE database at http://www.ripe.net/whois“.

The real whois looks more like this…

organisation: ORG-EL38-RIPE
org-name: Ecatel LTD
org-type: LIR
address: Ecatel LTD
Reinier van Eeden
P.O.Box 19533
2521 CA The Hague
NETHERLANDS
phone: +31702204015
fax-no: +31702204015
e-mail: r.eeden@ecatel.net
admin-c: RvE16-RIPE
mnt-ref: ECATEL-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
source: RIPE # Filtered
person: Reinier van Eeden
address: Archangelkade 1-3
address: 1013 BE Amsterdam
mnt-by: IQARUS-MNT
e-mail: r.eeden@nl.iqarus.com
phone: +31 64 607 11 12
nic-hdl: RvE16-RIPE
source: RIPE # Filtered

By: Jon

Jon — Thu, 13 Nov 2008 20:20:01 +0000

Glad I am not alone, same IP address, all blogs. That must be hell of a spambot someone has created. Not had anything other than gibberish yet.

By: Bas - Istanbul Expat

Bas - Istanbul Expat — Thu, 13 Nov 2008 15:54:41 +0000

I have a similar problem. Some person is posting on my name with some random English names (always first name last name) then adds his email address like ifnau@soimsf.com and just types a message like “adn9fnausunau”

I’ve been receiving about 5-10 of these messages per day now. Really annoying.

By: Matt Keegan

Matt Keegan — Thu, 13 Nov 2008 13:43:38 +0000

The last two days have been brutal. I’ve been receiving spam across my network of eight blogs and have had to go ban this I.P. and the shorter route derivative from leaving messages. That has helped as all messages now fill up my spam cache not my comments waiting folder.

By: Kathy

Kathy — Thu, 13 Nov 2008 13:17:12 +0000

Well…I’m glad to hear I’m not alone…I guess! This awful! All 5 of my blogs (some of which have been perfectly insulated from all spam) have been being hit bad.

Not liking this…

By: john b

john b — Thu, 13 Nov 2008 11:57:22 +0000

I am getting spammed from that IP as well.