Why in the world

[Li'l Abner]

would anyone post something like this in a guestbook?
------------------------------------------------------
You have a new entry in your hometown guestbook:

Name: mtxzhsqtt
IP: = 94.19.191.183 (resolves to pool.sknt.ru)
Host: =
Email: <nqyvmz@fvuovj.com>
URL: <http://dgjibcffojyn.com/>
Location: bvtdjx, ylyypakj, bcuilm
Time: Monday, January 16, 2012 at 20:19:56

Comments: 6fyXPF <a href="http://stdltqwsllkg.com/">stdltqwsllkg</a>,
vvylghbfqvpz,
[link=http://dqkxdsdlrtom.com/]dqkxdsdlrtom[/link],
http://iqwpjdqoohoc.com/
-------------------------------------------------

This is the content of the automatic email I receive from my ISP when
someone makes an entry in our hometown guestbook. I have the guestbook set
up so I have to approve the entry before it actually appears. This one, of
course, has already been rejected. I've been fighting guestbook spamming
for years. This one is written in perl and is fairly good about rejecting a
lot of the scripted exploits. Unlike a couple of php guestbooks I tried
out.
I don't ever expect to stop this crap altogether, but I just can't see the
point in it. None of the names or links are valid or I would have munged
them... just all generated crap. I just don't understand the purpose.
They're not selling anything or linking to anything.
Yeah, I know. If there was an alt.nonsenseware I would have posted it
there.
It looks like the nonsense is getting started up in here again anyway.

--
--- A dyslexic man walks into a bra ---

[G. Morgan]

Li'l Abner wrote:

>would anyone post something like this in a guestbook?
>------------------------------------------------------
>You have a new entry in your hometown guestbook:
>
>Name: mtxzhsqtt
>IP: = 94.19.191.183 (resolves to pool.sknt.ru)
>Host: =
>Email: <nqyvmz@fvuovj.com>
>URL: <http://dgjibcffojyn.com/>
>Location: bvtdjx, ylyypakj, bcuilm
>Time: Monday, January 16, 2012 at 20:19:56
>
>Comments: 6fyXPF <a href="http://stdltqwsllkg.com/">stdltqwsllkg</a>,
>vvylghbfqvpz,
>[link=http://dqkxdsdlrtom.com/]dqkxdsdlrtom[/link],
>http://iqwpjdqoohoc.com/
>-------------------------------------------------
>
>This is the content of the automatic email I receive from my ISP when
>someone makes an entry in our hometown guestbook. I have the guestbook set
>up so I have to approve the entry before it actually appears. This one, of
>course, has already been rejected. I've been fighting guestbook spamming
>for years. This one is written in perl and is fairly good about rejecting a
>lot of the scripted exploits. Unlike a couple of php guestbooks I tried
>out.
>I don't ever expect to stop this crap altogether, but I just can't see the
>point in it. None of the names or links are valid or I would have munged
>them... just all generated crap. I just don't understand the purpose.
>They're not selling anything or linking to anything.
>Yeah, I know. If there was an alt.nonsenseware I would have posted it
>there.
>It looks like the nonsense is getting started up in here again anyway.

Do you have a CAPTCHA on the form for posting?

[Bullwinkle.]

Did you post that while on drugs when your threaten women
and try to sue other posters?


"G. Morgan" <sealteam6@osama-is-dead.net> wrote in message
news47bh71rspt4pjeqrueesd5qhq5caffvd6@Osama-is-dead.net...

[FromTheRafters]

Li'l Abner wrote:
> would anyone post something like this in a guestbook?

At a guess, just to keep the filters busy.

[...]

[Virus Guy]

Li'l Abner wrote:

> would anyone post something like this in a guestbook?

(garbage stuff, including links to non-existent domains)

I did a lookup on most / all of the domains in your guestbook spam, and
none of them were even registered.

I did a google search using these terms:

use of non existent domains in blog guestbook comment link spam

But found nothing of value.

The IP is a known comment spammer:

http://www.robtex.com/ip/94.19.191.183.html#ip

A google search just on the IP address alone comes up with a few
examples. See this:

http://www.stopforumspam.com/ipcheck/94.19.191.183

The dns query result for dret.ddns.pl points to that IP address.

If you do a google search on dret.ddns.pl, you'll see a lot of wierd
****. There are lots of pages that show links for URL's within the
domain dret.ddns.pl, but none of them seem to work.

www.ddns.pl is a polish domain registrar. It's odd that they'd have one
of their own hosts point to a russian IP address with a negative
reputation.

As for why this bot is posting URL's for non-existant links?

It must have something to do with SEO. How exactly - I can't even
guess.

[Beauregard T. Shagnasty]

Virus Guy wrote:

> As for why this bot is posting URL's for non-existant links?

I get nearly identical crap via a contact form at one of my web sites.
About two or three a month. They come from IPs in Russia, France, Brazil,
Ukraine, and the U.S - and maybe others.

--
-bts
-This space for rent, but the price is high

[Li'l Abner]

Virus Guy <Virus@Guy.com> wrote in news:4F161923.B8572863@Guy.com:

> Li'l Abner wrote:
>
>> would anyone post something like this in a guestbook?
>
> (garbage stuff, including links to non-existent domains)
>
> I did a lookup on most / all of the domains in your guestbook spam,
> and none of them were even registered.
>
> I did a google search using these terms:
>
> use of non existent domains in blog guestbook comment link spam
>
> But found nothing of value.
>
> The IP is a known comment spammer:
>
> http://www.robtex.com/ip/94.19.191.183.html#ip
>
> A google search just on the IP address alone comes up with a few
> examples. See this:
>
> http://www.stopforumspam.com/ipcheck/94.19.191.183
>
> The dns query result for dret.ddns.pl points to that IP address.
>
> If you do a google search on dret.ddns.pl, you'll see a lot of wierd
> ****. There are lots of pages that show links for URL's within the
> domain dret.ddns.pl, but none of them seem to work.
>
> www.ddns.pl is a polish domain registrar. It's odd that they'd have
> one of their own hosts point to a russian IP address with a negative
> reputation.
>
> As for why this bot is posting URL's for non-existant links?
>
> It must have something to do with SEO. How exactly - I can't even
> guess.

Thanks for all the research. There was some interesting stuff there.
It's still a mystery. Maybe it's just someone with nothing better to
do... doing it to make people like me ask questions. :-(

--
--- A dyslexic man walks into a bra ---

[Li'l Abner]

G. Morgan <sealteam6@osama-is-dead.net> wrote in
news47bh71rspt4pjeqrueesd5qhq5caffvd6@Osama-is-dead.net:

> Li'l Abner wrote:
>
>>would anyone post something like this in a guestbook?
>>------------------------------------------------------
>>You have a new entry in your hometown guestbook:
>>
>>Name: mtxzhsqtt
>>IP: = 94.19.191.183 (resolves to pool.sknt.ru)
>>Host: =
>>Email: <nqyvmz@fvuovj.com>
>>URL: <http://dgjibcffojyn.com/>
>>Location: bvtdjx, ylyypakj, bcuilm
>>Time: Monday, January 16, 2012 at 20:19:56
>>
>>Comments: 6fyXPF <a href="http://stdltqwsllkg.com/">stdltqwsllkg</a>,
>>vvylghbfqvpz,
>>[link=http://dqkxdsdlrtom.com/]dqkxdsdlrtom[/link],
>>http://iqwpjdqoohoc.com/
>>-------------------------------------------------
>>
>>This is the content of the automatic email I receive from my ISP when
>>someone makes an entry in our hometown guestbook. I have the guestbook
>>set up so I have to approve the entry before it actually appears. This
>>one, of course, has already been rejected. I've been fighting
>>guestbook spamming for years. This one is written in perl and is
>>fairly good about rejecting a lot of the scripted exploits. Unlike a
>>couple of php guestbooks I tried out.
>>I don't ever expect to stop this crap altogether, but I just can't see
>>the point in it. None of the names or links are valid or I would have
>>munged them... just all generated crap. I just don't understand the
>>purpose. They're not selling anything or linking to anything.
>>Yeah, I know. If there was an alt.nonsenseware I would have posted it
>>there.
>>It looks like the nonsense is getting started up in here again anyway.
>
> Do you have a CAPTCHA on the form for posting?

Nope. Never seen one I could use with Perl. I am not currently getting
enough of the posts to mess with CAPTCHA. They have to get by me before
they'll show up in the guestbook anyway.

--
--- A dyslexic man walks into a bra ---