Bad Referer

Posted: Tue Jul 17, 2007 6:58 pm

Maybe you ´ll not notice this address:
pillenpharm.com in your referer but different forums are already filled with spam entries about pills and this url.
From my logs:

66.158.232.9 - - [16/Jul/2007:00:43:48 +0200] "GET /ftopicp-8785.html HTTP/1.0" 200 1385 "http://www.pillenpharm.com/index.html?ref_id=492&camp=viagra" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 95; BCD2000)"

I added the referer into the NukeSentinel blocker and the problem is when you use the email function also you can end up with a flood of emails.
I have a list of blocked IPs related to this url from several different countries and it looks like all are known as typical spammer.

An alternative way to ban via .htaccess is here:

http://www.ravenphpscripts.com/postp74556.html#74556

Posted: Mon Jul 23, 2007 5:14 pm

Looks like logfile spam. They have something like a partner programm and thats the reason why there is an id and why the so called partners try to link to this site using different methods like spamming in forums. Totally suspect.
I checked the german site with the same name and noticed there that the owner changed. So the .de site has nothing to do anymore with the com site.
There are a lot more suspect things with this site. Rolling Eyes

Anyone saw this url in his logs or forums ?

Btw: A way to report sites is here:

http://www.google.com/contact/spamreport.html

http://help.yahoo.com/l/us/yahoo/search/spam_abuse.html

Involved Joined: Apr 05, 2006 Posts: 263

them sods are using a lesser known mail address ive got (from merseymail.com)
to spam others
so i get lots of people thinking im doing it. life sucks then ya get divorced and the problems really begin lol.

Posted: Tue Aug 28, 2007 3:23 am

They are dirty spammers. I banned around 30 IPs.Found pillenpharm also on a illegal pharmacy blacklist.

Posted: Tue Aug 28, 2007 3:25 am

there no way to stop them either they shut one site down ,they just open another.
but the sad news is people must buy off them otherwise they wouldnt do it. Bang Head

Posted: Tue Aug 28, 2007 3:33 am

How true.Money is the name of the game.

Posted: Sat Jan 12, 2008 10:57 am

An other dirty refer spammer.
The blacklist status of this domain is clear. Rolling Eyes

Seems some guys are working hand in hand.
Doesn´t make much sense to ban the User agent or the different Proxies/IPs they use. Also I never saw them under referer within the administration.

218.7.13.186 - - [11/Jan/2008:12:25:03 +0100] "GET /ftopict-1714.html HTTP/1.0" 200 1535 "http://www.viagra-kaufen.info" "Mozilla/6.0; (Spoofed by Amiga-AWeb/3.5.07 beta)"

Solution:

Quote:

RewriteCond %{HTTP_REFERER} ^http://viagra-kaufen\.info
RewriteRule ^.* - [F]

registered · Site Admin Joined: Jun 04, 2004 Posts: 6437

Susann, thanks for the detailed, informative and helpful posts!