I just had a look at my referrers (every blogger loves his referral statistics!), and noticed something weird: a bunch of referrals from other blogs, all of them with a unique domain name. Now, nothing strange so far, but all these “blogs” contain are what looks like a random news entry from somewhere. And upon further inspection, all these referrals came from the same IP; 141.85.3.130. I’ve blocked it via .htaccess.

The domain names used so far are jennifersblog.com, kwlablog.com and malixya.com.

jennifersblog.com looks like a typical personal blog running MovableType. All entres are news headers from various sources, including Reuters, AP and BBC. All entries have exactly four comments, but all links in the entry (comments, trackback, permalink) are a javascript that points back to the root of the domain.

kwlablog.com is the same deal — the first paragraph of various news items. This site gives the appearance to run on Blogger. No bogus comment/trackback links here. The entries are clearly automated, added by a script in increments of 20 minutes.

malixya.com — same shit, different name.

wr18.com — just spotted this one in the referrers. This one differs a bit. The entries don’t look like mainstream news items, but is clearly the first paragraph of texts from other places.

And once I had a look at the HTML source of the sites, it all became clear: it’s porn spammers. At the very bottom of each and every one of these fake blogs, there is an invisible gif image with a link to /adult-webcam/. This link in turn points to splash.homesexnetwork.com, which tracks you and throws you deep into the bowels of the porn industry.

It’s obvious that this is done to increase their Google pagerank, though I don’t quite understand how they expect it to happen if they just do referral spam most likely wanting to appear in the statistics on spammed blogs, and hoping that Google finds and indexes the stats. The only one who sees the referrer is the site admin, and they’re not very likely to blog about it — well, unless they’re me. And I don’t actually link to the spamvertized domains.

And while I’m at it, bloogz.com is either a referral spammer, or they have a very rude spider. In either case, they’re not welcome to this domain. Banned.

Update 031117, 19:21: Here’s another analysis, including whois info for the domains.

Update 031117, 23:36: One more spamming IP address: 217.73.164.106.

The list of spamvertized domains looks like this right now:

• jennifersblog.com
• kwlablog.com
• malixya.com
• wr18.com
• worldnewslog.com
• a-b-l-o-g.com
• akksess.com
• mikesspot.com

Adding insult to injury, the layouts of the fake blogs are stolen, too.