Home > BlogTech > What the…

What the…

July 24th, 2004

So I’ve been getting blog referral spam lately. Spammers fake a link from their page to my site so as to get listed in my referral statistics, so that in turn their page will be listed higher in the search engines.

Well, I just got a new one: a total of 1556 hits from a new page, all generated within the last 24 hours, as if a link on that page sent 1556 people to my own web site. One would think that this was a classic referral spam attack.

Except the hits are coming from the web site of the International Atomic Energy Agency (IAEA). I checked out their site, there’s no link to mine.

What the heck is that about?!?

When I look at the stats for any occurrence of the number “1556,” I find that one web host/ISP, ool-18b8e8a7.dyn.optonline.net, is listed with this exact number of hits. Sure enough, it’s a commercial site–but it is a legitimate ISP, a Cablevision site in the New York area (where the IAEA is located). Not your usual spammer. So probably they are not the culprits. Optonline.net gets no referral link, and I seriously doubt that the IAEA is spamming me.

This seems to make no sense. Does anyone have any ideas?


Update: I’ve found out a bit more about it now. Seems to be a malicious email-address-harvesting spambot. Swell. Apparently it’s been terrorizing sites for over a year now. Obviously it spoofs the referrer, and it seems that the hacker who wrote it has either a weird sense of humor or a grudge against the IAEA.

See this page about how to block this bot and others like it.

Categories: BlogTech Tags: by
  1. July 24th, 2004 at 19:46 | #1

    I got a few referral hits from http://www.iaea.org back in Feb-Mar this year. Thought it was an odd hack but never took it farther. Now 1,500 plus hits is a different thing.

Comments are closed.