SE Spammer Revealed

Halfdeck · 2005-07-06, 08:49 PM

Quote:

Originally Posted by gideon

I have already got so many guys removed it took me a few minutes to find one lol.. but here is one
google this "site:wftp.org"

It's funny how the guy doesn't even bother using the noarchive tag. Also interesting that alot of the spam pages that stick out at me are using java redirects instead of IP cloaking. Finally, it's pretty surprising to find some of those pages show a PR of 4.

Halfdeck · 2005-07-06, 10:16 PM

Here is one guy using the same script/database to generate the same exact pages over multiple domains (and I'm not talking just 2-3). He does use a noarchive tag, so who knows, the pages may well be cloaked.

premiumxxxlinks.com
netcybersex.com
finderoticlinks.com
foxypetites.com
jackoffsites.com
viewpornos.com
foxytranssexuals.com
smutplaza.com
nakedblondies.com
nakedpeeing.com
11inchdicks.com
xlbreasts.com
nudesites.net
xxxsexorgy.com
sexyviews.com
ipornlinks.com
xxxnakedsites.com
over30porn.com
xxxindexer.com
xxxexhibitionists.com
nakedbisexuals.com
upskirtlove.com
xxxsitereviews.com
seesexvideos.com
xxxpornlinks.net
sexsitedomains.com
myadultlinks.net

There are tons more, but my fingers are getting tired, so I'll stop here.

Notice he uses comments <-- keywords: --> and <-- description: --> in the HTML a number of times on the top/bottom of the page. He also uses <img src width=1 height=1 ALT="description:......."> to put more invisible text on the page.

He uses multiple CCBill accounts, including 603702, 620418, 603704, and many more (I guess he decided to use a different account for each site, for whatever reason).

DHDRevEx affiliate code: 107924
Porn Star Bucks: 17114
Verotel ID: 9804000000567825
Dollar 4 Babes: 103118
Gorgia Cash: 100189
ARS: 94164
Silvercash: 257472
Light Speed Girls: 39767
Maximum Cash: nkamat
Gorilla Cash: gt2103
Giga Cash: 156751
Epic Cash: fslfsl
Adult Lounge: 101419
Traffic Cash Gold: top10links
Sunny Dollars: 1364
Pimp Roll: pimp4753
Adult Players Club: hcfsl
Platinum Bucks: 1259
Top Bucks: 5776

..The list goes on.

BTW, you can't find the affiliate codes from looking at the source code. I was able to see the actual affiliate links using http://web-sniffer.net/

Good news is only about 150 pages from each domain is indexed in Google, so far. The bad news is if a domain ranks for a key phrase, and positions above your page, then your page will be pushed a *few* pages down from all the above domains showing up above your link. Read the descriptions for all the listings and of course they're identical, except for the leading text which contains the domain name (I guess used to avoid being listed as similar pages).

EDIT: Added a few more info as I came across more stuff. Double check the affiliate IDs; since I extracted them from ref codes, I can't vouch for their complete accuracy.

Bill · 2005-07-07, 03:55 AM

gideon, that's a beautiful sample. That's a classic.

halfdeck, from your original description I was momentarily doubtful, but all it takes is dropping two or three of those names into the googlebar to see that it's just a distributed version of the first one. A lot of structural similarities, actually.

Two good finds.

Halfdeck · 2005-07-07, 09:32 AM

Quote:

Originally Posted by Bill

all it takes is dropping two or three of those names into the googlebar to see that it's just a distributed version of the first one. A lot of structural similarities, actually.

Yep.

Just do a search on google for "kristina lee" porn to see the pages in action.

http://www.google.com/search?hl=en&l...rn&btnG=Search

With 10 results/page, you're looking at result pages 1-41 taken over by this guy's duplicate pages...(so redefine site positioned above mine to SITES positioned above mine) and he's not even using subdomains. Freeone comes up on page 31, and they usually place relatively high for model names. Rabbitsreview on page 38-39, and my pages on 37.

Even if Google had a "block this site" feature, the surfer will have to do a lot of clicking to make those links dissappear.

Linkster · 2005-07-07, 10:40 AM

Im hoping thats a fake addy in the whois - since that addy is also located on this page http://www.webfoot.com/shareweb.html

kinda strange though - its the same whois on at least 400 domains I found

Linkster · 2005-07-07, 10:41 AM

Also noted that in Googles listings they already see these as dupes - theyre labelled as supp results so should be out next update

Bill · 2005-07-08, 07:29 PM

BTW, if anyone wants to submit a sample anonymously, just PM me with your find and I'll present it.

I've been busy practicing with wordpress the last few days, so I'm a little behind hunting my own samples, but this is still a very front-burner experiment in my thoughts.

Both of those samples are in the supplemental results Linkster? That's a shame - we'll need to keep looking for newer samples.

We'll have to figure out how to keep this information in some sort of spam record, so we can track these things over time.

Halfdeck · 2005-07-09, 08:51 AM

Quote:

Originally Posted by Linkster

Also noted that in Googles listings they already see these as dupes - theyre labelled as supp results so should be out next update

Great, more room for my sites to breathe, hopefully soon

2005-07-06, 10:16 PM	#2
Halfdeck You can now put whatever you want in this space :) Join Date: Oct 2004 Location: New Haven, CT Posts: 985	Here is one guy using the same script/database to generate the same exact pages over multiple domains (and I'm not talking just 2-3). He does use a noarchive tag, so who knows, the pages may well be cloaked. premiumxxxlinks.com netcybersex.com finderoticlinks.com foxypetites.com jackoffsites.com viewpornos.com foxytranssexuals.com smutplaza.com nakedblondies.com nakedpeeing.com 11inchdicks.com xlbreasts.com nudesites.net xxxsexorgy.com sexyviews.com ipornlinks.com xxxnakedsites.com over30porn.com xxxindexer.com xxxexhibitionists.com nakedbisexuals.com upskirtlove.com xxxsitereviews.com seesexvideos.com xxxpornlinks.net sexsitedomains.com myadultlinks.net There are tons more, but my fingers are getting tired, so I'll stop here. Notice he uses comments <-- keywords: --> and <-- description: --> in the HTML a number of times on the top/bottom of the page. He also uses <img src width=1 height=1 ALT="description:......."> to put more invisible text on the page. He uses multiple CCBill accounts, including 603702, 620418, 603704, and many more (I guess he decided to use a different account for each site, for whatever reason). DHDRevEx affiliate code: 107924 Porn Star Bucks: 17114 Verotel ID: 9804000000567825 Dollar 4 Babes: 103118 Gorgia Cash: 100189 ARS: 94164 Silvercash: 257472 Light Speed Girls: 39767 Maximum Cash: nkamat Gorilla Cash: gt2103 Giga Cash: 156751 Epic Cash: fslfsl Adult Lounge: 101419 Traffic Cash Gold: top10links Sunny Dollars: 1364 Pimp Roll: pimp4753 Adult Players Club: hcfsl Platinum Bucks: 1259 Top Bucks: 5776 ..The list goes on. BTW, you can't find the affiliate codes from looking at the source code. I was able to see the actual affiliate links using http://web-sniffer.net/ Good news is only about 150 pages from each domain is indexed in Google, so far. The bad news is if a domain ranks for a key phrase, and positions above your page, then your page will be pushed a few pages down from all the above domains showing up above your link. Read the descriptions for all the listings and of course they're identical, except for the leading text which contains the domain name (I guess used to avoid being listed as similar pages). EDIT: Added a few more info as I came across more stuff. Double check the affiliate IDs; since I extracted them from ref codes, I can't vouch for their complete accuracy. __________________ Success is going from failure to failure without a loss of enthusiasm.

2005-07-07, 10:40 AM	#5
Linkster NO! Im not a female - but being a dragon, I do eat them. Join Date: Mar 2003 Location: Sex Delta Posts: 5,084	Im hoping thats a fake addy in the whois - since that addy is also located on this page http://www.webfoot.com/shareweb.html kinda strange though - its the same whois on at least 400 domains I found __________________ Pussy Chompers Porn Links NSCash

2005-07-07, 10:41 AM	#6
Linkster NO! Im not a female - but being a dragon, I do eat them. Join Date: Mar 2003 Location: Sex Delta Posts: 5,084	Also noted that in Googles listings they already see these as dupes - theyre labelled as supp results so should be out next update __________________ Pussy Chompers Porn Links NSCash

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode	Rate This Thread:

2005-07-07, 03:55 AM	#3
Bill Selling porn allows me to stay in a constant state of Bliss - ain't that a trip! Join Date: Apr 2003 Posts: 3,914	gideon, that's a beautiful sample. That's a classic. halfdeck, from your original description I was momentarily doubtful, but all it takes is dropping two or three of those names into the googlebar to see that it's just a distributed version of the first one. A lot of structural similarities, actually. Two good finds.

2005-07-08, 07:29 PM	#7
Bill Selling porn allows me to stay in a constant state of Bliss - ain't that a trip! Join Date: Apr 2003 Posts: 3,914	BTW, if anyone wants to submit a sample anonymously, just PM me with your find and I'll present it. I've been busy practicing with wordpress the last few days, so I'm a little behind hunting my own samples, but this is still a very front-burner experiment in my thoughts. Both of those samples are in the supplemental results Linkster? That's a shame - we'll need to keep looking for newer samples. We'll have to figure out how to keep this information in some sort of spam record, so we can track these things over time.