Russian/Ukrainian Referer Spam Campaign IPs
It looks like there's a new referer spam campaign underway, with a fresh batch of hosts to block. This one is predominantly promoting Russian and Ukrainian websites. I first caught wind of it from Dave Horsfall, who in late January mentioned on an anti-spam mailing list that he'd seen pills24h.com
in his web access logs. I found that domain in my logs too, made a note to look further, and today I got around to poking at it a little.
Since I don't run WordPress or any common blog software, I was surprised to see referer spam suddenly hitting this site in earnest. Most modern spambots are intelligent enough to only target sites vulnerable to their spam. The мудак behind this campaign isn't so discerning, although he's at least bright enough to use IPs that aren't listed in the Stop Forum Spam blacklist. The abuse originates in snowshoe fashion from space allocated to Ukrainian provider Kyivstar / Golden Telecom (AS15895).
Offending hosts
For your blocking pleasure, here are the IPs involved in the spamming campaign:
5.248.253.101
37.115.112.228
37.115.184.155
46.118.113.100
46.118.116.121
46.118.125.21
46.118.127.172
46.118.152.50
46.118.225.78
46.119.113.175
46.119.114.157
46.119.115.60
46.119.121.22
46.119.121.71
46.119.122.170
46.119.123.218
46.119.126.51
46.211.13.134
134.249.48.151
134.249.53.158
134.249.55.53
134.249.66.84
178.137.16.45
178.137.16.174
178.137.18.222
178.137.55.200
178.137.82.153
178.137.86.152
178.137.91.90
178.137.162.218
178.137.167.106
178.137.178.122
178.159.37.55
178.159.49.228
188.163.72.38
188.163.79.63
Here are the domains each host has been pimping.
5.248.253.101
4inn.ru
37.115.112.228
komukc.com.ua
pills24h.com
studentguide.ru
37.115.184.155
balkanfarma.org
fishtauto.ru
gazel-72.ru
iptvuk.co.uk
krasivoe-hd.net
natprof.ru
petrushka-restoran.ru
pills24h.com
rocketchange.ru
46.118.113.100
svetka.info
46.118.116.121
doxyporno.com
raschtextil.com.ua
46.118.125.21
gazel-72.ru
krasivoe-hd.net
46.118.127.172
online-sbank.ru
46.118.152.50
pornohd1080.online
46.118.225.78
no-rx.info
pills24h.com
46.119.113.175
avtorskoe-vino.ru
cryptoswap.biz
electronic-component.org
doxyporno.com
kinoduh.ru
kollekcioner.ru
popugauka.ru
raschtextil.com.ua
supermama.top
superoboi.com.ua
truebeauty.cc
whoiswho.crimea.ua
46.119.114.157
sildenafil-tadalafil.info
46.119.115.60
drugs-no-rx.info
englishtopik.ru
46.119.121.22
www.xn--80aaajkrncdlqdh6ane8t.xn--p1ai (IDN: www.мягкиеокнасаранск.рф)
46.119.121.71
5elementov.ru
buynorxx.com
en.home-task.com
pillscheap24h.com
spy-app.info
46.119.122.170
www.inet-shop.su
www.sundrugstore.com
46.119.123.218
perl.dp.ua
46.119.126.51
pills24h.com
46.211.13.134
polyana-skazok.org.ua
strady.org.ua
suzuki-metropolis.kiev.ua
td-l-market.ru
134.249.48.151
kozhakoshek.com
meriton.ru
metallo-konstruktsii.ru
134.249.53.158
bonkers.name
skinali.photo-clip.ru
zelena-mriya.com.ua
134.249.55.53
gazel-72.ru
profnastil-moscow.ru
134.249.66.84
rql.kiev.ua
178.137.55.200
all-news.kz
178.137.16.45
chatroulette.life
drugs-no-rx.info
headpharmacy.com
online-sbank.ru
178.137.16.174
buynorxx.com
komp-pomosch.ru
178.137.18.222
avtorskoe-vino.ru
truebeauty.cc
178.137.82.153
buypuppies.ca
bonkers.name
chatroulette.life
hentai-manga.porn
perl.dp.ua
pospektr.ru
178.137.86.152
vzube.com
178.137.91.90
picturesmania.com
rieltor.crimea.ua
178.137.162.218
gezlev.com.ua
178.137.167.106
vkonche.com
178.137.178.122
pills24h.com
178.159.37.55
studentguide.ru
www.feminist.org.ua
178.159.49.228
www.atraining.ru
188.163.72.38
aanapa.ru
vzube.com
www.etotupo.ru
188.163.79.63
aanapa.ru
adobereader-free.ru
fanoboi.com
healgastro.com
kipu.crimea.ua
kozhakoshek.com
meriton.ru
pornosmola.info
sovetogorod.ru
tam-gde-more.ru
vzube.com
www.etotupo.ru
xtremeeagles.net
I'll update this post as I see new IPs joining the party.
Feb 11: Added 46.119.123.218, 178.137.162.218
Feb 12: Added 46.118.116.121, 188.163.72.38
Feb 16: Added 134.249.48.151, 178.137.16.45, 178.137.178.122
Feb 20: Added 134.249.66.84
Feb 21: Added 37.115.112.228
Feb 25: Added 178.159.37.55
Feb 27: Added 46.118.125.21, 46.119.114.157
Mar 06: Added 46.119.126.51
Mar 07: Added 178.137.16.174, 178.137.18.222
Mar 12: Added 134.249.53.158
Mar 16: Added 46.118.152.50
Mar 17: Added 46.119.121.22, 178.137.91.90
Mar 18: Added 46.119.122.170, 178.137.86.152
Mar 23: Added 46.118.113.100
Mar 24: Added 134.249.55.53
Mar 29: Added 46.118.127.172
Mar 30: Added 5.248.253.101
Apr 14: Added 178.159.49.228