Current mood:	contemplative
Current music:	John Mellencamp - Large World Turning

[NFZ] Most referrer spam for just two IPs
attn katster and jrenken:

Most of the domain names referrer-spammed on NFZ resolve to two IP addresses:

161.58.59.8 - 19 hosts
68.167.234.66 - 45 hosts

We're also being spammed by single urls leading to 216.92.15.203 (hotels-travelnow), 216.130.164.156 (sex3k), and 69.155.184.152 (faxo).

I'd be loath to add a DNS lookup to the web serving process to prevent this spamming since that would delay page draws. Alternatively, we could have an after-the-fact script to go through the logs and remove entries that spam for banned URLs, keyworks, and domains resolving to banned IPs. Later, if we feel like it, we could record the IPs of systems spamming us if we want to block them by firewall or access rule or whatever.


List of addresses:
Host www.academyofmusic.us not found: 2(SERVFAIL)
www.adult-dvd-top-shop.info has address 68.167.234.66
www.air-travel-e-site.info has address 68.167.234.66
www.alphacarolinas.org has address 68.167.234.66
Host www.australia-online-travel.com not found: 2(SERVFAIL)
www.auto-insurancedeals-4u.info has address 68.167.234.66
www.best-deals-blackjack.info has address 161.58.59.8
www.best-deals-casino.info has address 161.58.59.8
www.best-deals-diet-pills.info has address 161.58.59.8
www.best-deals-diet.info has address 161.58.59.8
www.best-deals-flowers.info has address 161.58.59.8
www.best-deals-hotels.info has address 161.58.59.8
www.best-deals-levitra.info has address 161.58.59.8
www.best-deals-online-gambling.info has address 161.58.59.8
www.best-deals-online-poker.info has address 161.58.59.8
www.best-deals-poker.info has address 161.58.59.8
www.best-deals-roulette.info has address 161.58.59.8
www.best-deals-texas-holdem.info has address 161.58.59.8
www.best-deals-tramadol.info has address 161.58.59.8
www.best-deals-weight-loss.info has address 161.58.59.8
www.car-insurancedeals-4u.info has address 68.167.234.66
www.car-rental-e-site.info has address 68.167.234.66
www.car-rentals-e-site.info has address 68.167.234.66
www.cheap-hotels-e-site.info has address 68.167.234.66
www.credit-card-applications-4u.info has address 68.167.234.66
www.credit-report-4u.info has address 68.167.234.66
www.credit-reports-4u.info has address 68.167.234.66
www.currency-converter-4u.info has address 68.167.234.66
www.currency-exchange-4u.info has address 68.167.234.66
www.currency-trading-4u.info has address 68.167.234.66
www.dating-e-site.info has address 68.167.234.66
www.dating-services-e-site.info has address 68.167.234.66
www.dating-site-e-site.info has address 68.167.234.66
www.deal-e-site.info has address 68.167.234.66
www.digital-camera-esite.info has address 68.167.234.66
www.digital-cameras-esite.info has address 68.167.234.66
www.dvd-top-shop.info has address 68.167.234.66
www.faxo.com is an alias for faxo.com.
faxo.com has address 69.155.184.152
www.forex-market-4u.info has address 68.167.234.66
www.forex-trading-system-4u.info has address 68.167.234.66
Host www.fortisenterprises.co.uk not found: 2(SERVFAIL)
www.golf-e-course.info has address 68.167.234.66
www.great-e-site.info has address 68.167.234.66
Host www.handmade2000.co.uk not found: 2(SERVFAIL)
www.health-insurancedeals-4u.info has address 68.167.234.66
Host www.hermosa.us not found: 2(SERVFAIL)
www.hotel-dealse-site.info has address 68.167.234.66
www.hotele-site.info has address 68.167.234.66
www.hotels-travelnow.com is an alias for hotels-travelnow.com.
hotels-travelnow.com has address 216.92.15.203
www.hotelse-site.info has address 68.167.234.66
www.insurance-quotesdeals-4u.info has address 68.167.234.66
www.insurancedeals-4u.info has address 68.167.234.66
www.las-vegas-hotels-e-site.info has address 68.167.234.66
Host www.maloylawn.com not found: 2(SERVFAIL)
Host www.monavaletoys.com/ not found: 3(NXDOMAIN)
www.mortgage-4-u.info has address 68.167.234.66
www.mortgage-calculators-ebanking.info has address 68.167.234.66
www.online-dating-e-site.info has address 68.167.234.66
www.online-gambling-4u.net has address 161.58.59.8
www.onlinegambling-4u.net has address 161.58.59.8
www.personal-loan-ebanking.info has address 68.167.234.66
Host www.philippestarckwatches.co.uk not found: 2(SERVFAIL)
www.private-mortgage-insurance-ebanking.info has address 68.167.234.66
www.rental-car-e-site.info has address 68.167.234.66
Host www.sedonaretreat.org not found: 2(SERVFAIL)
www.sex3k.com has address 216.130.164.156
Host www.slatersdvds.co.uk not found: 2(SERVFAIL)
www.student-loans-ebanking.info has address 68.167.234.66
www.superdolphins.org has address 68.167.234.66
Host www.texasproptax.com not found: 2(SERVFAIL)
www.top-deals-online-pharmacy.info has address 161.58.59.8
www.top-deals-pills.info has address 161.58.59.8
www.top-deals-viagra.info has address 161.58.59.8
www.top-e-site.info has address 68.167.234.66
www.loans-4-u.info has address 68.167.234.66
www.travel-e-site.info has address 68.167.234.66
www.vintage-watces-4u.info has address 68.167.234.66
www.vonormytexas.us has address 68.167.234.66
Host www.xopy.com/friendslinks.php not found: 3(NXDOMAIN)