johnkerry.com and referral spam
23 Feb 2004An update on this. An astute reader left a comment on my comment about the referral spam I received from blog.johnkerry.com:
There is another possibility, of course - someone could be “Joe Jobbing” the campaign. Trying to set up the Kerry campaign to LOOK like spammers.
I’m not sure which one I believe - I’ve written to to info@ and webmaster@ too asking the question, but haven’t heard anything back. I’d say both possibilities are equally likely at this point. In digging through my logs a bit more, I’ve found other StarProse referral spam, all from Democratic candidates. When campaigns as diverse as Kerry, Edwards, and Al Sharpton are showing up with the same software and the same general layout, it raises my suspicions a bit more for the Joe-Job.
Indeed.
What I know about the spam is that it’s being generated with this software. So, I first searched for that in the User-Agent. These are the hits I got:
| IP Address | Referrer | Count |
| 206.65.72.35 | "http://www.blog.johnkerry.com" | 179 |
| 172.144.61.107 | "http://blog.johnkerry.com" | 4 |
| 172.144.61.107 | "http://www.johnedwards2004.com/" | 1 |
| 206.129.0.134 | "http://www.riaa.com" | 2 |
| 206.65.72.35 | "http://blog.johnkerry.com" | 1 |
| 172.200.37.120 | "http://blog.johnkerry.com" | 1 |
| 172.166.255.186 | "http://blog.johnkerry.com" | 1 |
| 172.164.250.206 | "http://www.drudgereport.com/" | 1 |
| 172.155.141.2 | "http://www.blog.johnkerry.com" | 1 |
| 172.145.188.80 | "http://www.joe2004.com" | 1 |
| 172.140.68.49 | "http://blog.johnkerry.com" | 1 |
Notice that the same AOL IP (172.144.61.107) spammed for Kerry’s and Edwards’ websites, and also that the IP with the largest number of hits is 206.65.72.35, a “bess proxy” (basically, an open web cache/content filter that can be used to relay traffic).
Judging from this, I can make one conclusion: whoever is doing this is probably not affiliated with the John Kerry campaign (because of the hit for the Edwards site from the same IP).
Instead, I think there are a few possibilities:
- Some industrious tard is spamming on behalf of Democrats because he thinks it’s genuinely a good idea
- Someone is purposefully trying to make it look like democratic candidates are spamming for their websites. “Joe-Jobbing” it, as Wade put it.
Frankly, I find 1) pretty unlikely, and given the odd appearance of spam for drudgereport.com from the same block of AOL IPs, I think 2) is the most likely scenario.
That’s pretty low.