Suspending spammed URLs

Spammers should not profit, so post information here that hits their pockets. There are many ways to fight spammers, and we have automation tools to combat them efficiently. These forums are moderated, but do not reflect the views of the hosting company, domain registrar, etc. By entering any of these forums, you agree that you cannot hold anyone liable for anything related in any way to these forums.

Suspending spammed URLs

Postby Red Dwarf » Mon May 04, 2015 4:28 am

This is a list of 223 URLs that I extracted from incoming spam on one of my honeypots.
They date back to April 15.
I have reported them to the responsible services. These include URL shortening services,
    d4i.es
    ly1.ru
    catcut.net
and compromised web servers.
Checking back on these, I have found that all of them are now dead. This represents a poor return for the spammers, which in turn results in fights and accusations between the spammers and their masters.

Code: Select all
2mfi.d4i.es/
406creativeillusions.com/e7jxd2/chl0c.html
406creativeillusions.com/fpfnaj/937st.html
4e2n.d4i.es/
4lcn.d4i.es/
4mia.d4i.es/
6nr7.d4i.es/
6qwt.d4i.es/
749p.d4i.es/
9881.d4i.es/
9tvl.d4i.es/
abcs.edu.vn/0kj9f4/026sj.html
abcs.edu.vn/gyx1yl/x3kcp.html
abcs.edu.vn/tse4a9/r0rn7.html
abcs.edu.vn/ye6uur/0zsyf.html
adardubel.com/rf3cna/lsuc9.html
adardubel.com/ye93se/tcgjt.html
advisedbride.com/6uf4ao/0hb32.html
agrumehostel.com/9zid84/dtkf7.html
arsenalshina.ru/05noyn/grp56.html
arsenalshina.ru/d861ft/76x6a.html
artcarve.ru/m5646c/9pk8b.html
asturalimentaria.es/offvbo/ixpph.html
avto.cnoa.ru/fiji3c/n5hyo.html
avto.cnoa.ru/grumaf/ia51f.html
bccr.org.uk/cl7h66/8s0sm.html
bccr.org.uk/fj8nb1/bp7vd.html
bencoffee.com.vn/octr2p/oz912.html
beta.fahrihamzah.com/8uyiki/sedbt.html
blog2pitaya.fr/covyt4/mgocy.html
blog2pitaya.fr/jv5lsk/p0vig.html
blog2pitaya.fr/s9k5g4/ggc53.html
blog2pitaya.fr/vsrk0r/isz0g.html
byronbayescorts.net.au/f3cn46/0nki6.html
byronbayescorts.net.au/hoj8ix/i6yue.html
byronbayescorts.net.au/ncdpib/yd0ig.html
catcut.net/1v4
catcut.net/9Q3
catcut.net/Au4
catcut.net/aY4
catcut.net/bv4
catcut.net/cQ3
catcut.net/Cu4
catcut.net/cY4
catcut.net/DQ3
catcut.net/Du4
catcut.net/dv4
catcut.net/dY4
catcut.net/eQ3
catcut.net/ev4
catcut.net/EY4
catcut.net/HY4
catcut.net/iQ3
catcut.net/Iu4
catcut.net/jv4
catcut.net/jY4
catcut.net/kY4
catcut.net/KY4
catcut.net/lQ3
catcut.net/Pu4
catcut.net/qQ3
catcut.net/QQ3
catcut.net/qY4
catcut.net/rQ3
catcut.net/RQ3
catcut.net/RX4
catcut.net/TX4
catcut.net/YQ3
catcut.net/Yu4
celikvale.com/mgexs4/s8vj7.html
celikvale.com/oc5g2y/j4kvh.html
chothuenhahanoi.vn/4r9264/dpuvu.html
chothuenhahanoi.vn/7ahha8/hdj2c.html
chothuenhahanoi.vn/e3bvr2/443tu.html
chothuenhahanoi.vn/ok0b6t/a124t.html
cirrusevo.com/599njb/is5m2.html
cirrusevo.com/c3a0bo/1sa05.html
cirrusevo.com/gggpal/ppf0x.html
cirrusevo.com/vcgh8k/iz0lp.html
clubtrinacua.com/tfled1/5jrf8.html
cristinaubatuba.com.br/u4umt2/d6bvk.html
daliz.com.ua/1hn19i/3uf14.html
daliz.com.ua/8cnxur/ud3gi.html
daliz.com.ua/r4zf67/sugz1.html
demo-vut-research.viewmysitenow.com/1ekryg/n9s9r.html
demo-vut-research.viewmysitenow.com/ztrupl/ruz0y.html
devrek.gov.tr/1yh7vv/lxo22.html
devrek.gov.tr/i2izk8/jfnaj.html
devrek.gov.tr/nym74x/lxrgo.html
devrek.gov.tr/rzbj5f/m8b8a.html
devrek.gov.tr/snkgo8/geln8.html
drafthorseinn.net/6mg2mk/gihlj.html
dswtechsg.com/x8z31e/x51mn.html
ductuanship.com/98nmma/usssp.html
ductuanship.com/nb4f2h/dk19j.html
ejzh.d4i.es/
ekotehnoprom.ru/9dou81/o09v1.html
ellenewlands.throb.net/1tg5ov/tmuku.html
ellenewlands.throb.net/uj7j2x/tgafn.html
equinemedivet.com/3iv9vx/fnns6.html
equinemedivet.com/dc5u2m/r08u5.html
equinemedivet.com/ik7bdj/7scos.html
equinemedivet.com/npt8z7/pbtas.html
equinemedivet.com/p8dvpk/05y43.html
equinemedivet.com/phc4dn/h2csm.html
equinemedivet.com/rruppn/7k7pv.html
f4t5.d4i.es/
findbug.cn/gkehvv/nhp4y.html
findbug.cn/hyhmp5/f0b98.html
fkqq.d4i.es/
francesco50.altervista.org/b69122/tz3mm.html
gebaeudeservice-vm.de/ggy7iu/upefr.html
gebaeudeservice-vm.de/uk05oo/cums8.html
gr8u.d4i.es/
help.selro.com/ha8aud/4tljs.html
help.selro.com/z7gn2v/u7dkt.html
hotelcasitassollevante.com/c80lo3/zngxv.html
hotelcasitassollevante.com/pppye0/ba83f.html
hs24.com.pl/48hf12/5y0u0.html
hs24.com.pl/z3sghx/cs027.html
i63s.d4i.es/
imv-bw.de/0x3ty7/cjnmf.html
imv-bw.de/bel7hv/7a3yd.html
imv-bw.de/epjakt/n1lvv.html
info.devlpi.com/7hhgyl/eradn.html
info.devlpi.com/8016x6/uh5cn.html
info.devlpi.com/x3y52k/xg6fr.html
jney.d4i.es/
kadstragent.ru/co9nou/9jlu9.html
kadstragent.ru/hfo6ms/14069.html
kadstragent.ru/raco7b/o277l.html
kadstragent.ru/slcjpi/el2hv.html
kennedycenter.al/738pzk/58m2b.html
kestkennel.altervista.org/7i4z20/mg11l.html
kestkennel.altervista.org/lfgsp3/nyxih.html
kinderhospiz-sternenzelt.de/latp3s/t4dh9.html
kpjmarketing.com/ezdkk0/mtm02.html
ktft.d4i.es/
lam-tung-hoang.de/0h8p4j/pr2y4.html
lam-tung-hoang.de/mivx32/auet1.html
lam-tung-hoang.de/p3v56n/7ychu.html
lam-tung-hoang.de/xatufm/92gxo.html
lastluk.co.uk/4tffcn/rvbr8.html
lfys.d4i.es/
lmzs.d4i.es/
ly1.ru/28s
ly1.ru/29r
ly1.ru/2a6
ly1.ru/2ae
ly1.ru/s7
ly1.ru/sa
ly1.ru/si
ly1.ru/sj
ly1.ru/sq
ly1.ru/su
ly1.ru/sv
ly1.ru/t6
ly1.ru/t8
ly1.ru/tc
ly1.ru/te
ly1.ru/tg
ly1.ru/ti
ly1.ru/tr
ly1.ru/ts
meialuafilm.com/ou1c8s/b5aaa.html
mh6j.d4i.es/
mpjsupplies.com/rm3yjh/h0o57.html
mpjsupplies.com/uum6t0/d64vn.html
mstarues.com/5ufj3h/orvbv.html
mstarues.com/cicjez/yv8gx.html
mstarues.com/drhyf7/i7f31.html
onesstore.com/2ztmfd/ju0p1.html
onesstore.com/38p97k/vf145.html
onesstore.com/bkjboo/cykm2.html
onesstore.com/bpinbn/efdna.html
onesstore.com/imfgvz/g395n.html
onesstore.com/j58bim/pifxd.html
onesstore.com/jc29t0/jsctd.html
onesstore.com/mcys4d/lycxy.html
onesstore.com/yat6cg/lu0ao.html
pcqc.d4i.es/
pqo6.d4i.es/
preternet.com/raebei/ipy9x.html
q1hf.d4i.es/
qavg.d4i.es/
reliancemedics.com/2mfisg/k353j.html
reliancemedics.com/9m0zds/5x9ar.html
reliancemedics.com/ehu8er/4hr2m.html
reliancemedics.com/kmjb0o/yzmbx.html
reliancemedics.com/ndjiu0/13kr2.html
rfvendors.ribfestnh.com/lxmjc5/muvx6.html
royalambulance.co/dn6dss/7j46e.html
royalambulance.co/oaxbgt/6vjbg.html
seopowerrank.com/njrv9r/08o3p.html
seopowerrank.com/sepfam/vb9eu.html
sunrajacademy.com/thlri9/zm8tv.html
ufa.restoratti.net/3068a3/pa8bj.html
ufa.restoratti.net/c3dsgg/3bst2.html
umyy.d4i.es/
universalbhutan.com/ipa13n/3p8n9.html
universalbhutan.com/l86ft2/kmo8s.html
universalbhutan.com/ve8al5/vfjj8.html
vsip-fms.com.vn/0sk4pk/b47oa.html
westprospect.in/22gra0/ekvah.html
westprospect.in/5kymj6/0putp.html
westprospect.in/68e292/45a6c.html
westprospect.in/f394ha/1m52d.html
wp2g.d4i.es/
www.1040usreturn.com/3gvgis/y3nmi.html
www.1040usreturn.com/di37mg/7ahth.html
www.cepro.se/24dxxa/clz8s.html
www.cepro.se/xzp4cl/ytdoj.html
www.jcoopermedia.co.uk/b502jh/ese87.html
www.jcoopermedia.co.uk/hta0le/dp6p5.html
www.jcoopermedia.co.uk/r9l3rg/j24xk.html
www.jcoopermedia.co.uk/vcl4ze/v0yas.html
www.jcoopermedia.co.uk/yedz1c/uy2cx.html
www.lakesidelodge.com/4um92f/fdi0v.html
x.co/8npgh
x.co/8pnyq
xjjb.d4i.es/
xn----8sbwkaoc3co0a9a.xn--p1ai/dg5h7g/oxkl9.html
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10448
Joined: Tue Jun 27, 2006 2:01 am

Re: Suspending spammed URLs

Postby Red Dwarf » Sun May 10, 2015 10:29 pm

Note:

Redirecting service ly1.ru has a very fast take-down service. At the bottom of the page is a link,

© 2013-2015 Сервис коротких ссылок ly1.ru. Пожаловаться на ссылку which translates as
© 2013-2015 Shortened links ly1.ru. Report link

When you click on that link, you get a new data entry box, also entitled Пожаловаться на ссылку for "Report this link"

In that box, key in the spammed URL in the form http://ly1.ru/xxx where xxx is the 3-character code.

In less than one minute, the link will be dead - no questions asked. That means that all the other millions of spams for that link will be a waste of the spammer's time, giving no financial return.

List of removals that were redirecting to rdmachor.ru on May 11
ly1.ru/2ob ly1.ru/2oc ly1.ru/2od ly1.ru/2oe ly1.ru/2of ly1.ru/2og ly1.ru/2oh ly1.ru/2oi ly1.ru/2ok ly1.ru/2ol ly1.ru/2om ly1.ru/2on ly1.ru/2oo ly1.ru/2op ly1.ru/2oq ly1.ru/2or ly1.ru/2os ly1.ru/2ot ly1.ru/2ou ly1.ru/2ov ly1.ru/2p0 ly1.ru/2p2 ly1.ru/2p3 ly1.ru/2p4 ly1.ru/2p5 ly1.ru/2p6 ly1.ru/2p7 ly1.ru/2p8 ly1.ru/2p9 ly1.ru/2pa ly1.ru/2pb ly1.ru/2pc ly1.ru/2pd ly1.ru/2pe ly1.ru/2pf ly1.ru/2pg ly1.ru/2ph ly1.ru/2pi ly1.ru/2pj ly1.ru/2pk ly1.ru/2pl ly1.ru/2pm ly1.ru/2pn ly1.ru/2po ly1.ru/2pp ly1.ru/2pq ly1.ru/2ps ly1.ru/2pt ly1.ru/2pv
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10448
Joined: Tue Jun 27, 2006 2:01 am

Re: Suspending spammed URLs

Postby AlphaCentauri » Mon May 11, 2015 12:25 pm

Red Dwarf wrote:Note:

Redirecting service ly1.ru has a very fast take-down service.


Good to know. I've added information about reporting shortened URLs to the New Spamfighter Orientation thread:
viewtopic.php?p=65850#p65850
User avatar
AlphaCentauri
You are kiillllling-a my bizinisss!
 
Posts: 5989
Joined: Thu Mar 01, 2007 3:01 am

Re: Suspending spammed URLs

Postby Red Dwarf » Tue May 19, 2015 4:27 pm

Received a spam using an ly1.ru link
Code: Select all
Click Here To Watch The Video http://ly1.ru/34c


I discovered that all these also redirect to ghwetbir.ru so they were removed:

ly1.ru/34b
ly1.ru/34c
ly1.ru/34d
ly1.ru/34e
ly1.ru/34f
ly1.ru/34g
ly1.ru/34h
ly1.ru/34i
ly1.ru/34j
ly1.ru/34k
ly1.ru/34l
ly1.ru/34m
ly1.ru/34n
ly1.ru/34o
ly1.ru/34p
ly1.ru/34q
ly1.ru/34r
ly1.ru/34s
ly1.ru/34t
ly1.ru/34u
ly1.ru/34v

Another spam run with dead links.
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10448
Joined: Tue Jun 27, 2006 2:01 am


Return to Fight Spammers

Who is online

Users browsing this forum: Ahrefs and 1 guest

cron