Suspending spammed URLs

This is transferred to the new board at http://fraudreports.prophpbb.com
Spammers should not profit, so post information here that hits their pockets.

Suspending spammed URLs

Postby Red Dwarf » Mon May 04, 2015 4:28 am

This is a list of 223 URLs that I extracted from incoming spam on one of my honeypots.
They date back to April 15.
I have reported them to the responsible services. These include URL shortening services,
    d4i.es
    ly1.ru
    catcut.net
and compromised web servers.
Checking back on these, I have found that all of them are now dead. This represents a poor return for the spammers, which in turn results in fights and accusations between the spammers and their masters.

Code: Select all
2mfi.d4i.es/
406creativeillusions.com/e7jxd2/chl0c.html
406creativeillusions.com/fpfnaj/937st.html
4e2n.d4i.es/
4lcn.d4i.es/
4mia.d4i.es/
6nr7.d4i.es/
6qwt.d4i.es/
749p.d4i.es/
9881.d4i.es/
9tvl.d4i.es/
abcs.edu.vn/0kj9f4/026sj.html
abcs.edu.vn/gyx1yl/x3kcp.html
abcs.edu.vn/tse4a9/r0rn7.html
abcs.edu.vn/ye6uur/0zsyf.html
adardubel.com/rf3cna/lsuc9.html
adardubel.com/ye93se/tcgjt.html
advisedbride.com/6uf4ao/0hb32.html
agrumehostel.com/9zid84/dtkf7.html
arsenalshina.ru/05noyn/grp56.html
arsenalshina.ru/d861ft/76x6a.html
artcarve.ru/m5646c/9pk8b.html
asturalimentaria.es/offvbo/ixpph.html
avto.cnoa.ru/fiji3c/n5hyo.html
avto.cnoa.ru/grumaf/ia51f.html
bccr.org.uk/cl7h66/8s0sm.html
bccr.org.uk/fj8nb1/bp7vd.html
bencoffee.com.vn/octr2p/oz912.html
beta.fahrihamzah.com/8uyiki/sedbt.html
blog2pitaya.fr/covyt4/mgocy.html
blog2pitaya.fr/jv5lsk/p0vig.html
blog2pitaya.fr/s9k5g4/ggc53.html
blog2pitaya.fr/vsrk0r/isz0g.html
byronbayescorts.net.au/f3cn46/0nki6.html
byronbayescorts.net.au/hoj8ix/i6yue.html
byronbayescorts.net.au/ncdpib/yd0ig.html
catcut.net/1v4
catcut.net/9Q3
catcut.net/Au4
catcut.net/aY4
catcut.net/bv4
catcut.net/cQ3
catcut.net/Cu4
catcut.net/cY4
catcut.net/DQ3
catcut.net/Du4
catcut.net/dv4
catcut.net/dY4
catcut.net/eQ3
catcut.net/ev4
catcut.net/EY4
catcut.net/HY4
catcut.net/iQ3
catcut.net/Iu4
catcut.net/jv4
catcut.net/jY4
catcut.net/kY4
catcut.net/KY4
catcut.net/lQ3
catcut.net/Pu4
catcut.net/qQ3
catcut.net/QQ3
catcut.net/qY4
catcut.net/rQ3
catcut.net/RQ3
catcut.net/RX4
catcut.net/TX4
catcut.net/YQ3
catcut.net/Yu4
celikvale.com/mgexs4/s8vj7.html
celikvale.com/oc5g2y/j4kvh.html
chothuenhahanoi.vn/4r9264/dpuvu.html
chothuenhahanoi.vn/7ahha8/hdj2c.html
chothuenhahanoi.vn/e3bvr2/443tu.html
chothuenhahanoi.vn/ok0b6t/a124t.html
cirrusevo.com/599njb/is5m2.html
cirrusevo.com/c3a0bo/1sa05.html
cirrusevo.com/gggpal/ppf0x.html
cirrusevo.com/vcgh8k/iz0lp.html
clubtrinacua.com/tfled1/5jrf8.html
cristinaubatuba.com.br/u4umt2/d6bvk.html
daliz.com.ua/1hn19i/3uf14.html
daliz.com.ua/8cnxur/ud3gi.html
daliz.com.ua/r4zf67/sugz1.html
demo-vut-research.viewmysitenow.com/1ekryg/n9s9r.html
demo-vut-research.viewmysitenow.com/ztrupl/ruz0y.html
devrek.gov.tr/1yh7vv/lxo22.html
devrek.gov.tr/i2izk8/jfnaj.html
devrek.gov.tr/nym74x/lxrgo.html
devrek.gov.tr/rzbj5f/m8b8a.html
devrek.gov.tr/snkgo8/geln8.html
drafthorseinn.net/6mg2mk/gihlj.html
dswtechsg.com/x8z31e/x51mn.html
ductuanship.com/98nmma/usssp.html
ductuanship.com/nb4f2h/dk19j.html
ejzh.d4i.es/
ekotehnoprom.ru/9dou81/o09v1.html
ellenewlands.throb.net/1tg5ov/tmuku.html
ellenewlands.throb.net/uj7j2x/tgafn.html
equinemedivet.com/3iv9vx/fnns6.html
equinemedivet.com/dc5u2m/r08u5.html
equinemedivet.com/ik7bdj/7scos.html
equinemedivet.com/npt8z7/pbtas.html
equinemedivet.com/p8dvpk/05y43.html
equinemedivet.com/phc4dn/h2csm.html
equinemedivet.com/rruppn/7k7pv.html
f4t5.d4i.es/
findbug.cn/gkehvv/nhp4y.html
findbug.cn/hyhmp5/f0b98.html
fkqq.d4i.es/
francesco50.altervista.org/b69122/tz3mm.html
gebaeudeservice-vm.de/ggy7iu/upefr.html
gebaeudeservice-vm.de/uk05oo/cums8.html
gr8u.d4i.es/
help.selro.com/ha8aud/4tljs.html
help.selro.com/z7gn2v/u7dkt.html
hotelcasitassollevante.com/c80lo3/zngxv.html
hotelcasitassollevante.com/pppye0/ba83f.html
hs24.com.pl/48hf12/5y0u0.html
hs24.com.pl/z3sghx/cs027.html
i63s.d4i.es/
imv-bw.de/0x3ty7/cjnmf.html
imv-bw.de/bel7hv/7a3yd.html
imv-bw.de/epjakt/n1lvv.html
info.devlpi.com/7hhgyl/eradn.html
info.devlpi.com/8016x6/uh5cn.html
info.devlpi.com/x3y52k/xg6fr.html
jney.d4i.es/
kadstragent.ru/co9nou/9jlu9.html
kadstragent.ru/hfo6ms/14069.html
kadstragent.ru/raco7b/o277l.html
kadstragent.ru/slcjpi/el2hv.html
kennedycenter.al/738pzk/58m2b.html
kestkennel.altervista.org/7i4z20/mg11l.html
kestkennel.altervista.org/lfgsp3/nyxih.html
kinderhospiz-sternenzelt.de/latp3s/t4dh9.html
kpjmarketing.com/ezdkk0/mtm02.html
ktft.d4i.es/
lam-tung-hoang.de/0h8p4j/pr2y4.html
lam-tung-hoang.de/mivx32/auet1.html
lam-tung-hoang.de/p3v56n/7ychu.html
lam-tung-hoang.de/xatufm/92gxo.html
lastluk.co.uk/4tffcn/rvbr8.html
lfys.d4i.es/
lmzs.d4i.es/
ly1.ru/28s
ly1.ru/29r
ly1.ru/2a6
ly1.ru/2ae
ly1.ru/s7
ly1.ru/sa
ly1.ru/si
ly1.ru/sj
ly1.ru/sq
ly1.ru/su
ly1.ru/sv
ly1.ru/t6
ly1.ru/t8
ly1.ru/tc
ly1.ru/te
ly1.ru/tg
ly1.ru/ti
ly1.ru/tr
ly1.ru/ts
meialuafilm.com/ou1c8s/b5aaa.html
mh6j.d4i.es/
mpjsupplies.com/rm3yjh/h0o57.html
mpjsupplies.com/uum6t0/d64vn.html
mstarues.com/5ufj3h/orvbv.html
mstarues.com/cicjez/yv8gx.html
mstarues.com/drhyf7/i7f31.html
onesstore.com/2ztmfd/ju0p1.html
onesstore.com/38p97k/vf145.html
onesstore.com/bkjboo/cykm2.html
onesstore.com/bpinbn/efdna.html
onesstore.com/imfgvz/g395n.html
onesstore.com/j58bim/pifxd.html
onesstore.com/jc29t0/jsctd.html
onesstore.com/mcys4d/lycxy.html
onesstore.com/yat6cg/lu0ao.html
pcqc.d4i.es/
pqo6.d4i.es/
preternet.com/raebei/ipy9x.html
q1hf.d4i.es/
qavg.d4i.es/
reliancemedics.com/2mfisg/k353j.html
reliancemedics.com/9m0zds/5x9ar.html
reliancemedics.com/ehu8er/4hr2m.html
reliancemedics.com/kmjb0o/yzmbx.html
reliancemedics.com/ndjiu0/13kr2.html
rfvendors.ribfestnh.com/lxmjc5/muvx6.html
royalambulance.co/dn6dss/7j46e.html
royalambulance.co/oaxbgt/6vjbg.html
seopowerrank.com/njrv9r/08o3p.html
seopowerrank.com/sepfam/vb9eu.html
sunrajacademy.com/thlri9/zm8tv.html
ufa.restoratti.net/3068a3/pa8bj.html
ufa.restoratti.net/c3dsgg/3bst2.html
umyy.d4i.es/
universalbhutan.com/ipa13n/3p8n9.html
universalbhutan.com/l86ft2/kmo8s.html
universalbhutan.com/ve8al5/vfjj8.html
vsip-fms.com.vn/0sk4pk/b47oa.html
westprospect.in/22gra0/ekvah.html
westprospect.in/5kymj6/0putp.html
westprospect.in/68e292/45a6c.html
westprospect.in/f394ha/1m52d.html
wp2g.d4i.es/
www.1040usreturn.com/3gvgis/y3nmi.html
www.1040usreturn.com/di37mg/7ahth.html
www.cepro.se/24dxxa/clz8s.html
www.cepro.se/xzp4cl/ytdoj.html
www.jcoopermedia.co.uk/b502jh/ese87.html
www.jcoopermedia.co.uk/hta0le/dp6p5.html
www.jcoopermedia.co.uk/r9l3rg/j24xk.html
www.jcoopermedia.co.uk/vcl4ze/v0yas.html
www.jcoopermedia.co.uk/yedz1c/uy2cx.html
www.lakesidelodge.com/4um92f/fdi0v.html
x.co/8npgh
x.co/8pnyq
xjjb.d4i.es/
xn----8sbwkaoc3co0a9a.xn--p1ai/dg5h7g/oxkl9.html
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Suspending spammed URLs

Postby Red Dwarf » Sun May 10, 2015 10:29 pm

Note:

Redirecting service ly1.ru has a very fast take-down service. At the bottom of the page is a link,

© 2013-2015 Сервис коротких ссылок ly1.ru. Пожаловаться на ссылку which translates as
© 2013-2015 Shortened links ly1.ru. Report link

When you click on that link, you get a new data entry box, also entitled Пожаловаться на ссылку for "Report this link"

In that box, key in the spammed URL in the form http://ly1.ru/xxx where xxx is the 3-character code.

In less than one minute, the link will be dead - no questions asked. That means that all the other millions of spams for that link will be a waste of the spammer's time, giving no financial return.

List of removals that were redirecting to rdmachor.ru on May 11
ly1.ru/2ob ly1.ru/2oc ly1.ru/2od ly1.ru/2oe ly1.ru/2of ly1.ru/2og ly1.ru/2oh ly1.ru/2oi ly1.ru/2ok ly1.ru/2ol ly1.ru/2om ly1.ru/2on ly1.ru/2oo ly1.ru/2op ly1.ru/2oq ly1.ru/2or ly1.ru/2os ly1.ru/2ot ly1.ru/2ou ly1.ru/2ov ly1.ru/2p0 ly1.ru/2p2 ly1.ru/2p3 ly1.ru/2p4 ly1.ru/2p5 ly1.ru/2p6 ly1.ru/2p7 ly1.ru/2p8 ly1.ru/2p9 ly1.ru/2pa ly1.ru/2pb ly1.ru/2pc ly1.ru/2pd ly1.ru/2pe ly1.ru/2pf ly1.ru/2pg ly1.ru/2ph ly1.ru/2pi ly1.ru/2pj ly1.ru/2pk ly1.ru/2pl ly1.ru/2pm ly1.ru/2pn ly1.ru/2po ly1.ru/2pp ly1.ru/2pq ly1.ru/2ps ly1.ru/2pt ly1.ru/2pv
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Suspending spammed URLs

Postby AlphaCentauri » Mon May 11, 2015 12:25 pm

Red Dwarf wrote:Note:

Redirecting service ly1.ru has a very fast take-down service.


Good to know. I've added information about reporting shortened URLs to the New Spamfighter Orientation thread:
viewtopic.php?p=65850#p65850
User avatar
AlphaCentauri
You are kiillllling-a my bizinisss!
 
Posts: 5989
Joined: Thu Mar 01, 2007 3:01 am

Re: Suspending spammed URLs

Postby Red Dwarf » Tue May 19, 2015 4:27 pm

Received a spam using an ly1.ru link
Code: Select all
Click Here To Watch The Video http://ly1.ru/34c


I discovered that all these also redirect to ghwetbir.ru so they were removed:

ly1.ru/34b
ly1.ru/34c
ly1.ru/34d
ly1.ru/34e
ly1.ru/34f
ly1.ru/34g
ly1.ru/34h
ly1.ru/34i
ly1.ru/34j
ly1.ru/34k
ly1.ru/34l
ly1.ru/34m
ly1.ru/34n
ly1.ru/34o
ly1.ru/34p
ly1.ru/34q
ly1.ru/34r
ly1.ru/34s
ly1.ru/34t
ly1.ru/34u
ly1.ru/34v

Another spam run with dead links.
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am


Return to Fight Spammers

Who is online

Users browsing this forum: Ahrefs, Baidu [Spider] and 2 guests

cron