hostinggratisargentina.com in massive spam run

By Brian Turner

A massive spam run using the spambot Xrumer was used this evening against blogs across the internet.

The comment spam all linked to testxrum.hostinggratisargentina.com/map.html and was sent out via IP 89.179.1.177 (89-179-1-177.broadband.corbina.ru).

The scale was unusually aggressive, with ten of our own blogs suddenly in receipt of over 400 spam comments within an hour.

Criminal gangs in Russia have frequently been blamed for a host of spam and malware incidents, and it remains to be seen when the current flood of spam was an organised attempt to map blogs that allow comments across the internet.

However, proxy servers - insecure connections to the internet - are normally favoured by experienced spammers, as these make it more difficult to either be traced, or have their spam shut down.

The fact that a single IP and hostname was used throughout this attack suggests that it’s more likely the work of a moronic spam wannabe, testing out a program without realising just how powerful it may be.

In the meantime, blog owners are advised to block the IP 89.179.1.177 from their servers, before the idiot tries to run his program again.

ADDED: The message on the original spam was:

I’d prefer reading your findings and comments in french, but my knowledge of your languange is far too week. I’ll certainly try to better that fact some day. As I don’t know anyting about the story from other sources, I cannot judge as to the correctness of your summary. From the pure tune of your post, I’ll conclude that it is as factual as is possible.
I’m sure happy to see someone tackle the language barrier to inform about things going on in the french speaking sphere.