Paintball Spam

From chongqed.info

Got two related spams February 9, 2006 to my Wiki Spam Collection.

The first by 80.217.160.152 for paintball-guns.search-dot.com using CSS Hidden Spam.

The second by 71.227.32.165 is a bit more unusual. Twenty one minutes after the first paintball spam, this IP added another paintball-guns.search-dot.com link. The strange thing is that this link was inserted into the already existing hidden spam div.

That may explain the reason why we keep seeing the same seemingly random div ids. The spammer could easily detect which wikis are good to hit by checking the page for their unique id. If their id is still there, then they know the their spam wasn't cleaned without having to look for the actual URLs. And I guess to keep things organized, it makes sense to reuse the divs.

Making those assumptions and looking at the other similarities, I suspect this is the same spammer that hit the same page two days ago. An experiment I setup here seems to confirm this theory.

The final spam looked like this:

<div id="aflknwerkamfs" style="overflow:auto;height:1px;">
[http://paintball-guns.search-dot.com/ paintball guns] 
[http://paintball-guns.search-dot.com/ paintball guns] 
</div>