http://ppl.blastoffnetwork.com/investor (Blastoff Network)

[GaryK]

http://ppl.blastoffnetwork.com/investor (Blastoff Network)
71.203.96.nn
c-71-203-96-nn.hsd1.fl.comcast.net
-----
OrgName: Comcast Cable Communications, Inc.
OrgID: CMCS
Address: 1800 Bishops Gate Blvd
City: Mt Laurel
StateProv: NJ
CIDR: 71.192.0.0/12
-----
READ ROBOTS.TXT? No
OBEYED ROBOTS.TXT? Unsure
-----
When a bot like this uses the same UA with a different referrer for every page request does that usually mean it's advertising for all those sites?

[edited by: incrediBILL at 3:39 pm (utc) on Dec. 4, 2009]
[edit reason] delinked URL [/edit]

[Pfui]

Log-spamming sounds more like it:)

[keyplyr]

And now forum-spam :(

[GaryK]

I've been told by Bill to not call something a log spammer without solid evidence, so now I use euphemistic terms to describe it. :)

[jdMorgan]

So the comcast client or the bot-net that is driving it is the log-spammer, and may or may not have been asked to spam logs by the domain owner appearing as the referrer... For example, that referring domain could be unaware of this activity, having been promised "better ranking" in search, but not told how it would be accomplished.

There is also the possibility that the 'referrer-advertised site' is a victim, and that the actual log-spammer (comcast client or client-controlling botnet) is attacking both our sites *and* the advertised site. That would depend on the sites to which these log-spam requests are sent (IOW, this wouldn't apply to logspam sent to our presumably-legitimate sites), but the possibility exists that the spammer could also target a victim advertised site by creating a bunch of links to it from very-shady Web sites' public logs... (I have no idea if that would work to invoke a search penalty if the number of shady-site links got large enough, but the possibility exists).

So it's important as well to properly assign the 'log spammer' moniker to the controller of the log-spamming network (i.e. the bot herder), and not necessarily to the requesting IP address or hostname, or to the domain name in the referrer string.

Jim

[Pfui]

Agreed. I'd even venture to say that the majority of bad-acting Comcast, Road Runner, etc., addresses I see are zombied machines.

In this instance, I think the distinction between zombie and controller is in Gary's description -- "a bot like this uses the same UA with a different referrer for every page request...". Where bad conduct is bot-specific and the referer(s) has no connection to the site hit, I consider log-spamming.

Alas, given how the UA describes itself on-site, not all 'victims' may be innocent: "[S]o spread the word and cash in! ..."