Traffic from Malicious IPs and Adwords ads for my website

I get visitors from adwords when I never started a campaign

[Makis77]

This is an odd evening in general.
First i get some visitor on my blog posting 2 comments, after I reply to him I see the same IP address posting spam comments all over the plcae and try to manipulate my contact form and inject malicious code.
My next move was to ban his ip only to see that the same guy gets another ip from another country and does the same stuff all over again.
I had to put captcha and allow only registered users to post stuff in order to stop him.

Some seconds ago I visited my statscounter account only to find out that this same webiste had several visits coming from "paid" sources, probably adwords.
I never started any adwords campaign while I see traffic coming from adwords and on top of all that keywords used have nothing to do with my content, keywords like "hacks for Uncharted" "can you buy nzt" "free ava hacks".
Last but not least I get visitors from ask using keywords like "cod world at war cheats" which once more has nothing to do with my blog.


Any ideas?

[edited by: incrediBILL at 3:54 pm (utc) on Sep 12, 2011]
[edit reason] removed broken link [/edit]

[wilderness]

visitor on my blog

Is this an SMF forum or some other type of software?

Please specify?

[dstiles]

The forms poster was probably using a botnet. I see a lot of those - or used to, not so much recently. But then, I do not actually have a blog, only web contact forms.

Blocking IPs manually is always a bolted horse situation. There are a lot of checks that can be put in place to overcome these postings. Some of them you may find in this forum; others we do not post here because then it will become public knowledge and the hackers will try to get around it. :)

The rest of it I can't help with at all. Sorry.

[Pfui]

Spam botnets are very much alive and well, unfortunately.

[dstiles]

Not just spam. I get a lot of attempts from botnets trying to compromise my sites via (eg) sql injection and php cracking. Which latter always fails because I do not run PHP but is always a nuisance in bandwidth and log confusion.