Why are these bloggers linking to me?

[Judith]

Two different blogs show up on my stats as linking to my personal site. When I go to the blog, the url of my control panel shows up under their lists of links. Their link list goes to sites all over the world, but there is no explanation of what the links are for or why they're there.

I can trace the site owners with Whois, but haven't approached either one. Is that a good Idea? If so, how would you do it? Email, phone?

I reported it to my web host and all they said was "change your password."

But I'm still wondering:
Why did these people link to me? What are they trying to do?
If it happened twice, it will happen again. How can I stop it?

Suggestions appreciated!

Judith

[minstrel]

See this thread started by JMac:

Now for something completely different

and the site she cited:
Porn Sites Hiding Behind Blogs

[Judith]

Thanks for the most helpful information, Minstrel. I'm now up to 4 of these fake blogs referring to my site. I went to their blogs and viewed the source for each site. Every one contained a link to an adult webcam.

Check your logs. My list includes jennifersblog.com, wr18.com, worldnewslog.com, and saulem.com. Others are listed on the link cited by JMac and provided again by Minstrel in this thread. If this is happening to you, you'll find a lot of useful info there.

If they are linking to your site, apparently all of the ones identified so far come from the same IP address: 141.85.3.130 (and the user agent is : MSIE)

So IP banning might work, at least until these crooks figure out something else.

It's worth a try.

Judith

[JMac]

Hi there-

When I originally noticed this link to my control panel (which will be gone in the next 10 visits or so since it's some weird rotating links system) I started a pretty low-key email to the webmaster. And this is how I got his (maybe I'm showing a gender bias here but cloaking a porn site behind a blog - well....) email address: I hacked the URL to get a 404. On the 404 page it gives the following email address:
ddalex@cyclop.net
The email I ended up sending was not as friendly but it has not been returned - wouldn't it be returned if it were a non-functioning address?
So just now I went to cyclop.net, thinking I'd be able to lodge a complaint and lo and behold, it appears to be a personal site, somehow forwarded or subdomained or however these people do it, to another site called horia.com - now as unappealing as the name is, it really does seem to be a family photo album with pictures of a woman, her daughter, and statues... and no porn - just cute kid pictures... ah-hah there's one with Daddy - maybe HE is the culprit!
I hope I didn't scare this woman, if indeed the email address was a phony one.
BUT... as many of you now know, these sites have been tracked, not to the US as stated in their Whois info, but to Bukarest (spelling?) - and this woman's site seems to be located there, too.
Maybe my gender bias was unfounded!

More sleuthing needed.

And maybe MInstrel could help me overcome this "blame it all on a man" thinking, with some therapy! :-)

I'll let you know how it goes!

JMac

[minstrel]

And maybe Minstrel could help me overcome this "blame it all on a man" thinking, with some therapy!

If you're asking if I know how to get women and children to stop blaming men (especially me) when things go wrong, no... this was underscored for me during that recent East Coast blackout - the first thing that happened after the lights went out was a message on my cell phone from my oldest son (whose video game had I think been interrupted) saying, basically, "dad - you idiot - did you forget to pay the Hydro bill?"

[JMac]

Minstrel - I KNEW it was your fault! Spread the word everyone!!! :-)

So, I did a Whois on this horia.com - this is their administrative contact info:
*dns*major*jackoff*janitor*-**rgroza@GMX.NET*
********cyclop.net*
********22*Transilvaniei*
********,**Bucharest*
********RO*

Ah yes, that name rings a bell - I was just thinking that about them...
Unfortunately, another company comes up as their technical contact and <shudder> here it is:
*Technical*Contact*-*
*********Tera-byte*Network*Operation*Centre*-**hostmaster@TERA-BYTE.COM*
********Tera-byte*Dot*Com*Inc.*
********Suite*900,*10004*-*104*Ave.*NW*
********Edmonton,*AB*T5J0K1*
********CA*
********Phone*-**+1-780-413-1868*
********Fax*-**-*+1-780-413-1869*

I don't think that's a Canadian area code...

More info - better battle plan.

JMac

[JMac]

There appear to be four domains hosted through this IP number. They are:

www.Dianaandreea.com
www.Horia.com
www.Qozi.com
www.Thecyclop.com

There's got to be some way to track these people down...

[JMac]

And a new site to add to the list of not-quite-right sites:
websearchus.com - I've found that each of these sites has transparent pixels which are links to the porn section of the site. And beware (REALLY) of clicking on them - it will launch a stream of popups that can't be controlled at all. I'm lucky to be working on a Mac and I just have to quickly do a force quit on my browser. On the PC, it eventually crashes the whole system - not before you've more than an eyeful though!

Anyone working from home with their kids around should not even visit one of these sites in case it inadvertently sets of the popups - what people do in the privacy of their own homes is fine with me but hijacking people's computers is wrong, wrong, wrong. If it takes me 'til the end of time (or even the end of today!) I will find out where these people are. The odd thing is that the family to which I referred earlier seems to really play some sort of role in this. There are multiple references to them and albums devoted to their daughter. Could it really be that they don't know enough to not host their legitimate family site on the same DNS as their other activities? Or is this an innocent family that has no knowledge of what's happening behind the scenes?

Curiouser, and curiouser....

We're beyond the looking glass here...
:-)

JMac

[mikmik]

Phone - +1-780-413-1868
Fax - - +1-780-413-1869

I don't think that's a Canadian area code...

Yes, JMac, that is an Edm. number, or at least area code. Seeing I can't get them to move here, I still call my family there often - unless the calls are being redirected to Transalvania as well! I've not visited lately.

[JMac]

Hi MikMik -

You're just the guy I thought would already be tracking these people down! All the research you've done has turned up impressive results so far! (Did you get my email "thank you" for the info on the auto launch presentation? Once again, thank you!!)

Maybe this company has more information than I'd thought - I HAd thought it was just another false front - maybe, even if they are, they need a little email from the not so friendly desk of....

JMac