Blog Spammer Exposed

Filed as General on September 2, 2003 9:33 pm

by Duncan

Blog Spam is currently climbing up the charts on the main blogging indexes with top-penis-enlargement.com/vigrx.htm hitting No.11 at Blogdex today, all achieved through the process of spamming comments sections of blogs worldwide, including on numerous occasions, the Blog Herald. Victim sites include Scriptygoddess, Bigpinkcookie and many others currently listed on the reference page at Blogdex for the site.

But just who is the blogospheres fastest growing spammer, where is he hosted and how can you contact him. Perhaps you might want to give him a few words of wisdom as to what you think of his activities.

There is also a way to slow him down!

First to our spammer. The first thing to note on the comment posts in blogs is that the domains are mainly top level or secondary pages, and that there is no clearly directed affiliate links or referrals programs. This spammer is referring users to site he has registered.

The Blog Herald researched the various domains he lists in his posts, and found that our spammer, if this is his real name, is han xiaoliang of No.5 DongJianLi, XiChangXiaPo, TianTai Lu,HeBei Qu TianJin, TianJin 300230 CHINA, now I don’t know what sort of laws the Chinese have about Blog spamming, but if you are a member of the Chinese armed forces, please feel free to visit our friend.

His email address appears to be [email protected], a free web based email service with anti-spam policy, itself a sub service of Outblaze, who would love to know about his activities at [email protected]. The address seems to be legitimate and was operating at the time we researched the article.

Now the web host: the dns settings for all the sites point to the name servers at conepuppy.com, a registered domain of Cyber Wurx LLC of Saint Louis. Now we are sure that Cyber Wurx is unaware of Mr Han’s activities, they look like a reputable company and I do like the sound of their packages, join the Blog Herald in letting them know what you think about the hosting of Blogspammers website at [email protected]

There is also something we can do to slow Mr Han down. Those using MT (and some other packages) can disable HTML links from being used in comment fields. If you have this option, disabled immediately, it still means that people can post, it just means that you wont wake up and find your blog linking to porn.

IP blocking is also possible in most packages to block the posting in the first place, although in the Blog Heralds experience, the IP address for Mr Han has changed several times, and blocking IP addresses also runs the risk of blocking legitimate comments if Mr Han is spoofing the IP addresses in his postings.

This post was written by

You can visit the for a short bio, more posts, and other information about the author.


Submissions & Subscriptions

Submit the post to Reddit, StumbleUpon, Digg or Del.icio.us.

Did you like it? Then subscribe to our RSS feed!



  1. By Mikal B. posted on September 3, 2003 at 2:14 am
    Want an avatar? Get a gravatar! • You can link to this comment

    Thanks for tracking all of this down. Nicely done. He got to me, as well, but luckily I found his comment right away. And he’s smart, too. He didn’t leave the comment on a current blog posting; rather, he went into my archives and posted his spam on a listing from 90-days ago. I banned his IP addy, but I doubt that’s the last I’ll see of him or others like him. In fact, I think this is a real threat to all blogs.

  2. By mrG posted on September 7, 2003 at 1:02 pm
    Want an avatar? Get a gravatar! • You can link to this comment

    Excellent, totally excellent. A fine bit of spam-rat hunting down at the swamp, brill score cobber!

    And I rather suspect this may be the last we hear of Mr Han for a while …

  3. By tracy posted on October 18, 2003 at 3:30 am
    Want an avatar? Get a gravatar! • You can link to this comment

    WOW! I’m in awe of your research spiffyness. When I grow up, I wanna be just like you guys! And, heh, wouldn’t it be great to get a followup on Mr. Han’s experiences after exposure? My world is small, thanks for keeping me informed!

  4. By null posted on August 13, 2004 at 12:12 am
    Want an avatar? Get a gravatar! • You can link to this comment

    null