Blog Spammer Exposed

Blog Spam is currently climbing up the charts on the main blogging indexes with hitting No.11 at Blogdex today, all achieved through the process of spamming comments sections of blogs worldwide, including on numerous occasions, the Blog Herald. Victim sites include Scriptygoddess, Bigpinkcookie and many others currently listed on the reference page at Blogdex for the site.

But just who is the blogospheres fastest growing spammer, where is he hosted and how can you contact him. Perhaps you might want to give him a few words of wisdom as to what you think of his activities.

There is also a way to slow him down!

First to our spammer. The first thing to note on the comment posts in blogs is that the domains are mainly top level or secondary pages, and that there is no clearly directed affiliate links or referrals programs. This spammer is referring users to site he has registered.

The Blog Herald researched the various domains he lists in his posts, and found that our spammer, if this is his real name, is han xiaoliang of No.5 DongJianLi, XiChangXiaPo, TianTai Lu,HeBei Qu TianJin, TianJin 300230 CHINA, now I don’t know what sort of laws the Chinese have about Blog spamming, but if you are a member of the Chinese armed forces, please feel free to visit our friend.

His email address appears to be [email protected], a free web based email service with anti-spam policy, itself a sub service of Outblaze, who would love to know about his activities at [email protected]. The address seems to be legitimate and was operating at the time we researched the article.

Now the web host: the dns settings for all the sites point to the name servers at, a registered domain of Cyber Wurx LLC of Saint Louis. Now we are sure that Cyber Wurx is unaware of Mr Han’s activities, they look like a reputable company and I do like the sound of their packages, join the Blog Herald in letting them know what you think about the hosting of Blogspammers website at [email protected]

See Also
Ghost Websites: Top 10

There is also something we can do to slow Mr Han down. Those using MT (and some other packages) can disable HTML links from being used in comment fields. If you have this option, disabled immediately, it still means that people can post, it just means that you wont wake up and find your blog linking to porn.

IP blocking is also possible in most packages to block the posting in the first place, although in the Blog Heralds experience, the IP address for Mr Han has changed several times, and blocking IP addresses also runs the risk of blocking legitimate comments if Mr Han is spoofing the IP addresses in his postings.

View Comments (4)
  • Thanks for tracking all of this down. Nicely done. He got to me, as well, but luckily I found his comment right away. And he’s smart, too. He didn’t leave the comment on a current blog posting; rather, he went into my archives and posted his spam on a listing from 90-days ago. I banned his IP addy, but I doubt that’s the last I’ll see of him or others like him. In fact, I think this is a real threat to all blogs.

  • Excellent, totally excellent. A fine bit of spam-rat hunting down at the swamp, brill score cobber!

    And I rather suspect this may be the last we hear of Mr Han for a while …

  • WOW! I’m in awe of your research spiffyness. When I grow up, I wanna be just like you guys! And, heh, wouldn’t it be great to get a followup on Mr. Han’s experiences after exposure? My world is small, thanks for keeping me informed!

Scroll To Top