Michael Pollitt | freelance technology journalist

If you’re looking for the Michael Pollitt who left a spam message in your guestbook (or in other response forms), it wasn’t me. And it wasn’t me that sent you a spam e-mail. If your guestbook has been spammed and the sites listed in the message (or link) redirect to search-pharmacy-online.com or online-search-catalog.com at Everyones Internet (EV1), please send a complaint to abuse@ev1.net.

I’ve discovered two more IPs for the guestbook spammer. 195.225.177.89 – netcathost.com – in the Ukraine. 81.177.15.44 – In-Telecom Ltd – in Russia. The spammed sites in the guestbook messages redirect to search-pharmacy-online.com which is hosted by Everyones Internet (EV1). See all my posts about the guestbook spammer. I’m continuing to push EV1 for explanations.

EV1 sales has just told me this via a chat session: “at this time they [abuse] are in contact with the customer and they are investigating the issue and will keep in contact with you…” I asked if this meant the owner of the spam sites…”correct the customer who is spamming.” I used chat as my e-mails to senior management were not (and still have not been) answered. They don’t want to talk on the phone to a journalist either: “I’m sorry but we do not have anyone who will make comments” and suggested I e-mailed the boss but I’d done that already several times. Meanwhile, I’m still getting acknowledgement e-mails from the guestbooks being spammed. And the number of guestbooks being spammed in my name is going up too.

Update 29 March: A typical guestbook entry from yesterday listed 20 drug URLs. All but one redirected to search-pharmacy-online.com hosted at EV1Servers (ev1s-67-15-237-49.ev1servers.net). Affiliate code is 15356. The one site that didn’t divert had a typing error and, corrected, it also redirected to this site. An MSN search finds over 2,200 guestbooks with my details. Yahoo finds 646, Google finds 762. An MSN search for “69.31.41.89″ – the spamming IP at Pilosoft (colo-69-31-41-89.pilosoft.com) – produces 2,420 results. The real total is probably far higher than any of these numbers suggest given that search engines probably ignore spammy link content. Allowing that the spammer is using several other names as well as mine, the number of spammed guestbooks is probably in the high tens of thousands.

For the avoidance of doubt EV1=EV1Servers=Everyones Internet which has offices in Houston, Austin, Dallas, and San Antonio. I’m generally referring to EV1Servers in these posts where the spammed sites are. EV1 also hosts klikvip.com (mentioned on the spammed sites).

Update 30 March: The more abuse I see, the more I blog so here’s today’s update. Klikvip.com is mentioned on search-pharmacy-online.com. As I’ve blogged before, Klikvip.com has a whois pointing to Nelroy Ltd. Earlier I’d said this seemed to be an Australian company (Victoria) but looking more closely the phone number (which doesn’t work) is Kazakhstan. Country code SC in the whois address could be the Seychelles (or perhaps South Carolina?). The whois might match a real address in the Seychelles – or it could be fake. A search for Nelroy Ltd leads me very nicely to this Whois History Time Line of the Klik Gang and Rogues Anti Spyware Apps (PDF). The only thing I know for sure is that klikvip.com is hosted by EV1Servers – here’s the reverse DNS of ev1s-67-15-237-78.ev1servers.net. Also Klikvipsearch.com at ev1s-67-15-237-49.ev1servers.net. It looks like EV1Servers may have the Klik Gang for a customer. And did I mention that I’ve been contacted by somebody else who has the same problem with the guestbook spammer…he’s not too happy either.

Update 31 March: More abuse so…do you want to see some Klikvip.com owned sites at EV1Servers? Click here for a google search. I checked over a dozen and they’re all registered to Nelroy Ltd. The sites are sitting at ev1s-67-15-237-49.ev1servers.net and ev1s-67-15-237-67.ev1servers.net. And I also found klikstyle.com at ev1s-67-15-237-50.ev1servers.net. Let’s give Klikvip the benefit of the doubt here: as far as I can determine it’s Klikvip affiliates (codes: 15356 and the just-discovered 15521 below) that are doing the spamming. But if EV1Servers are in contact with their customer about the guestbook spamming using my details, then why hasn’t it been stopped?

Update: I’m now seeing evidence that the guestbook spammer is sending e-mails out in my name to spam the search-pharmacy-online.com site hosted by EV1Servers. Just like the guestbook spam, the e-mail lists urls that quickly redirect to this site with an affiliate code of 15521. According to the bounce messages I’m receiving, the originating IP was 81.177.15.41 (Russia: In-Telecom Ltd). The same IP has been guestbook spamming.

Update 3 April: More guestbook spamming in my name over the weekend including some interesting attempts with obfuscated URLs. Affiliate 15521. Theory about e-mail bounces: if a guestbook uses an e-mail to send the form contents to the owner and that address bounces, I get the bounce. But to me, it looks like the spammer is sending e-mail spam in my name. EV1Servers is hosting at least 14 Klikvip owned sites…I have a list. MSN searches showing guestbook spam in my name remain over 2,200 hits. The latest spammer phrase “Best site I see. Thanks” (as associated with pharmacy site redirects) shows 17,800 results (not just in my name). Spammer using at least 10 different phrases so perhaps well over 200,000 guestbook entries by now? Googling the same “best site I see…” phrase gets 57,200 hits! Maybe we’re nearer a million guestbook entries overall? He’s been a very busy spammer.

Update 6 April: The spammer is still spamming guestbooks in my name, the sites at EV1Servers remain up. Nothing heard from EV1Servers, Pilosoft or (no surprise), Klikvip. I’m getting repeated acknowledgement e-mails from the spammed guestbooks as the spambot cycles through the list. An MSN search using my details is producing nearly 2,400 spammy results from guestbooks. Google just found 9,280 10,100 spammy hits with my details (it’s not me, I keep telling you!) The “Best site I see” phrase (one of over 10 phrases) now has 73,700 hits so I reckon there are well over a million guestbook entries left by this spammer.

Update 7 April: You might be interested to read some Klikvip posts in an SEO forum. See their top 30 affiliates. New spamming IP 81.177.15.46 found (Russia: In-Telecom Ltd). Links in the guestbook spam still point (via redirects) to search-pharmacy-online.com (at EV1Servers).

Update 10 April: There are now 27,200 27,400 spammy hits on Google with my details. Another spamming IP found – 81.177.15.51 (Russia: In-Telecom Ltd). EV1Servers still hosting the spammed site. 25 50 guestbook acknowledgement e-mails have arrived so far today.

Update 11 April: Acknowledgement e-mails are streaming in today. The spammer is now spamming some blogs in addition to guestbooks. EV1Servers continues to host the sites.

Update 13 April: It has been a very bad couple of days.The guestbook spammer has found a way to spam a series of Pivot blogs such that I get the acknowledgement messages for each different name he uses in a spam run. But the worst problem has been the hundreds of messages (there were 200 on one day) resulting from a guestbook spamming run on a series of similar guestbooks. At one point the messages reached a rate of 29 in six minutes. I alerted the company hosting the guestbooks and the messages have now slowed to a trickle. EV1Servers continues to host the site being spamvertised. Here’s a reminder of what the spam guestbook messages look like [this link may not last. The sites redirect to search-pharmacy-online.com - hosted by EV1Servers]

Update: Phew! The guestbook host in the US has just told me that further technical changes have been made to stop the spammer from abusing its systems. The company also purged almost 400 occurences of my details from its database. And I have written again to EV1Servers demanding action as I am still seeing guestbook spam from other directions.

Update 14 April: No response from EV1 to yesterday’s e-mail so I have now sent a fax to Robert Marsh, CEO. He’s the founder of the company and calls himself the ‘headsurfer’. I’ve sent him (and EV1’s management) several e-mails before – all were ignored. There are now 28,000 spammy hits on Google – the site at EV1Servers is still up too.

Just found another spammed site at EV1Servers – azresults.com (ev1s-207-44-134-217.ev1servers.net) following receipt of a comment acknowledgment from a spammed blog. The comment had 10 gambling links (new topic!) like this one (http://karoll.php5.cz/gambling/online-gambling-directory.htm) which redirect to azresults.com (the home page is a configuration listing…this site uses search.php with parameters to work – see the link) Results on this page redirect to peakclick.com, an Austrian company. So, this is another pay-per-click spamming run/scam using EV1 hosting for the spammed site. How many more such sites will I discover at EV1?

The spammer is also ensuring (and I don’t know how) that the latest acknowledgements are coming to my e-mail although they don’t appear to be left in my name/e-mail. Strange. I’ve also had e-mail acknowledgements that point to a Umaxsearch.com site hosted elsewhere – not fully investigated yet.

Here is some very interesting reading about EV1.

Update 15 April. Let’s make it really simple for EV1 with another example from today [look for comment no. 67 - link may not last] of the guestbook spammer’s activities.

Here’s the text of the comment left using my name and e-mail address.

Not much on my mind right now, but it’s not important. I’ve just been letting everything happen without me. I just don’t have anything to say right now.
[URL=http://pablick.dyndsl.com/ultram-withdrawl.html]ultram withdrawl[/URL] [URL=http://korol.kwik.to/xanax-and-pregnancy.html]xanax and pregnancy[/URL] [URL=http://pablick.dyndsl.com/does-ultram-help-methadone-withdrawl.html]does ultram help methadone withdrawl[/URL] [URL=http://pablick.dyndsl.com/online-pharmacy-ultram.html]online pharmacy ultram[/URL] [URL=http://kirok.cba.pl/ic-butalbital.html]ic butalbital[/URL] [URL=http://pablick.dyndsl.com/ultram-drug.html]ultram drug[/URL] [URL=http://pablick.dyndsl.com/ultram-addiction.html]ultram addiction[/URL] [URL=http://pablick.dyndsl.com/ultram-and-alchohol.html]ultram and alchohol[/URL] [URL=http://lodo4ka.cba.pl/vicodin.html]vicodin[/URL] [URL=http://partizan.epac.to/Effect-of-Rivotril.html]Effect of Rivotril[/URL] [URL=http://pablick.dyndsl.com/ultram-tablet.html]ultram tablet[/URL] [URL=http://pablick.dyndsl.com/order-medicine-ultram-online.html]order medicine ultram online[/URL] [URL=http://pablick.dyndsl.com/ultram-lawsuit.html]ultram lawsuit[/URL] [URL=http://korol.kwik.to/xanax-abuse.html]xanax abuse[/URL] [URL=http://pablick.dyndsl.com/where-to-buy-ultram.html]where to buy ultram[/URL] [URL=http://kirok.cba.pl/cheap-butalbital.html]cheap butalbital[/URL] [URL=http://partizan.epac.to/rivotril.html]rivotril[/URL] [URL=http://pablick.dyndsl.com/online-pharmacy-ultram.html]online pharmacy ultram[/URL] [URL=http://www.ortogono.webpages.pl/diazepam/diazepam-drug.html]diazepam drug[/URL] [URL=http://pablick.dyndsl.com/ultram-and-alchohol.html]ultram and alchohol[/URL]

Okay, the spammer has got it a bit wrong…there’s no click through on the comment itself. However, the sites listed divert to search-pharmacy-online.com using what I assume is an affiliate code of 15356 like this: http://search-pharmacy-online.com/search.php?aff=15356&q=ultram&saff=1

And where is search-pharmacy-online.com hosted? ev1s-67-15-237-49.ev1servers.net. That’s EV1.

Update 16 April: Well, somebody at EV1 has been looking at this blog over the last week or two. Quite a few times. From this IP – 207.44.220.3. And they’ve read the posts I’ve written about the guestbook spammer. Is this EV1’s management, I wonder? (especially as yesterday’s hit looked at the post on advice for PRs – public relations people.) But when you look at http://207.44.220.3/ you see a site called “1 Poker Game US” (www.1-poker-game.us). Google that IP and you find blog spam about casino, poker, and sports gambling. So, it’s not EV1’s management looking at my blog!

Update 17 April: I’ve been given more evidence of spamming IPs (thanks, J): 64.62.228.2 – 64.62.228.5 (Hurricane Electric, California) and 81.177.15.40 – 81.177.15.43 (In Telecom Ltd, Russia). The guestbook spammer is quite active today, still spamming urls like this one: http://utenti.lycos.it/kkarsha/prozac/prozac-weekly.html that link to search-pharmacy-online.com at EV1. Here are some klikvip sites at EV1 that I’ve not named before: online-teacher-search.com, finance-search-online.com, online-search-pharmacy.com, online-search-catalogue.com, online-finance-search.com, online-search-casino.com, bestsearchinsurance.com, online-adult-search.com, onlinesearchcasino.com, pharmacy-online-search.com, best-auto-search.com, travel-best-search.com, search-best-auto.com, and klikstyle.com. I have just repeated my complaints to EV1 management by phone message, fax, and e-mail. We’ll see if they respond this time.

Update 18 April: The sound of silence from EV1’s management. The guestbook spammer’s abuse was first reported to EV1’s abuse team on 21 March. Since then I’ve had over 700 guestbook acknowledgements and my name/e-mail details have been blasted across the internet (28,400 times at the last count) to guestbooks from the UK to Japan. I reckon that the spammer has left at least one million spammy messages in guestbooks worldwide (using various names including mine). I’ve shown how EV1 is providing hosting to PPC pharmacy search sites (with fake whois details) being promoted by the spammer. I’ve found links to Russia and the web’s worst spyware, Coolwebsearch. As I write this update, more guestbook acknowledgements are coming in. The more abuse I see, the more I dig and the more spam-linked sites I uncover at EV1. I’ve complained to EV1, again, and again, and again, and again. By e-mail, phone, chat, and fax. I’ve blogged all the technical details, sufficient for them to pull the plug (their AUP seems clear on spam). And yet…EV1’s management does nothing. Absolutely nothing. What is it with this company?

Update: I’ve just made a final attempt to call EV1’s management about this. Not successful so far. I’ve therefore now contacted EV1’s upstream provider, AboveNet, about these issues. This approach – going upstream – worked well before when I contacted WVfiber about Inhoster. So, we’ll see what the people at AboveNet have to say about their customer in relation to acceptable usage policies.

Update 19 April: More spamming evidence*. The guestbook spammer is now promoting online-search-catalog.com which (you guessed it) is at EV1 (ev1s-67-15-237-49.ev1servers.net [67.15.237.49]. Search-online-pharmacy.com at EV1 is still being spammed. I have also identified and contacted Cogentco as another upstream provider to EV1. A lot of guestbook acknowledgement spam is arriving this morning. I’m seeing the same sites spammed again, and again and again. It’s been a relentless barrage today.

*here’s the evidence left in a guestbook by the pharmacy spammer – I got the automatic acknowledgement from that site this morning:

Comments: Best site I see. Thanks.

http://ortogono.asp2.cz/prescription-drug.html
http://kkarsha.qsh.sk/alprazolam/Anxiety-Alprazolam2.html
http://site.neogen.ro/dreadsster/images/img_936504.html
http://kkarsha.qsh.sk/alprazolam/cheap-alprazolam29.html
http://astraguy.prox-net.pl/tramadol/buy-tramadol81.html
http://ccurvas.blogse.nl/log/hydrocodone.html
http://site.neogen.ro/harecut/images/img_936197.html
http://gybki.asp2.cz/xanax.html
http://rampakr.asp2.cz/cheap-phentermine.html
http://astraguy.prox-net.pl/valium/buy-valium-online.html
http://site.neogen.ro/ortogono/images/img_936416.html
http://astraguy.prox-net.pl/phentermine/phentermine-37_5.html
http://rampakr.blogs.eurosport.com
http://site.neogen.ro/ccarlos007/images/img_936444.html
http://site.neogen.ro/tatyra/images/img_936419.html
http://site.neogen.ro/mmamasita/images/img_936227.html
http://kkarsha.qsh.sk/alprazolam/Alprazolam-Xanax.html
http://karatel666.asp2.cz/lipitor.html
http://astraguy.prox-net.pl/valium/valia92.html
http://rampakr.asp2.cz/carisoprodol.html

I’ve edited the links so you just see the urls only. These sites divert to online-search-catalog.com hosted by EV1Servers. It’s Klikvip.com affiliate 15356 again. Here’s an example url at the destination http://online-search-catalog.com/search.php?aff=15356&q=valium&saff=1.

There are now at least 28,600 37,000 38,100 spammed guestbook entries using my name and e-mail address with pharmacy spam like the example above. Are you reading this, EV1 management? (EV1=EV1Servers=Everyones Internet) Do you think it right to provide support to spammers? Your acceptable use policy says….”anyone hosting websites or services on their server that support spammers……will have their server immediately removed from our network”. If I told you about this problem on 21 March, then how “immediately” do you mean? I’d like to know.

See a picture of EV1/EV1Servers/Everyones Internet founders Roy Marsh and Robert Marsh in this Houston Chronicle story: “Houston businessmen earn heartfelt thanks” – not from me, they don’t…

Update 24 April: There are now 38,500 spammed guestbook entries using my name and e-mail address. More guestbook acknowledgements over the weekend which are now show additional sites (not at EV1) being spammed as well as the main sites search-pharmacy-online.com and online-search-catalog.com (both hosted by EV1). The spammer is also spamming a series of Pivot blogs using my details and other names – I’m getting all the acknowledgements for those somehow. This is now over a month since I reported this problem to EV1 abuse. More acknowledgements are arriving this morning. I have repeated my e-mails and a fax to EV1.

Here’s an example of today’s guestbook spamming (actually a blog, this time). This is one comment from here: http://www.andrewsstarspage.com/Blog/pivot/entry.php?id=65#joe-0604241157 where the spammer has arranged somehow – I don’t know how – that the acknowledgement comes to me even though the name and e-mail is “Joe”. I’m reluctant to leave these links live but it’s the best way of demonstrating how they divert. Other acknowledgements I’ve had today shows the spammer is still using my name and e-mail address.

Not much on my mind right now, but it’s not important. I’ve just been letting everything happen without me. I just don’t have anything to say right now.
http://www.praize.com/travel/kkarsha/diet-pills.html“>diet pills | http://www.praize.com/apologetics/lartakap/vicodin.html“>vicodin | http://asspida.atspace.com/medication.html“>medication | http://www.praize.com/apologetics/rampakr/propecia.html“>propecia | http://ddrevoo.atspace.com/lortab.html“>lortab | http://moe.atspace.name/diazepam/buy-diazepam.html“>buy diazepam | http://www.praize.com/travel/kkarsha/ephedrine.html“>ephedrine | http://www.praize.com/apologetics/rampakr/ritalin.html“>ritalin | http://www.mashada.com/blog/gremor/“>estradiol | http://moe.atspace.name/diazepam/diazepam-online.html“>diazepam online | http://moe.atspace.name/diazepam/valium-diazepam.html“>valium diazepam | http://www.praize.com/travel/kkarsha/clomid.html“>clomid | http://moe.atspace.name/diazepam/index.html“>diazepa!
m | http://www.mashada.com/blog/ttryman/“>ephedrine | http://myrcuss.atspace.com/fioricet.html“>fioricet | http://www.praize.com/apologetics/pardamk/prilosec.html“>prilosec | http://www.praize.com/apologetics/pardamk/ionamin.html“>ionamin | http://www.mashada.com/blog/varvarv/“>diazepam | http://www.praize.com/apologetics/rampakr/viagra.html“>viagra | http://moe.atspace.name/diazepam/diazepam.html“>diazepam |

These sites redirect to online-search-catalog.com hosted by EV1 (ev1s-67-15-237-49.ev1servers.net [67.15.237.49]) and search-pharmacy-online.com (ev1s-67-15-237-49.ev1servers.net [67.15.237.49]).

I’ve telephoned Everyones Internet/EV1/EV1servers again today. They are refusing to talk to me, even for a discussion on how to resolve the problems. The receptionist at the corporate HQ switchboard in Houston has been told not to put me through. She won’t even tell me the name of the person who has been given the e-mails I sent today.

If EV1 had acted promptly when I first asked them on 21 March, I feel that this problem would have been stopped before we hit 38,500 guestbook entries and clogged my gmail account with acknowledgements (I’ve just checked up – over 1,100 e-mails) If Klikvip.com is EV1’s customer, then why are they not raising the issue of spam with them? Or discussing it with me? In whose interest is it for a spammer to use my details and e-mail address to spam Klikvip.com’s pharmacy sites hosted at EV1?

If your guestbook has been spammed and the sites listed in the message (or link) redirect to search-pharmacy-online.com or online-search-catalog.com at Everyones Internet (EV1), please send a complaint to abuse@ev1.net.

New site found at EV1 – find-pharmacy-online.com (ev1s-67-15-237-49.ev1servers.net [67.15.237.49])

I will continue to monitor the incoming guestbook acknowledgement e-mails, the spammed sites hosted at EV1, and numbers of spammed guestbook entries using my details (google finds 38,500 today). But I’m now getting close to the point where I may have to abandon my gmail address and take this entire blog offline so I drop off the spammers’ radar. I may post again on this topic before the end of the week.

I have had enough. More than enough.

Update: 26 April. Still spamming, still seeing redirects to the sites hosted by EV1 plus some other sites such as topsearch10.com (produces the same search results as the sites at EV1) hosted elsewhere. I’ve looked more closely today at a series of Pivot-powered blogs that the spammer is spamming using my name and other names. I get all the acknowledgements. Of the 26 blogs I’ve looked at, he’s hit them repeatedly with with around 470 comments (and those comments have hit me including two more in the last minute). His activities have generated over 1,300 e-mails for me and the number of guestbook/blog entries using my details has hit 39,900 today. Oh, and judging by the number of searches arriving on my blog for phrases like “need help stopping guestbook spam”, “ads appearing in my guestbook” and “how to protect guestbook from spammers”, I’m not the only one being thoroughly annoyed.

And there are now 40,300 hits of my details. Now 40,700 – and I’ve written about all this in The Guardian newspaper today (27 April) – An unwelcome guest of spam The spammer is still spamming in my name this morning, pointing via redirects to the pay-per-click search sites hosted by Everyones Internet/EV1/EV1Servers. We’ll see if EV1 does anything about all this now.

Please use caution if looking at any klik*.com and related search sites as many are mentioned in this list as being linked in various ways to Coolwebsearch (CWS) exploits. If you don’t know, Coolwebsearch is a very nasty piece of spyware. I believe that Klikvip is a Russian/Eastern European operation although the guestbook spammer could be anywhere.