Every now and then, there's still someone who does their forum spamming the old fashioned way: manually. Someone from Russia just posted a whole bunch of spam-links to geocities pages in this very thread. I deleted it, of course, but here's the breadcrumb trail.
62.33.137.159 - - [17/Nov/2006:10:05:49 -0800] "GET /viewtopic.php?p=104&sid=e8775244618f8d319d8a77ef9e647e43 HTTP/1.1" 200 10800 "http://www.google.com/search?hl=en&lr=&client=opera&rls=ru&q=site%3A+forum+mode%3Dreply%26t&btnG=Search" "Opera/9.00 (Windows NT 5.1; U; ru)"
62.33.137.159 - - [17/Nov/2006:10:05:54 -0800] "GET /favicon.ico HTTP/1.1" 404 584 "http://forum.tfbw.com/viewtopic.php?p=104&sid=e8775244618f8d319d8a77ef9e647e43" "Opera/9.00 (Windows NT 5.1; U; ru)"
62.33.137.159 - - [17/Nov/2006:10:06:12 -0800] "GET /posting.php?mode=reply&t=62&sid=bfa27b162263410f7f52d5d5f4b61bd8 HTTP/1.1" 200 13070 "http://forum.tfbw.com/viewtopic.php?p=104&sid=e8775244618f8d319d8a77ef9e647e43" "Opera/9.00 (Windows NT 5.1; U; ru)"
62.33.137.159 - - [17/Nov/2006:10:06:19 -0800] "GET /posting.php?mode=topicreview&t=62 HTTP/1.1" 200 7794 "http://forum.tfbw.com/posting.php?mode=reply&t=62&sid=bfa27b162263410f7f52d5d5f4b61bd8" "Opera/9.00 (Windows NT 5.1; U; ru)"
62.33.137.159 - - [17/Nov/2006:10:06:52 -0800] "POST /posting.php HTTP/1.1" 200 4565 "http://forum.tfbw.com/posting.php?mode=reply&t=62&sid=bfa27b162263410f7f52d5d5f4b61bd8" "Opera/9.00 (Windows NT 5.1; U; ru)"
62.33.137.159 - - [17/Nov/2006:10:07:00 -0800] "GET /viewtopic.php?p=112 HTTP/1.1" 200 10965 "http://forum.tfbw.com/posting.php" "Opera/9.00 (Windows NT 5.1; U; ru)"
62.33.137.159 - - [17/Nov/2006:10:07:05 -0800] "GET /favicon.ico HTTP/1.1" 404 584 "http://forum.tfbw.com/viewtopic.php?p=112" "Opera/9.00 (Windows NT 5.1; U; ru)"
Yeah... you may need to copy/paste that somewhere to make it readable, but it's not much better in terms of readability at larger sizes. Note in particular that the initial "referer" URL. This very forum happens to be on the first page of that particular Google search. I'll repeat it here at full size to save you the bother of getting a magnifying glass.
Code:
http://www.google.com/search?hl=en&lr=&client=opera&rls=ru&q=site%3A+forum+mode%3Dreply%26t&btnG=Search
I think the intention was to find forums that allowed public posting, and it's worked to the extent that it found mine, but many of those hits aren't even forums, and mine is the first on the list that allows public posting. There might be something in this that I'm not getting, but I'm leaning towards the view that this particular spammer is just a bit of a n00b.