Can you help with a problem?

[misterjam]

Hello, Japanese page people.
I am a syndicated newspaper humor columnist in Asia, and I enjoy Japanese culture.
I also appreciate websites such as the Japanese page, and the work that many people like you do to spread appreciation of the culture.
Well done, for all the good work you do.
I just have one small problem. My daily newspaper column appears on http://www.misterjam.com and is thankfully free of spam for years. Except that just recently, I have suddenly been getting regular spam emails appearing in the comments boxes. Every single one links back to japanese page -- to the files section. The most recent goes to a file called "hot video" -- which doesn't sound like something i would be interesting in viewing. (I run a child-friendly family humor site.)
It seems to me that from the tone of most of your pages, you would not be sending out pornographic spam. Is it someone from within your team? Or someone who has penetrated (no pun intended!) the site in some way? Anyway, i wish you every success, but if anyone can tell me how to stop these spam comments, I would be pleased. By the way, I have had open, anonymous commenting enabled for years, and it would be a shame if I had to introduce some sort of registration system simply to stop these links to the Japanese page.
Finally, I'd just like to add that I know some people get terribly hostile at the slightest implication that they are being criticized, so let me make it clear that I am not making any sort of negative accusations at anyone, but merely seeking help with a problem.
warmest wishes
Mister Jam

[Wakannai]

could you link to one of the comments that has the spam? Or copy and paste one?

[coco]

I think it might be better that this topic is placed in the "problem" category.
Admins, could you please move this topic to there ? So that moderators and administrators can easily find this topic.

Every single one links back to japanese page -- to the files section. The most recent goes to a file called "hot video"

If there was a hot video (file ?) section in TJP, videos should be Grandma friendly contents! (I am curious about that, though.)
----
Edit：
Richさんでしょうか?　移動してくださってありがとうございます。

[misterjam]

Thanks for your prompt response. You asked me to cut and paste one of the spam emails. The latest one, which arrived in the last half day, is pasted below. Maybe the IP address can reveal the source. Thanks again.
**

From:

Jonny was here comprehension for teens wfk
• Commenter name: Jfgdrexs
• Commenter email: rikky@aol.com
• Commenter URL: http://www.thejapanesepage.com/files/hotvideo.html
• IP address: 200.193.115.3
• Authentication: None

[Wakannai]

interesting, that redirects off this site to IGN.. The link looks valid, but I can't help but wonder if he's ghosting our url. It's gonna take me a bit to figure out if he's using an ASCII character with a different code that looks the same.

edit - wierd. I typed in the url and it still re-directed. So apparently that page got hacked in somehow. Phreadom should be waking up soon, so he should be able to figure it out.

[Sairana]

apparently TJP pissed off someone in Mexico, or the person who is doing it is good at spoofing his IP.

IP Address Contact Information

OrgName: Latin American and Caribbean IP address Regional Registry
OrgID: LACNIC
Address: Rambla Republica de Mexico 6125
City: Montevideo
StateProv:
PostalCode: 11400
Country: UY

[Wakannai]

apparently TJP pissed off someone in Mexico,

Why does the name Jonny make me cringe?

edit - http://www.thejapanesepage.com/PatrikCrolse/ is the redirect FROM the IGN site. So if I click on redirect it goes to this guy. Of course, his page has long been deleted already. Apparently this is a hack into a vulnerability in the blog software and it suffers at IGN's end as well. Because when I hover over the report links and such at IGN, it comes back to TJP.

These are all links back to TJP from the IGN page
http://www.thejapanesepage.com/PatrikCr ... ent/90710/
http://www.thejapanesepage.com/PatrikCr ... /23/90710/
http://www.thejapanesepage.com/UserPage ... stid=90710
http://www.thejapanesepage.com/PatrikCrolse/2008/05/23/
http://www.thejapanesepage.com/PatrikCrolse/

It's especially noteworthy that the "mark as offensive" link at IGN redirects here.

i'm guessing someone dropped a page in with a really fast redirect. Or someone hacked the name server account and added a redirect at the URL registry level.

[coco]

If 200.193.115.3 is our registered user, isn't it easy to find who is he?

[Wakannai]

Unfortunately, even though the admin can ban the person spamming and call IGN and let them know to remove this jerk, we really won't be able to do anything about the guy spamming personally. He will still be free to send you spam, we can just make his links not work anymore.

[Sairana]

I poked around on the "IGN" blog that you get redirected to like Wakannai did, and noticed most of the same things. However, in the page source, the "referrer URL" is NOT from here (as it should be if I click it from here), but from an -actual- IGN blog by a user of the same name.

<!-- Request.UrlReferrer = http://blogs.ign.com/PatrikCrolse -->

Go to THAT link, and it looks very familiar

I'm not exactly sure what it all points to, exactly. Seems like a guy is probably managing to get click-through credit on a reward-oriented program by way of massive redirects. But I don't even know if that's possible. Heh.

Anyway... people who know more about the back-end of internet programming will have to uncover the rest of the clues, this pushes my technological limits.

[coco]

Sairanaさん、すばらしい!
Could someone ( admins), remove his attachment files, please?
http://www.thejapanesepage.com/node/1899

[ss]

Sairana, you are awesome!

Some people are indeed abusing the use of blogs.

[coco]

Dear admins.
Thank you for removing the attachment files.

Now, http://www.thejapanesepage.com/files/hotvideo.html goes nowhere.
----
Misterjam-san, please click http://www.thejapanesepage.com/files/diary.html

and please see http://www.thejapanesepage.com/node/1899

I think that could be the way JoseffSmith used.

Thank you for letting us know this problem.
This could happen soon or later. I think admins will take measures against the problem.

( sorry for my broken English.)
----
Edit: it seems that admins banned JoseffSmith since node/1899 and 1900 were gone. (cf.)

[Wakannai]

<!-- Request.UrlReferrer = http://blogs.ign.com/PatrikCrolse -->

Go to THAT link, and it looks very familiar

I went ahead and deleted that node/1900 page.

Looks like we need to remove the ability to attach htm and html pages.

[phreadom]

Sorry I was gone everyone.

Looking into this now.