I hardly get any feedback through the contact form, so whenever something pops up, I'm always curious. This time it's Marilyn Shaw informing me that I've got a broken link in one of my articles. And, very helpfull, she pointed me to a useful replacement. 

And that's when the cautious mode kicks in, the message contains a shortened URL , and the shortened URL and the useful replacement both end up at the same domain www.whoishostingthis.com , and the email address also points there. The ip-address that's used for the posting originates from the Philippines. Searching the internet reveals more of these spams, including another message if you do not reply or change the link.

What surprises me the most is the effort that went in to sending me the message, as the contact form I've used requires you to select a picture to send the mail. There's no simple way to script this, so an actual human, in my case Marilyn, has to type that message

Message after the break

(all links in the message are broken on purpose, don't email me about that)


Date 15-12-2016 10:18
Subject: One of your pages has a broken link

 

From Marilyn Shaw at marilyn.shaw at whoishostingthismail.com

112.198.243.92 using Chrome

Hi,

Whilst researching Mod_rewrite resources to cite on our website, I found one of your links isn’t working.

It's this link that seems to be broken: http://www.ilovejackdaniels.com/apache/mod_rewrite-cheat-sheet/, here on this page of your site http://dribibu.xs4all.nl/en/component/content/article/26-website/236-rewrittenurlsinamajorway.html, using this text "mod rewrite cheat sheet".

Please check out our resource http://wiht.link/Mod_rewriteCS as it may prove a useful replacement.

Best,
Marilyn

 

This is an obvious attempt to generate traffic to the website that is hosting all this. Be warned !

I'm anxiously waiting for more news from Marilyn  :-D

Well, I didn't have to wait very long, one week after the first message:


Date 22-12-2016 05:53
Subject: Re: One of your pages has a broken link


From Marilyn Shaw at marilyn.shaw at whoishostingthismail.com

180.191.134.121 using Chrome

Hi,

I noticed that the link on your site is still broken and I thought that I would follow up on the email I sent the other day; copy included below for reference.

On Thu, Dec 15, 2016 at 5:18 PM, wrote:



Hi,

Whilst researching Mod_rewrite resources to cite on our website, I found one of your links isn’t working.

It's this link that seems to be broken: http://www.ilovejackdaniels.com/apache/mod_rewrite-cheat-sheet/, here on this page of your site http://dribibu.xs4all.nl/en/component/content/article/26-website/236-rewrittenurlsinamajorway.html, using this text "mod rewrite cheat sheet".

Please check out our resource http://wiht.link/Mod_rewriteCS as it may prove a useful replacement.

Best,
Marilyn

 

As I already suspected, they continue their attempts. This ip-address also points to the Philippines. Another thing I noticed, is that the new messages seems to be a reply to a copy they sent to themselves. Only the copy arrived in a different timezone, we're doing UTC+1 now, so that should be UTC+8, another pointer to someone far, far away, and funny, the Philippines match !. They haven't noticed I changed the link four days ago, that I visited the given link more than once or that I've written this.

The domains whoishostingthis and whoishostingthisemail are both registered by:
Organisation: Identity Protect Limited
Owner: Identity Protection Service
in the UK.