```json
{
    "title": "Stupid attacking domain — andrewsaluk.com",
    "url": "https://performancezen.com/2005/02/12/stupid-attacking-domain-andrewsalukcom/",
    "datePublished": "2005-02-12",
    "dateModified": "2022-04-29",
    "language": "en-US",
    "description": "Looks like some bozo has managed to take over a large number of machines and launch some sort of zombie attack against blogs. If you see andrewsaluk.com filling up your…",
    "author": "spierzchala",
    "publisher": "Performance Zen"
}
```

# Stupid attacking domain — andrewsaluk.com

Looks like some bozo has managed to take over a large number of machines and launch some sort of zombie attack against blogs. If you see *andrewsaluk.com* filling up your referrer log, block the hosts. They are likely zombies.

Just checked the domain (IP address [211.180.238.254](https://networksdb.io/ip/211.180.238.254)) -- it originates in South Korea. Definitely points to either a script-kiddie or a zombie on a high-speed connection.