Feeling dirty

Not me, you. A recent post in the Web App Security mailing list prompted me to take a look at my own logs and do a little bit of extra research. This NWF article talks about FunWebProducts and its rapid spread as spyware. One thing that I haven't seen mentioned yet is what I've noticed in my referer logs. The IP's with the spyware (67.149.42.119, 24.186.59.180, 172.141.208.54, and 4.16.57.93, in the last week) are all referers for www.locators.com.

I wonder...