21 Responses to “More Fun With Spam!”

1. jgt Says:
   October 13th, 2005 at 4:17 am

   The thing I’ve never figured out is why spammers continue to leave 30 comment/trackback spams on my page every day, when none of them make it to the live site. I even renamed the comment- and trackback-submission php files, so they’re apparently scraping the form. As far as I can tell, they’re getting absolutely no benefit from hitting my site, yet they continue to do so. I just don’t get it.

   (I’m not expecting you to know the answer; I’m just venting.)

2. Marco Says:
   October 13th, 2005 at 4:50 am

   Are you guys actively blocking open proxies at firewall level? Those are often abused by spammers. I now have a huge .htaccess block list but firewalling the proxies is a lot better. They are also used by comment spammers by the way, which also puts a very high load on the server depending on what anti-comment-spam package the blogger is running.

3. Paul Goscicki Says:
   October 13th, 2005 at 5:20 am

   And I have thought that they have only targeted my site (which resulted in a very biased visitors statistics), while it seems whole Dreamhost was their target. Interesting…

4. Marco Says:
   October 13th, 2005 at 5:30 am

   Also, among others I have these rules in my .htaccess. They block HUGE amounts of referrer spam:

   # PHARMACY CRAP

   RewriteCond %{HTTP_REFERER} medicine [NC,OR]
   RewriteCond %{HTTP_REFERER} health [NC,OR]
   RewriteCond %{HTTP_REFERER} retin-a [NC,OR]
   RewriteCond %{HTTP_REFERER} ionamin [NC,OR]
   RewriteCond %{HTTP_REFERER} adipex [NC,OR]
   RewriteCond %{HTTP_REFERER} xenical [NC,OR]
   RewriteCond %{HTTP_REFERER} tramadol [NC,OR]
   RewriteCond %{HTTP_REFERER} cialis [NC,OR]
   RewriteCond %{HTTP_REFERER} fluoxetine [NC,OR]
   RewriteCond %{HTTP_REFERER} pharmacy [NC,OR]
   RewriteCond %{HTTP_REFERER} ultram [NC,OR]
   RewriteCond %{HTTP_REFERER} tramadol [NC,OR]
   RewriteCond %{HTTP_REFERER} imitrex [NC,OR]
   RewriteCond %{HTTP_REFERER} ultracet [NC,OR]
   RewriteCond %{HTTP_REFERER} levitra [NC,OR]
   RewriteCond %{HTTP_REFERER} triphasil [NC,OR]
   RewriteCond %{HTTP_REFERER} estradiol [NC,OR]
   RewriteCond %{HTTP_REFERER} diflucan [NC,OR]
   RewriteCond %{HTTP_REFERER} zyban [NC,OR]
   RewriteCond %{HTTP_REFERER} phentermine [NC,OR]
   RewriteCond %{HTTP_REFERER} drugs [NC,OR]
   RewriteCond %{HTTP_REFERER} prozac [NC,OR]
   RewriteCond %{HTTP_REFERER} valtrex [NC,OR]
   RewriteCond %{HTTP_REFERER} aldara [NC,OR]
   RewriteCond %{HTTP_REFERER} condylox [NC,OR]
   RewriteCond %{HTTP_REFERER} acyclovir [NC,OR]
   RewriteCond %{HTTP_REFERER} famvir [NC,OR]
   RewriteCond %{HTTP_REFERER} denavir [NC,OR]
   RewriteCond %{HTTP_REFERER} zovirax [NC,OR]
   RewriteCond %{HTTP_REFERER} cyclobenzaprine [NC,OR]
   RewriteCond %{HTTP_REFERER} zanaflex [NC,OR]
   RewriteCond %{HTTP_REFERER} carisoprodol [NC,OR]
   RewriteCond %{HTTP_REFERER} skelaxin [NC,OR]
   RewriteCond %{HTTP_REFERER} paxil [NC,OR]
   RewriteCond %{HTTP_REFERER} prescription [NC,OR]
   RewriteCond %{HTTP_REFERER} valium [NC,OR]
   RewriteCond %{HTTP_REFERER} hydrocodone [NC,OR]
   RewriteCond %{HTTP_REFERER} viagra [NC,OR]
   RewriteCond %{HTTP_REFERER} propecia [NC,OR]
   RewriteCond %{HTTP_REFERER} celebrex [NC,OR]
   RewriteCond %{HTTP_REFERER} pills [NC,OR]
   RewriteCond %{HTTP_REFERER} xanax [NC,OR]
   RewriteCond %{HTTP_REFERER} meridia [NC,OR]
   RewriteCond %{HTTP_REFERER} pharmacie [NC,OR]
   RewriteCond %{HTTP_REFERER} viagra [NC,OR]
   RewriteCond %{HTTP_REFERER} ambien [NC,OR]

   # GAMBLING CRAP

   RewriteCond %{HTTP_REFERER} poker [NC,OR]
   RewriteCond %{HTTP_REFERER} blackjack [NC,OR]
   RewriteCond %{HTTP_REFERER} black-jack [NC,OR]
   RewriteCond %{HTTP_REFERER} casino [NC,OR]
   RewriteCond %{HTTP_REFERER} roulette [NC,OR]
   RewriteCond %{HTTP_REFERER} gambling [NC,OR]
   RewriteCond %{HTTP_REFERER} texas- [NC,OR]
   RewriteCond %{HTTP_REFERER} holdem [NC,OR]

   # FINANCIAL / MARKETING CRAP

   RewriteCond %{HTTP_REFERER} paying [NC,OR]
   RewriteCond %{HTTP_REFERER} mortgage [NC,OR]
   RewriteCond %{HTTP_REFERER} finance [NC,OR]
   RewriteCond %{HTTP_REFERER} insurance [NC,OR]
   RewriteCond %{HTTP_REFERER} credit [NC,OR]
   RewriteCond %{HTTP_REFERER} credit-card [NC,OR]
   RewriteCond %{HTTP_REFERER} loan [NC,OR]
   RewriteCond %{HTTP_REFERER} buy [NC,OR]
   RewriteCond %{HTTP_REFERER} cheap- [NC,OR]
   RewriteCond %{HTTP_REFERER} commercial- [NC,OR]
   RewriteCond %{HTTP_REFERER} webmaster [NC,OR]
   RewriteCond %{HTTP_REFERER} affiliate [NC,OR]
   RewriteCond %{HTTP_REFERER} order- [NC,OR]
   RewriteCond %{HTTP_REFERER} business [NC,OR]

   # SEX / PORN CRAP

   RewriteCond %{HTTP_REFERER} -rape [NC,OR]
   RewriteCond %{HTTP_REFERER} xxx [NC,OR]
   RewriteCond %{HTTP_REFERER} bestiality [NC,OR]
   RewriteCond %{HTTP_REFERER} sodomy [NC,OR]
   RewriteCond %{HTTP_REFERER} rape- [NC,OR]
   RewriteCond %{HTTP_REFERER} sperm [NC,OR]
   RewriteCond %{HTTP_REFERER} semen [NC,OR]
   RewriteCond %{HTTP_REFERER} ejacula [NC,OR]
   RewriteCond %{HTTP_REFERER} blowjob [NC,OR]
   RewriteCond %{HTTP_REFERER} blow-job [NC,OR]
   RewriteCond %{HTTP_REFERER} gay [NC,OR]
   RewriteCond %{HTTP_REFERER} -sex [NC,OR]
   RewriteCond %{HTTP_REFERER} -teen [NC,OR]
   RewriteCond %{HTTP_REFERER} teen- [NC,OR]
   RewriteCond %{HTTP_REFERER} -pics [NC,OR]
   RewriteCond %{HTTP_REFERER} sex- [NC,OR]
   RewriteCond %{HTTP_REFERER} incest [NC,OR]
   RewriteCond %{HTTP_REFERER} lesbian [NC,OR]
   RewriteCond %{HTTP_REFERER} adult [NC,OR]
   RewriteCond %{HTTP_REFERER} hentai [NC,OR]
   RewriteCond %{HTTP_REFERER} porn [NC,OR]

   # MISC

   RewriteCond %{HTTP_REFERER} cruises [NC,OR]
   RewriteCond %{HTTP_REFERER} premature [NC,OR]
   RewriteCond %{HTTP_REFERER} ejaculation [NC,OR]
   RewriteCond %{HTTP_REFERER} penis [NC,OR]
   RewriteCond %{HTTP_REFERER} replica [NC,OR]
   RewriteCond %{HTTP_REFERER} watches [NC,OR]
   RewriteCond %{HTTP_REFERER} diet [NC,OR]
   RewriteCond %{HTTP_REFERER} cams [NC,OR]

   If you want the whole file, I’ve got a link to it from my weblog’s frontpage.

5. Gail Says:
   October 13th, 2005 at 6:57 am

   I get massive amounts (well, maybe not massive) of referrer spam - I don’t display a top list of sites on my blog, but it still makes things icky in my stats pages. I hope the changes you’ve made helps!

6. hungerfan Says:
   October 13th, 2005 at 8:05 am

   Would these changes being made cause issues with a site? One site that is on basic-moon is not responding this morning but another site I have is doing just fine and it is on basic-heavy.

   Ed

7. Adam Backstrom Says:
   October 13th, 2005 at 12:01 pm

   jgt, I assume they keep leaving spam because it is cheaper to have the spam bot crawl and comment regardless of the result.

8. Tin Says:
   October 13th, 2005 at 2:39 pm

   For all the Wordpress users out there, you may already know about this, but there’s a plugin called Bad Behavior, which blocks spam pretty well. The scripts can be adapted to work with any PHP-based system, too. If anyone is having problems with spam, I hope this helps.

9. Marco Says:
   October 14th, 2005 at 1:19 am

   Just a small question guys!
   How much are you guys already stopping with mod_security? Could you tell me what kind of rules you’re using? Maybe (parts of) my .htaccess file isn’t even necessary. If that’s the case I can save some resouces here!

10. Marco Says:
    October 14th, 2005 at 2:17 am

    Extra remark: I don’t know all that much about mod_security but if you could block the above word-patterns at server-level through mod_security whenever they occur in a referrer it would save a LOT of bandwidth and cpu cycles.

11. Marco Says:
    October 14th, 2005 at 6:21 am

    Thinking ahead, this helps quite a bit if you call it at the very beginning of your PHP scripts. I have this as the very first thing that’s called when someone requests my pages:

    
function killspammer() {

    /* add items to this array at will */

    $aSpamWords = array(
'medicine',
'health',
'retin-a',
'ionamin',
'adipex',
'xenical',
'tramadol',
'pareto',
'cialis',
'fluoxetine',
'pharmacy',
'ultram',
'tramadol',
'imitrex',
'ultracet',
'fioricet',
'zoloft',
'levitra',
'lipitor',
'triphasil',
'estradiol',
'diflucan',
'zyban',
'phentermine',
'drugs',
'prozac',
'valtrex',
'aldara',
'condylox',
'acyclovir',
'famvir',
'denavir',
'zovirax',
'cyclobenzaprine',
'zanaflex',
'carisoprodol',
'skelaxin',
'paxil',
'prescription',
'valium',
'hydrocodone',
'viagra',
'propecia',
'celebrex',
'pills',
'xanax',
'meridia',
'pharmacie',
'viagra',
'ambien',
'poker',
'blackjack',
'black-jack',
'casino',
'roulette',
'gambling',
'texas-',
'holdem',
'paying',
'mortgage',
'finance',
'insurance',
'credit',
'credit-card',
'loan',
'buy',
'cheap-',
'commercial-',
'webmaster',
'affiliate',
'order-',
'business',
'-rape',
'xxx',
'bestiality',
'sodomy',
'rape-',
'sperm',
'semen',
'ejacula',
'blowjob',
'blow-job',
'gay',
'-sex',
'-teen',
'teen-',
'-pics',
'sex-',
'incest',
'lesbian',
'adult',
'hentai',
'porn',
'cruises',
'premature',
'ejaculation',
'*beep*',
'replica',
'watches',
'diet',
'cams');
$sReferer = $_SERVER['HTTP_REFERER'];
foreach($aSpamWords as $sSpamWord) {
if(stripos($sReferer, $sSpamWord) != false) {
die();
}
}
return “”;
}
?>


12. Daniel Says:
    October 14th, 2005 at 1:43 pm

    Josh,
    I’m really upset with you. You got my hopes up, and I was “dreaming” of the video airport at night… Then the video ipod came out and shot them down. DAMN YOU, MAN!

    Oh ya… interesting entry, Nate. The fact that people would spam in that manner just makes me… laugh… a lot. lol.

13. G Vigneault Says:
    October 14th, 2005 at 4:59 pm

    Just install Referrer Karma and Spam Karma for WordPress.

    My blog pass the 12,000 at 750 spam referer per day

14. Ashley Says:
    October 15th, 2005 at 3:24 pm

    None of my sites have traditional referrer pages that show any of these but all of my sites get hit by tons of referrer spam.

    A few jackasses are selling software (and presumably, site lists) to do the spamming. Merely taking down your referring site stuff won’t stop the hits.

15. Marco Says:
    October 16th, 2005 at 11:23 pm

    Hello Dreamhost crew? Are you actually reading this blog or are you only posting-and-forgetting?

    My site is being hammered by one single asshole promoting his crap porn site for days already. Multiple requests PER MINUTE!

    Another idiot is promoting tons of prescriptiondrugname.sie.pl and then there’s another porn spammer with tons of seeya.at domains.

    212.175.112.152 - - [16/Oct/2005:23:21:20 -0700] “GET /weblog/ HTTP/1.0″ 200 0 “http://sesso-racconti.com” “Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)”

    As you see in the access rule at least my little function keeps them from stealing bandwidth or many cpu cycles but still I’d like to know what you guys are doing to prevent/battle all this. I asked this by mail some days ago already but I didn’t get a response….

16. TB Says:
    October 18th, 2005 at 11:43 am

    Wordpress:

    Gets rid of my comment spam:
    http://elliottback.com/wp/archives/2005/05/11/wordpress-hashcash-20/
    Uses a hashing algorithm.

    Gets rid of my trackback spam:
    http://blog.mytechaid.com/archives/2005/03/09/wordpress-trackback-spam-solution/
    Uses modrewrite rules.

    I haven’t gotten a single spam since using those. No blacklists or spam score or anything else required.

17. Off the Kuff Says:
    October 18th, 2005 at 12:28 pm

    August and September traffic reports

    I managed to skip doing a traffic report last month amidst all the excitement. August and September were both pretty…

18. Marco Says:
    October 18th, 2005 at 2:41 pm

    Hashcash does nothing against referrer spam which is what this thread is all about.

19. Jason Says:
    October 23rd, 2005 at 8:43 am

    With all these spam bots flying around automagically, might I suggest some of you check out Bad Behavior?
    ESPECIALLY THOSE OF YOU USING WORDPRESS!

20. bdotson Says:
    November 5th, 2005 at 4:05 pm

    Thanks for that link Jason. I didn’t know that plugin existed for Wordpress. I’ll have to install that today.

21. IGrizzli Says:
    December 3rd, 2005 at 1:24 pm

    I don’t have a blog. But I have site and site’s Forum attacks by spamers a lot of times every day. Do you know some plugins which can help me?

Leave a Reply

Name

Mail (will not be published)

Website