Trackback Spammers
The group of spammers I blogged about previously, the ones using crapflooding techniques (multiple POSTs from behind anonymous proxies) for comment spam, finally returned, this time as Trackback spammers. Lotta people seem to have been hit hard.
Since it took the Crapflooders only a week or so to figure out that Trackback flooding was easier and more fun than Comment flooding, I was wondering when these spammers would come to the same realization. Last night, they finally did. Golem received several hundred trackback attempts, in two concerted waves.
When the crapflooders were at it, a throttle on the number of trackbacks in a given time-period was my main defence. That throttle is now built-into MT 3.1x.
Since then, I’ve wised up a bit, and block submissions (of Trackbacks and Comments) from open HTTP Proxies. Thanks to Brad Choate’s plugin, modified to use the opm.blitzed.org DNSBL list of open Proxies (instead of the irrelevant dsbl.org list of open SMTP servers), all of the hundreds of would-be spam Trackbacks were blocked.
The modifications to Brad’s plugin are easy,
--- plugins/dsbl_deny.pl.orig Thu Nov 11 11:06:29 2004 +++ plugins/dsbl_deny.pl Thu Nov 11 11:08:58 2004 @@ -12,9 +12,9 @@ my ($eh, $app, $comment) = @_; my $remote_ip = $app->remote_ip; my ($a, $b, $c, $d) = split /\./, $remote_ip; - if (checkdnsrr("$d.$c.$b.$a.list.dsbl.org")) { + if (checkdnsrr("$d.$c.$b.$a.opm.blitzed.org")) { $app->log("Blocked comment post from known open proxy: $remote_ip"); - my $url = "http://dsbl.org/listing?$remote_ip"; + my $url = "http://opm.blitzed.org/proxy?ip=$remote_ip"; # we're forcing out the header here and exiting since I can't find # a cleaner way to force a redirection to the DSBL.org site...
The only surprising thing was how well it performed.
Update (2/2/2005):
Zack is, alas, correct. My “internal working version” is a little more heavily hacked than I let on (or even remembered). So, pending Brad releasing a new version of his plugin, here’s a (slightly neatened-up) canned replacement which filters both Comments and Trackbacks.Update (2/4/2005):
Ever the scientist, I decided to check whether the success of theopm.blitzed.org open proxy list in covering the particular proxies used by these spammers in their recent Trackback Spam runs was due to dumb luck or to genuine comprehensiveness. So I decided to look up a much larger sample of IP addresses, used in recent weeks by these lowlifes for referrer spam and their (feeble attempts at) comment spam. The result is that opm.blitzed.org lists only about half of those IP addresses1. In other words, I got lucky2.So I’ve begun to deploy some other countermeasures against them, which I will surely write about anon. In the meantime, there’s a wee buglet in the plugin I posted the other day. If you downloaded it, please download it again.
1 Looking back at a weeks-old list of proxies may not be a reliable measure. Many of these may once have been open, but are now closed and delisted. So this surely understates the effectiveness of the Blitzed list. By how much is hard to tell.
2 In case you’re wondering about the Central Limit Theorem, a spam run seems to use about a dozen different proxies, but these are likely not uncorrelated. If the spammers use trojanned PCs for their spam run, none of them will show up on the Blitzed list. Conversely, if they happen to use open proxies, which have previously been used to connect to certain IRC channels (monitored by the BOPM), they all will appear.
Re: Trackback Spammers
Thanks for taking the time to write this up, Jacques. I think this episode will give us the incentive to upgrade our site. Though we can’t hope to be as all-singing, all-dancing, all-standards-compliant as golem ;-)