Trackback Spam II
Back at the end of June, I reported that trackback spam directed against this site had soared to nearly 13,000/month. That was, by any measure, a pretty hefty amount of spam. You might well have wondered what has happened since then.
Automated Trackback Spam, Feb-Oct 2005.
As you can see from the graph at left, my trackback spam load has settled down to just shy of 12,000/month. Most of these come from a withering array of open proxies and (increasingly) zombie PCs. Almost all of them are automatically blocked, but if even 1/2 of 1% sneak through, that’s still an undesirably large amount of spam to clean up manually. I strive for, and almost achieve an Ivory Snow-level of effectiveness.
More than just blocking them, I do my best to tarpit the spammers. As I write this, there are 212 tarpitted connections open. Each of these stay open for as long as two days. You’d think that would have a significant impact on the spammers. But, with an unlimited number of open proxies and zombie PCs to choose from, the spammers don’t seem to care much.
Starting in July, I noticed a new trend: rather aggressive trackback spammers operating from fixed IP addresses. They’re indicated by the dark rectangles in the graph. Trackback spamming from a fixed IP address is dumb. It makes you too easy to block or, in this case, to harass. Once I got serious about counter-attacking those fixed-IP spammers, their numbers dropped rather precipitously (from 3769 in August to 59 in October).
A minor triumph, perhaps, but one that does little to ease my anxiety. There are clearly a number of new groups out there, writing new trackback spambots. Like someone nervously watching the levée as the floodwaters rise, I wonder how long my blocking techniques will remain effective.
Re: Trackback Spam II
Your stats got me to check on my trackback spam. I got 2,724 attempts last month on my current trackback cgi file. However, there were also 1,784 attempts on the previous name of that file. But what was surprising was that the name I had for the trackback script before that got 16,931 attempts last month. That name hasn’t been in use for months. And both previous filenames return a 410. Still including everything I got 21,439 POST attempts at current and previous trackback scripts. However, there was no attempt at the MT default name (mt-tb.cgi) which I haven’t used in a while.