annie

Agreed, PR doesn't mean much. A week ago or so, I notified a dynamic IP host that one of the users was spamming. Instead of disabling the address, they put in a 302 redirect to my post exposing the spammer. Fast forward a week, and that address has been banned in Google (did the honors myself), but I come up third in MSN for a very dirty phrase, and pretty high up in Yahoo for a similar dirty phrase. I now get a significant amount of hits from the search engines from people who look for ahem, perverted .... Very weird. Unintended search engine occurrences. I bet my expose on the spammer ranks much better than the spammer could have ranked on his original page. No contest really. There are other pages I haven't succeeded in having yanked yet (I bet the admins in Denmark are on Easter holiday, that's a big deal here in Scandinavia), so it's possible to make comparisons.

Ah, the revelation that it was flash related makes sense. I've currently got java disabled (and have for some time), but for the first time in a long time flash is enabled. Yep, makes perfect sense.

First time I noticed the problem was when visiting a Tripod site. Some newspapers and disc.server forums. It blocks most pop-ups, but the ones that sneak through are getting more numerous.

That's very weird!

If someone else from AOL has subscribed before, sure.

If you get trackbacks from someone on that server, then yes, you will get visits. But unless you have very few visitors, it shouldn't go that high on the list. I think you should download your raw logs and grep for the IP number, then see what you're seeing. Check the user agent of the accesses.

These are normal when an AOL user accesses your site. They use proxies, and the numbers can change from access to access, in the same session. They also use HEAD to avoid having to fetch the whole document if it hasn't changed recently.

For rude bots, you exclude with .htaccess

Some bots get caught in loops, infinite or otherwise. I'd block the IP number in .htaccess and not worry anymore about it. Well, I'd probably have a look in the logs first, to see exactly what was goin on.

But be aware that there's a bug in cpanel, so the log rolls over about one or two days before the month ends. And then it might roll over one more time for good measure. Which means unless you work around that, you'll lose at least a few hours worth of logs each month. Just a heads up. This is common to ALL hosts using cpanel.

I get trackbacks from many platforms, so yes, it's a general thing.

But what about E-mail filtering in cpanel?

My two forums are both earlier versions. Did you find anything for them?

The advice about renaming the comment script doesn't help much. One of the most prolific comment spammers, the Bulgarians, adapt quickly. Last time I changed mine, they didn't even try the old one, just went straight for the new one. What does help, is a few .htaccess tricks. # This seems to stop the Bulgarians: RewriteCond %{HTTP:VIA} ^.+pinappleproxy RewriteRule .* - [L,F] This one seems to stop Alexander Morozov: SetEnvIf User-Agent "compatible; MSIE 5.5; Windows 98; Win 9x 4.90" spammer <Limit POST> Order Allow,Deny Allow from all Deny from env=spammer </Limit> And this one seems to stop him from actually browsing: SetEnvIfNoCase X-AAAAAAAAAAAA 1 spammer=yes There are more tricks, of course. I keep a running commentary on the tactics of these spammers on my blog (click the smiley):

Google has started crawling more often. That's on public record. I've got 90 megs worth of Google love this month on the site where I have a forum. Haven't checked the other - where I've outlawed Google from the forum.

Googlebot has trouble with all the links on a forum. Especially my cat forum site is getting hit severely. I'm running an early version of IPB. I'm looking for a way to make Googlebot not hit all those links. But I'm not sure how. You know, with that trailing alphabet soup they've got goin on that version of IPB, it gets really bad. Especially since there's a link to virtually everything. I mean, one link for every post, which means one thread gets hit over and over.

It can be done. And I'm sure Raul has already told you how. Just be careful. Those files can get mighty big after a while!

The e-mail address in my Cpanel is current. I still didn't get the e-mail. Where is this immediate policy change? I haven't seen it.

All customers? I didn't receive that e-mail.

There was an outbreak of MT trackback spams from the Bulgarians yesterday. I'm sure TCH did a server wide adjustment when they discovered it.

Do backups of the databases, and also FTP copies of the weblog folders.

I read the law taking effect tomorrow in Norway. The wording is so broad, I think blogspam is covered! Of course, it probably only works if both sender and recipient is in Norway. And I don't know what the penalties are. Probably civil.

Thought this might spark some conversation: http://www.theregister.co.uk/2005/01/31/li...amer_interview/

Could it be some link from within AOL? I mean, part of their system is closed to the outside world.

Wow, you're saying this thing was exploited? Let's say my install was exploited. Would there be any tell tale signs in my logs? What would I be looking for?