annie

I was trying to enter my domains in the list. For one of the domains, the admin address is on TCH. And no matter what I do, I never get the mail. Did you block that address? If so, why?

There are some users on my ISP that keep trying to access my computer. I'm not 100% sure what they're trying to do. At first I thought they were zombies. Then I read up on messenger spam, and now I saw something about MSQL attacks. Anyway, here's from my log today. Time zone is GMT: Jan 25 15:25:00 home.gateway:firewall:info: 270665.073 Blocked Prot=6, xx.xxx.xxx.xxx(attacker):3426 > xx.xxx.xxx.xxx(mine):135, S Seq=-1102522738, Ack=0 -Default Defense Jan 25 15:25:00 home.gateway:firewall:info: 270665.073 Blocked Prot=6, xx.xxx.xxx.xxx(attacker):3426 > xx.xxx.xxx.xxx(mine):135, S Seq=-1102522738, Ack=0 -Disallowed Destination IP Jan 25 15:25:00 home.gateway:firewall:info: 270665.085 Blocked Prot=6, xx.xxx.xxx.xxx(attacker):3427 > xx.xxx.xxx.xxx(mine):1025, S Seq=-1102439480, Ack=0 -Default Defense Jan 25 15:25:00 home.gateway:firewall:info: 270665.085 Blocked Prot=6, xx.xxx.xxx.xxx(attacker):3427 > xx.xxx.xxx.xxx(mine):1025, S Seq=-1102439480, Ack=0 -Disallowed Destination IP Jan 25 15:25:00 home.gateway:firewall:info: 270665.112 Blocked Prot=6, xx.xxx.xxx.xxx(attacker):3429 > xx.xxx.xxx.xxx(mine):1433, S Seq=-1102329596, Ack=0 -Default Defense Jan 25 15:25:00 home.gateway:firewall:info: 270665.112 Blocked Prot=6, xx.xxx.xxx.xxx(attacker):3429 > xx.xxx.xxx.xxx(mine):1433, S Seq=-1102329596, Ack=0 -Disallowed Destination IP Jan 25 15:25:03 home.gateway:firewall:info: 270667.980 Blocked Prot=6, xx.xxx.xxx.xxx(attacker):3426 > xx.xxx.xxx.xxx(mine):135, S Seq=-1102522738, Ack=0 -Default Defense Jan 25 15:25:03 home.gateway:firewall:info: 270667.980 Blocked Prot=6, xx.xxx.xxx.xxx(attacker):3426 > xx.xxx.xxx.xxx(mine):135, S Seq=-1102522738, Ack=0 -Disallowed Destination IP Jan 25 15:25:03 home.gateway:firewall:info: 270668.079 Blocked Prot=6, xx.xxx.xxx.xxx(attacker):3427 > xx.xxx.xxx.xxx(mine):1025, S Seq=-1102439480, Ack=0 -Default Defense Jan 25 15:25:03 home.gateway:firewall:info: 270668.079 Blocked Prot=6, xx.xxx.xxx.xxx(attacker):3427 > xx.xxx.xxx.xxx(mine):1025, S Seq=-1102439480, Ack=0 -Disallowed Destination IP Jan 25 15:25:03 home.gateway:firewall:info: 270668.099 Blocked Prot=6, xx.xxx.xxx.xxx(attacker):3429 > xx.xxx.xxx.xxx(mine):1433, S Seq=-1102329596, Ack=0 -Default Defense Jan 25 15:25:03 home.gateway:firewall:info: 270668.099 Blocked Prot=6, xx.xxx.xxx.xxx(attacker):3429 > xx.xxx.xxx.xxx(mine):1433, S Seq=-1102329596, Ack=0 -Disallowed Destination IP

There are a few more updated files. What I did was that I zipped the file up on my home machine, then set the FTP to list the files according to date. I went through the whole file structure, and found quite a few files with time stamp today.

Another thing, as I mentioned in my blog, I'm looking for someone to help me write a script that dumps everything the spammer is trying to pump into my comment script or formmail. No prettifying, no formatting. Just everything sent, and a time stamp, UA and IP in addition. And there's something you can add that gives you the IP number beyond the proxy, if it's transparent enough to give you that. I'll bait and switch the spammer with some creative .htaccess'ing, and leave the real comment script up for the rest of the world. Output either to mail or a hidden page. I'm happy I don't have to clean my blog of hundreds of comments, but sad that I don't have the evidence to send to open proxy owners etc... Plus, I've been wanting to study the way they exploit formmail for years!

I've sent you a PM about that. But remember that IP blocking is messy, and doesn't really work. Even so, you're welcome to the logs, if they can help you in any way.

I'm hoping for some feedback on that. What appeals most to me at the moment would be to find out what ISP they're using (guessing orbitel.bg) and complaining to them. Also, getting journalists to write about it. But, that may take some time, because I haven't actually contacted the twins, and responsible journalists will probably at least e-mail them and ask for comments. But I guess the two main advantages to me personally (the perks), would be: 1) Hopefully more attention to my plight to close down as many open proxies as possible 2) I can put spamhunter on my resume! I'm open to new challenger jobwise...

I think I found out who the blog spamming outfit responsible for most of the spam to my blog is. A set of twins living in Bulgaria:

They search for MT installations. So just the fact that you have one, would be enough for them to try.

Do you by any chance have a blog? If you do, you're more likely to get referrer spam. One outfit is responsible for most of my referrer spam. I also get a few on my other non-blog equipped site, but those are mostly one offs. I'd say ignore it unless it becomes a bandwidth issue. Many referrer spams have subdomains. Spammy ones. That's a dead giveaway. But the one offs generally have more normal sites, and are spamming once, twice at most.

Yep, that's the stuff I've been writing about. Many of us traced that connection, and complained to Verio. Yesterday that box was still serving spammy websites. Click on smiley to go to blog:

They succeeded with open relays. It may take time, but chances are admins will eventually cotton on to this too. Just make enough noise, sooner or later it'll make it to the top, eh?

I'm very serious about this. I don't have the capacity to run down every proxy server. But I'm starting to see some patterns here as to what's happening on these servers. I'm guessing the best way would be to create enough of a ruckus the admins will have to take it seriously, like they did with open e-mail relays a few years ago. As to zombies, that's trickier. There are some zombies on my ISP's net. I notified the ISP, and they replied and told me they didn't have the capacity to run down specific users and warn them about this. So the users will keep on trying to get through my firewall - indefinitely. Unless I can find those IP numbers one Google connected to an e-mail address or user name, there's nothing I can do about it.

Notepad can't open really big files (or at least couldn't in the past). I suggest you use something to reduce the size of the log, say to one day at a time. I use a browser to look at logs, and I reduce their size by some well chosen include words in TextHarvest.

I wasn't asking for advice on how to keep the comment spammers out of my blog. I'm doing fine in that respect. I'm asking for advice on how to get as many open proxies as possible shut down. One of the admins of one such server kindly offered to share the log with me. I got a small fragment so far, and will get the full log later on. Comment spam is only one of the things happening on such a server. Fraudulent banner traffic is one other thing. I'm sure there's more.

I've been grappling with comment spamming lately. What I found is that the spammers are using open proxies to a large degree. Some might be zombie boxes, but a large percentage are webservers or other servers with proxying turned on. Most of them unintentional. Usually you can just plug the IP addresses into Google and find lots of spammy posts, blacklists and open proxy lists. When I did the same with the TCH address my site is listed on, there wasn't even ONE hit like that. So, is there any way we can get the message out more thoroughly, than me notifying webmasters/admins one at a time? Also, I've trying to get a server on Verio off their service. It's got hundreds of spammy sites on it. The owner of that server seems to be ultimately responsible for over 50 percent of the spam hitting my logs. I've sent an e-mail to their hosting abuse department, and I know others who have and are about to. The server is still online, still serving all those spammy domains. For details, check this post (click on smiley): So, you guys at TCH, any advice on making this fight against the spammers more effective?

I've been doing some tracking. I found that many of the IP number this particular spamming outfit is using, are webservers. Many of them unintended webservers. It's possible he's used open proxy lists, and it's also possible he's port scanned lots of IP numbers until he found ones that did work. About half the IP numbers don't have webservers on them. Probably windows home computers that are virus infected. Zombies. The rest are webservers. And they're both microsoft servers and Apache and even other types. One Lotus Domino, of all things. What kind of program could work on ALL of those? Or is he just using them as proxies? Most likely, I suppose. Check my blog for details, if you want to play around with this stuff. Click the smiley:

I didn't complaing to Atrivo. If the spammer has abandoned that IP number, I thought it would be more worth my time to complain to ThePlanet. Still no reply. I'm giving them the benefit of the doubt since it's the weekend. But if there's no reply by Tuesday night I'm making some waves. EDIT: Wow, you're one of the people I linked to. Amazing how you find related things on search engines or blog searches, then end up having a conversation with them here on TCH!

I feel really I AM A SPAMMER retentive today. I MAY have tracked down the trackback spammer. Click on the smiley for the explanation: EDIT: Sorry, screwed up on the link.

Mystery solved. I got a legitimate trackback from a site on Totalchoice. That's what produced that weird user agent in my log. http://www.windsofchange.net/archives/006118.php

Hmph, now my guestbook is getting hammered by some joker I've blocked.

Yay! He's giving up for now!

Of course there's a way to turn off trackbacks! Just rename the trackback file until the attack is over. Not saying if that's what I did, but here's the file to rename: mt-tb.cgi BTW, either he's stopped for now, or my webhost filtered out the error message. He's done that before, so I wouldn't be surprised...

It's Alexander, no doubt about it. I got the same pre-attack last night. He's still going full tilt at my scripts. I wonder if it's his zombies that are out of control, since they don't understand what's happening when they try trackbacking to my site? But I also got those same nonsense things a while ago, as comment spam, if I remember correctly. Oh, and WTF? I got an access to my log from server85.totalchoicehosting.com with the user agent MovableType/3.14. That site isn't even on here, my other site is. So I'm kinda curious now...

Turns out the varmin is Alexander Morozov. He's quite famous for his blogspam.

So, is there any type of clearinghouse for reporting allegedely infected drones?