Yahoo Spam

9 Responses

• 

  Andy Skelton | April 4th, 2005 @ 3:30 pm

  I got something like that today, too. All of them hit in the same minute from different IPs around the world. Looks like maybe somebody’s testing out a new spamming script.

  Current score: 0 +1
• 

  Arve | April 4th, 2005 @ 4:22 pm

  I’ve seen this happen on occasion — it’s either, like Andy says, someone testing out a new spamscript, or more sinister: Someone is trying to poison the well by having people add legitimate domains to their blacklist, in the hopes that people will eventually have to turn off their (more often than not, MT) spam filters because they otherwise will block legitimate comments or trackbacks.

  Perhaps having a distributed automatic whitelist will work.

  Current score: 0 +1
• 

  kilikina | April 4th, 2005 @ 4:57 pm

  ditto.. trackbacks & comments with links from proxy’s

  Current score: 0 +1
• 

  Carthik | April 4th, 2005 @ 8:44 pm

  Someone trying to get whitelisted at the blogs, perhaps.

  Current score: 0 +1
• 

  Roy Schestowitz | April 5th, 2005 @ 12:08 am

  Is anybody else affected by the “Backgammon” c**p? It’s like 100 of these a day… pushes the limits on Comment Mass Edit Mode…

  Current score: 0 +1
• 

  Dougal Campbell | April 5th, 2005 @ 5:49 am

  I got hit by about 160 of the Yahoo comments. And they didn’t come through blacklisted proxies. Any of the theories mentioned could be true: flubbed experiment, attempt to poison the well, etc.

  I’ve also seen quite a few of those huge backgammon spams, too. Of course they go straight to moderation due to all the links. Well, actually now they go straight to the spam blackhole, because I’ve blacklisted all of the domains that I’ve seen in them. But those are annoying, too.

  I’ve taken to blocking the most prolific spam IPs at the firewall level, before WordPress (or Apache for that matter) even sees them. The most effective block for me has been on 148.244.150.0/24, which is *still* attempting 5000-10000 hits per day, despite the fact that they can’t even touch this host now (but it shows up in the firewall IP accounting logs, which is why I know they’re still trying).

  I hate locking out a whole block like that, but my server has been much happier with the reduced load.

  Current score: 0 +1
• 

  CardiacKid | April 5th, 2005 @ 9:07 am

  Matt,

  Maybe its a sign form the Weblog Gods saying stay away from Google and become number 1 in yahoo…lol.

  Current score: 0 +1
• 

  Robert Accettura | April 5th, 2005 @ 1:30 pm

  testing test

  1.2… spam systems go!

  /me braces for the next wave.

  Current score: 0 +1
• 

  bernard | April 6th, 2005 @ 2:17 pm

  Hi Matt,

  I got a bunch of those also, but mine seemed to be manual, although while I am writing this comment a friend has just IM’ed me, saying he also got 5 this morning.

  Anyway, you can have a look at a little bit of analysis I did on these spams just now. You can see it here: http://www.runningwithbulls.com/blog/?p=50

  It would appear that they are automated, as the orig. IP seems to be different for a number of them.

  hope that helps someone,
  cheers
  bBt

  Current score: 0 +1