Comments on: Anatomy of a Web Spam Attack http://blog.merjis.com/2007/09/09/anatomy-of-a-web-spam-attack/ Effective Internet Marketing Strategy and Technique Through Experiments, Measurement and Audit Thu, 28 Aug 2008 05:00:52 +0000 http://wordpress.org/?v=2.0.12-alpha by: Jeremy Chatfield http://blog.merjis.com/2007/09/09/anatomy-of-a-web-spam-attack/#comment-36250 Fri, 08 Feb 2008 04:06:44 +0000 http://blog.merjis.com/2007/09/09/anatomy-of-a-web-spam-attack/#comment-36250 Hi Paul, Given the wide availability of open proxies, anonymising proxies and botnets, trying to block spam by IP address is pretty pointless. It doesn't take much effort for pests to bypass IP address restrictions. You end up hurting real users, who neither know nor want to know the arcane processes to connect - so you penalise real users when you restrict IP addresses, while causing minimal inconvenience to the pests. Hi Paul,

Given the wide availability of open proxies, anonymising proxies and botnets, trying to block spam by IP address is pretty pointless. It doesn’t take much effort for pests to bypass IP address restrictions. You end up hurting real users, who neither know nor want to know the arcane processes to connect - so you penalise real users when you restrict IP addresses, while causing minimal inconvenience to the pests.

]]> by: Paul Swearingen http://blog.merjis.com/2007/09/09/anatomy-of-a-web-spam-attack/#comment-36208 Thu, 07 Feb 2008 21:30:25 +0000 http://blog.merjis.com/2007/09/09/anatomy-of-a-web-spam-attack/#comment-36208 I did not set up e-DXN although I administer it, and of course I have to deal with spammers, many of them Ukranian and Polish (I found your site via a Google search for "ukraine spam IP address"). e-DXN is a phpBB site, a subscription-only site to radio hobbyists. Those who register must not only provide a real name (so that I can cross-check payments via PayPal or personal check) but a real e-mail address as well as the contents of a graphic posted on the registration page. (We cater to blind hobbyists, so several times a year I find myself registering blind subscribers who cannot see the graphic.) If I am lucky enough to catch a spammer online, hacking into the members-only forums, I can easily ban his IP address and even range. But recently when I tried to block 91.*.*.* after I noted one or more Ukranian spammers trolling our site, I also blocked two of our legitimate members who live in Finland. One was able to provide his ISP's dynamic range, the other one not, so I'm now trying to figure out how much of a range I can block to keep the Ukranian spamscum off (one of them seems to be promoting child porn) the site. Therefore, I'm trolling the web to see if I can find known Ukranian spammers' IP addresses, plus others, but inasmuch as we have members from Europe and other parts of the world, I may just have to nuke each spam registrant as they pop up, currently at the rate of 2-4 per day. (We don't have any kind of IP tracker installed now, as the National Radio Club is a non-profit organization.) Your comments were helpful and informative to a neophyte. Thanks -pls. I did not set up e-DXN although I administer it, and of course I have to deal with spammers, many of them Ukranian and Polish (I found your site via a Google search for “ukraine spam IP address”).

e-DXN is a phpBB site, a subscription-only site to radio hobbyists. Those who register must not only provide a real name (so that I can cross-check payments via PayPal or personal check) but a real e-mail address as well as the contents of a graphic posted on the registration page. (We cater to blind hobbyists, so several times a year I find myself registering blind subscribers who cannot see the graphic.)

If I am lucky enough to catch a spammer online, hacking into the members-only forums, I can easily ban his IP address and even range. But recently when I tried to block 91.*.*.* after I noted one or more Ukranian spammers trolling our site, I also blocked two of our legitimate members who live in Finland. One was able to provide his ISP’s dynamic range, the other one not, so I’m now trying to figure out how much of a range I can block to keep the Ukranian spamscum off (one of them seems to be promoting child porn) the site. Therefore, I’m trolling the web to see if I can find known Ukranian spammers’ IP addresses, plus others, but inasmuch as we have members from Europe and other parts of the world, I may just have to nuke each spam registrant as they pop up, currently at the rate of 2-4 per day. (We don’t have any kind of IP tracker installed now, as the National Radio Club is a non-profit organization.)

Your comments were helpful and informative to a neophyte. Thanks -pls.

]]> by: Julian Evans http://blog.merjis.com/2007/09/09/anatomy-of-a-web-spam-attack/#comment-20923 Mon, 29 Oct 2007 09:54:31 +0000 http://blog.merjis.com/2007/09/09/anatomy-of-a-web-spam-attack/#comment-20923 Thanks for your reply. The blog is being used as an awareness driver for consumers... amazed by the interest in it actually ;).. last month we improved the look and feel as well as adding some very useful content. Why not take a look? p.s. the social networking issue is a real biggie here in the UK- esp with Facebook. Cheers, Julian Thanks for your reply. The blog is being used as an awareness driver for consumers… amazed by the interest in it actually ;).. last month we improved the look and feel as well as adding some very useful content. Why not take a look?

p.s. the social networking issue is a real biggie here in the UK- esp with Facebook.

Cheers, Julian

]]> by: Jeremy Chatfield http://blog.merjis.com/2007/09/09/anatomy-of-a-web-spam-attack/#comment-16716 Mon, 10 Sep 2007 14:11:00 +0000 http://blog.merjis.com/2007/09/09/anatomy-of-a-web-spam-attack/#comment-16716 Hi Julian, This was an analysis of web server log files from one of our servers, running a site we control, using our software. As for the rest - over the years I've worked with a bunch of fine people, who have educated me. The errors of interpretation are mine :) Your blog was pretty interesting. The overlap with social network sites was intriguing. Cheers, JeremyC. Hi Julian,

This was an analysis of web server log files from one of our servers, running a site we control, using our software. As for the rest - over the years I’ve worked with a bunch of fine people, who have educated me. The errors of interpretation are mine :)

Your blog was pretty interesting. The overlap with social network sites was intriguing.

Cheers, JeremyC.

]]> by: Julian Evans http://blog.merjis.com/2007/09/09/anatomy-of-a-web-spam-attack/#comment-16711 Mon, 10 Sep 2007 11:09:30 +0000 http://blog.merjis.com/2007/09/09/anatomy-of-a-web-spam-attack/#comment-16711 Very interesting article. We are leading the way here in the UK with driving education and awareness to consumers and SME's. Where did you get your source information from? May well be of interest to our visitors. Julian Very interesting article. We are leading the way here in the UK with driving education and awareness to consumers and SME’s.

Where did you get your source information from? May well be of interest to our visitors. Julian

]]>