Comments on: zombie pharma attack http://blog.lauralemay.com/2005/10/zombie-pharma-attack.html Sun, 22 Aug 2010 16:09:37 +0000 http://wordpress.org/?v=abc hourly 1 By: Enno http://blog.lauralemay.com/2005/10/zombie-pharma-attack.html/comment-page-1#comment-324 Enno Fri, 07 Oct 2005 15:57:36 +0000 http://wptest.lauralemay.com/2005/10/zombie-pharma-attack.html#comment-324 I don't know if you already do that, but I'm doing pretty well by using pivot blacklist - <a href="http://www.i-marco.nl/pivot-blacklist/" rel="nofollow">http://www.i-marco.nl/pivot-blacklist/</a> - after I came after a weekend onvacation to find my site under attack by the comment-spam bots and 2000+ new entries. I don’t know if you already do that, but I’m doing pretty well by using pivot blacklist -
http://www.i-marco.nl/pivot-blacklist/ – after I came after a weekend onvacation to find my site under attack by the comment-spam bots and 2000+ new entries.

]]> By: Jef http://blog.lauralemay.com/2005/10/zombie-pharma-attack.html/comment-page-1#comment-323 Jef Fri, 07 Oct 2005 15:31:12 +0000 http://wptest.lauralemay.com/2005/10/zombie-pharma-attack.html#comment-323 I have solved my referer spam problem in two different ways now. The first method involved a program to recognize referer spam based on a self-updating database, kind of like bogofilter. Another program would use that database to filter my web server logs before generating my daily report. This setup worked but was fairly heavyweight, and I was worried about false positives. The second method, which I'm using now, was to rewrite the referer section of my server log report so instead of showing the top N referers, it shows the top N referer->page pairs. The spammers like to hit a bunch of different pages instead of just one page, so all of the pairs they generate have low counts and they fall off the bottom of the list and don't get shown. This has worked 100% so far, but I suppose some day a spammer might change tactics and hit one page a thousand times. In any case, it's very fucking annoying. I have solved my referer spam problem in two different ways now.

The first method involved a program to recognize referer spam based on a self-updating database, kind of like bogofilter. Another program would use that database to filter my web server logs before generating my daily report. This setup worked but was fairly heavyweight, and I was worried about false positives.

The second method, which I’m using now, was to rewrite the referer section of my server log report so instead of showing the top N referers, it shows the top N referer->page pairs. The spammers like to hit a bunch of different pages instead of just one page, so all of the pairs they generate have low counts and they fall off the bottom of the list and don’t get shown. This has worked 100% so far, but I suppose some day a spammer might change tactics and hit one page a thousand times.

In any case, it’s very fucking annoying.

]]>