Kategorie: Spam

Veröffentlicht am

Spam-Attacke geht weiter

virusJetzt hab ich die Faxen aber dicke. Ich habe die untere Blacklist in meine .htaccess eingefügt. Damit ist die Tür erst einmal für einen sehr großen Teil der Spammer zu. Fast 6.000 Spams in den letzten Tagen. Es langt. 👿

Wer ➡ Spam Karma benutzt und Zugriff auf einen phpMyAdmin hat, der kann mit folgendem Query seine eigene persönliche Blackliste erstellen. Man sollte aber den Spam nicht entfernen sondern fleissig sammeln damit die Liste möglichst genau wird.

SELECT SUBSTRING_INDEX( comment_author_IP, '.', 2 ) IP, count( * ) Zaehler
FROM `wp_comments`
WHERE `comment_approved` = 'spam'
GROUP BY 1
ORDER BY `Zaehler` DESC

Hier “meine” Blacklist:

deny from 12.154
deny from 12.155
deny from 12.180
deny from 12.193
deny from 12.223
deny from 125.183
deny from 125.240
deny from 125.241
deny from 125.243
deny from 125.244
deny from 125.245
deny from 125.246
deny from 125.247
deny from 128.227
deny from 129.120
deny from 129.33
deny from 132.248
deny from 134.76
deny from 140.110
deny from 140.113
deny from 140.114
deny from 140.127
deny from 141.21
deny from 142.22
deny from 145.253
deny from 147.26
deny from 148.235
deny from 148.244
deny from 149.99
deny from 150.187
deny from 151.8
deny from 153.19
deny from 157.158
deny from 157.181
deny from 159.61
deny from 163.15
deny from 163.178
deny from 163.27
deny from 164.58
deny from 164.77
deny from 165.154
deny from 165.228
deny from 165.229
deny from 168.115
deny from 168.176
deny from 168.243
deny from 192.114
deny from 192.148
deny from 192.252
deny from 192.6                
deny from 193.136
deny from 193.151
deny from 193.170
deny from 193.188
deny from 193.194
deny from 193.219
deny from 193.220
deny from 193.224
deny from 193.227
deny from 193.253
deny from 193.69
deny from 194.126
deny from 194.146
deny from 194.206
deny from 194.44
deny from 195.13
deny from 195.134
deny from 195.156
deny from 195.162
deny from 195.175
deny from 195.177
deny from 195.187
deny from 195.191
deny from 195.219
deny from 195.221
deny from 195.226
deny from 195.39
deny from 195.55
deny from 195.64
deny from 195.77
deny from 196.192
deny from 196.2
deny from 196.200
deny from 196.202
deny from 196.211
deny from 196.32
deny from 196.36
deny from 196.40
deny from 196.45
deny from 199.104
deny from 199.3
deny from 200.105
deny from 200.106
deny from 200.118
deny from 200.122
deny from 200.124
deny from 200.130
deny from 200.143
deny from 200.149
deny from 200.150
deny from 200.161
deny from 200.164
deny from 200.166
deny from 200.171
deny from 200.174
deny from 200.177
deny from 200.188
deny from 200.195
deny from 200.196
deny from 200.201
deny from 200.205
deny from 200.207
deny from 200.21
deny from 200.210
deny from 200.211
deny from 200.216
deny from 200.225
deny from 200.233
deny from 200.237
deny from 200.250
deny from 200.252
deny from 200.31
deny from 200.32
deny from 200.35
deny from 200.36
deny from 200.41
deny from 200.47
deny from 200.5
deny from 200.55
deny from 200.65
deny from 200.67
deny from 200.69                   
deny from 200.7
deny from 200.71
deny from 200.75
deny from 200.76
deny from 200.79
deny from 200.80
deny from 200.81
deny from 200.85
deny from 200.88
deny from 200.89
deny from 200.93
deny from 200.94
deny from 200.96
deny from 201.0
deny from 201.1
deny from 201.11
deny from 201.12
deny from 201.134
deny from 201.17
deny from 201.209
deny from 201.21
deny from 201.217
deny from 201.24
deny from 201.247
deny from 201.248
deny from 201.28
deny from 201.44
deny from 201.49
deny from 201.55
deny from 201.57
deny from 201.6
deny from 201.7
deny from 202.101
deny from 202.129
deny from 202.132
deny from 202.141
deny from 202.143
deny from 202.147
deny from 202.154
deny from 202.155
deny from 202.159
deny from 202.163
deny from 202.164
deny from 202.175
deny from 202.176
deny from 202.188
deny from 202.28                   
deny from 202.31
deny from 202.54
deny from 202.57
deny from 202.58
deny from 202.62
deny from 202.63
deny from 202.65
deny from 202.69
deny from 202.70
deny from 202.71
deny from 202.77
deny from 202.82
deny from 202.88
deny from 202.96
deny from 203.115
deny from 203.131
deny from 203.133
deny from 203.135
deny from 203.144
deny from 203.160
deny from 203.162
deny from 203.167
deny from 203.169
deny from 203.172
deny from 203.177
deny from 203.199
deny from 203.236
deny from 203.247
deny from 203.26
deny from 203.67
deny from 203.68
deny from 203.76
deny from 203.81
deny from 203.94
deny from 205.160
deny from 205.188
deny from 207.104
deny from 207.157
deny from 207.218
deny from 207.248
deny from 207.69
deny from 208.27
deny from 208.34
deny from 208.50
deny from 209.112
deny from 209.128
deny from 209.206
deny from 209.226
deny from 209.236
deny from 209.241
deny from 209.68
deny from 210.0
deny from 210.124
deny from 210.16
deny from 210.177
deny from 210.187
deny from 210.196
deny from 210.20
deny from 210.211
deny from 210.212
deny from 210.213
deny from 210.238
deny from 210.93
deny from 211.100
deny from 211.136
deny from 211.137
deny from 211.138
deny from 211.141
deny from 211.144
deny from 211.162
deny from 211.18
deny from 211.187
deny from 211.208
deny from 211.230
deny from 211.239
deny from 211.30
deny from 211.48
deny from 211.60
deny from 211.76
deny from 211.97
deny from 211.99
deny from 212.0
deny from 212.118
deny from 212.122
deny from 212.138
deny from 212.141
deny from 212.142
deny from 212.165
deny from 212.190
deny from 212.199
deny from 212.227
deny from 212.244
deny from 212.52
deny from 212.92
deny from 213.114
deny from 213.134
deny from 213.140
deny from 213.144
deny from 213.149
deny from 213.157
deny from 213.176
deny from 213.186
deny from 213.237
deny from 213.249
deny from 213.33
deny from 213.42
deny from 213.56
deny from 213.60
deny from 213.63
deny from 213.84
deny from 216.11
deny from 216.136
deny from 216.239
deny from 216.255
deny from 216.73
deny from 217.119
deny from 217.153
deny from 217.160
deny from 217.162
deny from 217.17
deny from 217.197
deny from 217.199
deny from 217.219
deny from 217.56
deny from 217.57
deny from 217.73
deny from 217.77
deny from 217.8
deny from 217.91
deny from 218.104
deny from 218.11
deny from 218.146
deny from 218.147
deny from 218.152
deny from 218.188
deny from 218.189
deny from 218.210
deny from 218.219
deny from 218.235
deny from 218.248
deny from 218.47
deny from 218.56
deny from 218.75
deny from 218.9
deny from 218.94
deny from 219.129
deny from 219.133
deny from 219.144
deny from 219.165
deny from 219.21
deny from 219.223
deny from 219.232
deny from 219.87
deny from 219.93
deny from 219.94
deny from 220.110
deny from 220.123
deny from 220.125
deny from 220.130
deny from 220.132
deny from 220.171
deny from 220.194
deny from 220.228
deny from 220.229
deny from 220.233
deny from 220.71
deny from 220.72
deny from 220.81
deny from 220.88
deny from 221.10
deny from 221.114
deny from 221.138
deny from 221.142
deny from 221.162
deny from 221.212
deny from 221.231
deny from 221.241
deny from 221.250
deny from 222.124
deny from 222.132
deny from 222.151
deny from 222.228
deny from 222.235
deny from 222.99
deny from 24.190
deny from 24.23
deny from 24.39
deny from 24.61
deny from 24.97
deny from 43.253
deny from 58.13
deny from 58.147
deny from 58.186
deny from 58.67
deny from 59.120
deny from 59.13
deny from 59.14
deny from 59.19
deny from 59.20
deny from 59.5
deny from 59.87
deny from 60.190
deny from 60.248
deny from 60.254
deny from 60.48
deny from 61.108
deny from 61.117
deny from 61.129
deny from 61.150
deny from 61.152
deny from 61.153
deny from 61.155
deny from 61.18
deny from 61.189
deny from 61.19
deny from 61.206
deny from 61.219
deny from 61.220
deny from 61.221
deny from 61.235
deny from 61.238
deny from 61.3
deny from 61.37
deny from 61.39
deny from 61.5
deny from 61.6
deny from 61.67
deny from 61.70
deny from 61.90
deny from 62.0
deny from 62.111
deny from 62.116
deny from 62.121
deny from 62.128
deny from 62.141
deny from 62.149
deny from 62.162
deny from 62.193
deny from 62.2
deny from 62.216
deny from 62.24
deny from 62.244
deny from 62.245
deny from 62.253
deny from 62.50
deny from 62.56
deny from 62.75
deny from 62.84
deny from 63.208
deny from 63.219
deny from 63.223
deny from 63.226
deny from 63.236
deny from 63.243
deny from 63.249
deny from 63.81
deny from 64.12
deny from 64.187
deny from 64.42
deny from 64.49
deny from 64.71
deny from 64.89
deny from 65.115
deny from 65.160
deny from 65.200
deny from 65.202
deny from 65.208
deny from 65.223
deny from 65.65
deny from 65.66
deny from 65.82
deny from 65.98
deny from 65.99
deny from 66.160
deny from 66.186
deny from 66.192
deny from 66.235
deny from 66.254
deny from 66.77
deny from 66.83
deny from 66.98
deny from 67.134
deny from 67.161
deny from 67.52
deny from 67.79
deny from 68.109
deny from 68.142
deny from 68.188
deny from 68.216
deny from 68.231
deny from 68.82
deny from 69.10
deny from 69.119
deny from 69.19
deny from 69.195
deny from 69.197
deny from 69.20
deny from 69.250
deny from 69.31
deny from 69.45
deny from 69.46
deny from 69.61
deny from 69.65
deny from 69.70
deny from 70.108
deny from 70.112
deny from 70.136
deny from 70.159
deny from 70.178
deny from 70.26
deny from 70.56
deny from 70.60
deny from 70.72
deny from 70.88
deny from 71.230
deny from 71.40
deny from 72.2
deny from 80.108
deny from 80.188
deny from 80.231
deny from 80.249
deny from 80.25
deny from 80.255
deny from 80.50
deny from 80.51
deny from 80.53
deny from 80.55
deny from 80.58
deny from 80.71
deny from 80.76
deny from 80.78
deny from 80.81
deny from 80.90
deny from 80.97
deny from 81.12
deny from 81.168
deny from 81.189
deny from 81.195
deny from 81.199
deny from 81.202
deny from 81.208
deny from 81.210
deny from 81.228
deny from 81.248
deny from 81.52
deny from 81.7
deny from 81.73
deny from 82.106
deny from 82.109
deny from 82.114
deny from 82.127
deny from 82.136
deny from 82.138
deny from 82.139
deny from 82.146
deny from 82.160
deny from 82.189
deny from 82.198
deny from 82.206
deny from 82.207
deny from 82.231
deny from 82.234
deny from 82.236
deny from 82.70
deny from 82.92
deny from 83.137
deny from 83.138
deny from 83.15
deny from 83.16
deny from 83.17
deny from 83.18
deny from 83.19
deny from 83.206
deny from 83.237
deny from 83.238
deny from 84.122
deny from 84.244
deny from 84.40
deny from 84.96
deny from 85.117
deny from 85.135
deny from 85.18
deny from 85.186
deny from 85.193
deny from 85.204
deny from 85.25
deny from 85.255
deny from 85.33
deny from 85.39
deny from 85.96
deny from 86.120
deny from 86.143
deny from 86.51
deny from 87.234
deny from 88.33                                         
deny from 88.80
Veröffentlicht am

Spam-Attacke

virus Mein Weblog wird gerade immer noch bombardiert mit Spam. 1.200 Ungefähr 3.000 Spams hat Spam Karma 2 schon abgewehrt — innerhalb weniger Stunden. Momentan kommt der Müll sekündlich rein. Ich werde wohl mal meine Blackliste aufbohren müssen.

33 x  	84.96.70.155		Frankreich
32 x 	209.128.101.244		United States
30 x 	125.244.22.130		Korea
28 x 	66.186.173.166		United States
26 x 	208.50.69.80		United States
25 x 	210.212.254.2		India
24 x 	200.79.192.11		Mexico 
20 x 	125.246.109.67		Korea
19 x 	125.243.207.130		Korea
19 x 	200.188.219.164		Brazil
18 x 	193.188.77.2		Jordan
18 x 	217.199.172.146		United Kingdom
18 x 	82.234.138.4		France
18 x 	151.8.207.5		EU
17 x 	217.17.197.195		Germany
16 x 	70.88.104.170		United States
16 x 	210.93.13.77		Korea
16 x 	213.186.49.115		France
16 x 	61.219.84.212		Taiwan
16 x 	201.209.249.45		Venezuela
15 x 	203.169.251.29		United States
15 x 	69.45.68.245		United States
15 x 	222.228.173.153		Japan
15 x 	202.57.138.131		Thailand
15 x 	213.237.161.9		Denmark
14 x 	203.133.33.170		Taiwan
14 x 	195.39.134.26		Kuwait
14 x 	66.160.176.201		United States
14 x 	83.16.148.52		Poland
14 x 	194.146.131.179		Poland
13 x 	82.138.62.154		Russian Federation
13 x 	63.236.234.28		United States
13 x 	195.219.214.3		EU
13 x 	63.219.4.74		United States
13 x 	202.82.19.173		Hong Kong
13 x 	216.11.0.16		United States
13 x 	210.124.165.54		Korea
.
.
.

Das ist die Topliste der spammenden IP-Adressen, die gerade aus allen Rohren ballern. Tststs. Sieht mir sehr nach einem Botnetzwerk aus. Unten am Seitenrand kann man es quasi “live” mitverfolgen.

NACHTRAG 29.5.

Die Attacke geht weiter. Ich habe mal die Herkunft analysiert (siehe oben).

Veröffentlicht am

Aktuelle Blacklist

Hier mal meine aktuelle Blackliste von IP-Adressen, die ich in meiner .htaccess eingetragen habe. Warum? Um die lästigen Spammer fernzuhalten.

deny from 128.227
deny from 129.33
deny from 145.253
deny from 147.26
deny from 148.244
deny from 192.6
deny from 196.192
deny from 200.106
deny from 200.196
deny from 202.101
deny from 202.188
deny from 202.28
deny from 203.144
deny from 207.248
deny from 207.69
deny from 208.27
deny from 212.0
deny from 212.142
deny from 213.33
deny from 203.162
deny from 216.239
deny from 218.189
deny from 219.93
deny from 24.97
deny from 60.248
deny from 60.248
deny from 62.0
deny from 62.141
deny from 62.193
deny from 62.216
deny from 62.245
deny from 62.56
deny from 68.82
deny from 69.10
deny from 80.58
deny from 80.90
deny from 82.109
deny from 85.255
order allow,deny
allow from all

Was passiert da genau? Ganz einfach, die pösen Spammer lasse ich damit nicht auf meinen Server. Die sehen stattdessen eine Standardseite meines Providers.

Veröffentlicht am

Spam Karma 2.2

SpamIch muss doch heute mal den Schöpfer von Spam Karma 2 loben. Dieses Plugin für WordPress ist wie eine Firewall für ein Weblog — wenn ich das mal so ausdrücken darf. Bis jetzt hat dieses Plugin 8.514 Spams verschluckt. Und nach oben ist kein Ende offen.

Einfach faszinierend, wie genau und präzise Spam (normaler Kommentar-Spam, Trackback-Spam) erkannt wird. Spam Karma ist das Pflichtplugin für jede frische WordPress-Installation.

Die kürzlich erschienene neue Version 2.2 ist übrigens gegen die “neue Art von Spam” gewappnet, welcher in naher Zukunft auf uns einprasseln soll.

Es gibt mittlerweile auch eine umfangreiche Sprachdatei-Sammlung, darunter auch deutsch.

Veröffentlicht am

Wer’s glaubt

Für blöd wird man heutzutage überhaupt gehalten?

Guten Tag,
Sie wurden in den Gewinn Newsletter von http://www.w******ce.de eingetragen. Sie müssen nur noch Ihre E-Mail Adresse bestätigen. Klicken Sie einfach unten auf den Link:
http://newsletter.w*****-media.de/nletter.php?d=adddo
&email=c******tcher@gmail.com

Wie versprochen hier Ihr 15 € Gutschein für G***ino.de. Code: power15

Sollten Sie sich nicht eingetragen haben Ignorieren sie bitte diese Mail. Es kommt leider öfters vor das Leute Adressen aus Spass eintragen.

Mit freundlichen Grüssen dein w*****-media.de Team

Bla bla… Wenn da schon extra erwähnt wir, dass “Leute aus Spass” jemanden eintragen… ihr wart das doch selbst. Tststs…

Und logischerweise haben alle genannten Domains in der Mail das gleiche Impressum.

Veröffentlicht am

Blogspammer aus Deutschland

Wir alle hassen Spam in unseren Weblogs. Wer bisher dachte, dass dieser Müll aus fernen Ländern eingeliefert wird, der irrt.

Bin mal gespannt, wie sich diese Geschichte hier entwickelt. Besonders interessant wird es dann sicherlich hier.

Veröffentlicht am

Temporäre Email-Adressen

Wenn man mal wieder auf die Schnelle eine Email-Adresse benötigt, weil man sich irgendwo registrieren möchte, das Angebot aber irgendwie keinen seriösen Eindruck erweckt:

➡ www.jetable.org
➡ 2prong.com
➡ Mailinator
➡ MyTrashMail
➡ MailExpire
➡ TemporaryInbox
➡ MailEater
➡ SpamBox
➡ GuerillaMail
➡ SpamHole
➡ 10MinuteMail
➡ DontReg
➡ TempoMail
➡ TempEmail
➡ PookMail
➡ SpamFree24
➡ KasMail
➡ SpamMotel
➡ GreenSloth
➡ AnonInbox
➡ Spam.la

Man kann mit diesen Diensten temporäre Email-Adressen erstellen, die eine einstellbare Gültigkeit haben.

Es gibt sogar eine Firefox-Extension.

Veröffentlicht am

Referrer-Spam

Neben Kommentar-Spam werde ich nun auch ständig mit Referrer-Spam beglückt. Da ich die Faxen damit langsam richtig dicke habe aber die “incoming-Links” nicht deaktivieren will, gibt es jetzt die Holzhammer-Methode.

Per .htaccess werden die lästigen Zeitgenossen ausgesperrt. Ich schaue dann regelmässig nach ob die Spammer neue Keywords bespammen und füge diese einfach unten hinzu. Und für später habe ich dann noch einen anderen Trumpf: dann blocke ich einfach komplette Länder per IP-Block.

# Block them if certain keywords are in the referring URL
# Achtung: Keinen Zeilenumbruch bei SetEnvIfNoCase:

SetEnvIfNoCase Referer ".*(adult|dalin|amateurmatch|ballaire|bestsite|betting|blackjack|black|jack|craps|bukakke|credit|.cn|puff|casino|cz-|czcn|czpcsj|drugs|dyndns|epraha|equity|eroti|ficken|finance|freecq|gambling|gay|glwb|golove|jewel|jewelry|holdem|hold-em|livecam|loan|machnacht|money|payday|pharmacy|phentermine|pills|plasticmachinery|poker|porn|roulette|roundandbrown|sex|sina|slot|stripper|surprise|texas|titti|vegas|prakash|viagra|welivetogether|wins).*" BadReferrer

# Exclude my domain form the above
SetEnvIfNoCase Referer ".*(kempf).*" !BadReferrer
order deny,allow
deny from env=BadReferrer

# Block them if they come from this IP-range
order allow,deny
deny from 128.227
deny from 129.33
deny from 148.244
deny from 192.6
deny from 200.196
deny from 202.188
deny from 207.248
deny from 208.27
deny from 218.189
deny from 218.189
deny from 24.97
deny from 62.0
deny from 82.109
allow from all

Seitdem ich das eingeführt habe ist so ziemlich “Schicht im Schacht”. 😉

Veröffentlicht am

Spam-Dauerbeschuss

Mann-o-Mann. Momentan steht mein Weblog unter Kommentar-Spam-Dauerbeschuss. 100 Stück in der letzten Stunde. Die spinnen doch. Wie gut, dass Spam-Karma funktioniert. 😉

* Total Spam Caught: 6820 (average karma: -4875.42)
* Total Comments Approved: 288 (average karma: 7.28)
* Total Comments Moderated: 262
* Current Version: 2.0 final