Tag Info

Hot answers tagged

38

How do they find the 'new user registration' page? (I'm especially surprised because some forums don't have a dedicated URL for this eg, www.forum.com/register.html , but instead use query strings or even other methods invisible to the URL bar) They find new sites by: Crawling and looking for signatures of known software. Usually this is ...


12

Funny this should come up, I was dealing with a similar problem at work today! @HeatherWalters has covered most of the good stuff, but there are a couple of things to add. You can block referers by domain using the following htaccess code:- RewriteEngine on # Options +FollowSymlinks RewriteCond %{HTTP_REFERER} spammer-one\.com [NC,OR] RewriteCond ...


10

How do forum spambots work? Talented (if evil) programmers write them - there are probably as many different types of spambots as there are people writing them but, unfortunately, it only takes a few spambot authors sharing and selling their work to ruin life for administrators... One popular forum spamming application is called "xrumer" - here's a ...


10

They search for and fill in every form they can find. They're looking for any vulnerability that they can exploit for their gain. It might be to see if they can gain access to your site or web server. It can be to compromise your form to send out spam. It's worth their time to do because it's all automated. They just set their bots free and let them go ...


8

How about a little corbomite maneuver? RewriteEngine on RewriteCond %{HTTP_REFERER} ^http(s)?://(www\.)?turkyoutube.org.*$ [NC] RewriteRule ^(.*)$ http://127.0.0.1/$1 [R=401,L] Note, untested but should redirect requests from them back to themselves with a 401 Not Authorized status code. That is, if the bot even handles redirects (very unlikely), but it ...


8

Basic Security Steps Since Wordpress is so popular there are a lot of drive by hacks knocking around taking advantage of flaws in basic security. All Wordpress users should take the following basic and easy steps to protect themselves:- Do not use wp_ as the database table prefix, use any string of random characters that appeals. Turn off Wordpress DB ...


7

You need to completely remove every file from your website and do a fresh install of Wordpress. The odds are they uploaded files that allow them continuous access to your site. Unless you want to go file by file trying to figure out which one(s) they are a complete install from scratch is the best thing you can do.


6

Look into having a honey pot in your form, this will only work though if it's a generic robot, as the moment a custom script is written the honeypot can easily be bypassed. Also, if you're not keen on a CAPTCHA you could try Solve Media's alternative and earn a bit on the side at the same time, I think it was Ticketmaster who recently started using them as ...


6

I'm the author of the free open source Ostermiller Contact Form which is designed to thwart spammers. I have found that the biggest reason that spammers fill in your contact form is link spam. To many spam bots, you contact form looks little different than a guest book form or a form to comment on a blog. My contact form software has rules that ...


5

you might be better off using your firewall instead of relying on a php script, since after all the php script will only affect php page loads and not static files like images. Plus, having php log all connections and check for >800 from the same ip for every request is going to add some serious overhead to your server, maybe even more so than the requests ...


5

Although I totally agree with danlefree and his previous answer, there are some ways to make it more difficult for bots, at least for "not-so-clever" bots. 1 - Other than IP and User-Agent strings, you could try to set a cookie and display ads only if cookie is set. Also, if the bot uses cookies, try to see if it's clever enough to clear them when it ...


5

Have you considered the possibility that they are visiting your site, hoping you will research who they are, by following the link (so that you end up visiting their spammy sites.........the blackest of blackhat SEO)? Have you accessed this information on website hits purely through GA or have you looked at your website's traffic logs? Maybe they aren't ...


5

No, hosting on Amazon EC2 is not adequate protection from DDoS. According to one of the AWS engineers, "Once you have exposed your instance on a particular port (or set of ports and protocols) using EC2 authorize, there is no explicit DDOS protection offered by EC2." https://forums.aws.amazon.com/thread.jspa?messageID=208949 There is a well documented ...


4

But what's the point of this type of activity? Your guess is as good as anyone's - perhaps the operator is mistakenly trying to access a set of spam accounts created elsewhere? (or ones which were supposed to be created at your site but failed for whatever reason) Edit: ... speaking to your initial question: How should a site respond to automated ...


4

A best practice shows the following user friendly solution: Add a hidden field in your form. Bots will automatically complete all forms, whilst humans will not since they cannot see the hidden field. When all fields are submitted you know that its a bot and you simply won't allow submitting a message. Works great and there is no extra hassle for your website ...


4

How do I capture the POST part of incoming HTTP requests for analysis? Try using ModSecurity - from its documentation on HTTP Traffic Logging: Web servers are typically well-equipped to log traffic in a form useful for marketing analyses, but fall short logging traffic to web applications. In particular, most are not capable of logging the ...


3

Since Mahesh didn't come back to write this up as an answer I figured I would. It is going to be hard to work out why spammers do what they do - it could have been a bug in their system so they spammed the wrong URL out, or they could be trying to damage your name on Twitter, or a host of other things. My advice would be to not lose too much sleep over it. ...


3

Disclosure: A family member works for Adversor. There is no such thing as 100% DDoS protection at the minute (unless someone has more computing power than the rest of the world combined). Some offer a range of Reverse Proxies, some use adaptive black/white listing (sometimes teaming up with other services for more accurate lists - distributed DDoS ...


3

It is quite difficult to tell without adding further checks I would normally add a question that a computer can't answer. Ie "If today is Thursday, what is tomorrow?" "What month comes before October?" etc. I use this technique on our forum as well as a Captcha and it has reduced the amount of spam quite considerably. Just having a Captcha wasn't ...


2

Aside from the IP blocking, I would scrutinize the files that are being requested. It's a fairly common thing for open-source systems such as WordPress and Joomla to be exploited, which is one reason why they're frequently updated. If you've neglected a few updates, it's possible that someone has penetrated your site. I've had that scenario happen to me ...


2

I made Anti-spam plugin for WordPress, it blocks spam pretty good without Captcha or anything else. How does it work: Two extra fields are added to comments form. First is the question about the current year. Second should be empty. If the user visits site, than first field is answered automatically with javascript, second field left blank and both fields ...


2

I've recommended similar tactics before.


2

I've been trying to track this one down as well. Whatever they're doing, they seem to rotate domains every couple of weeks to a month. This can easily be seen in our analytics by filtering by traffic from Bangladesh (which we get very little legitimate traffic from.) In our case, the traffic isn't affecting sales but is a couple of orders of magnitude ...


2

How can I block a bot like this? There is no foolproof way for you to block illegitimate clicks on ads served with your content - if a human can click the ads, so can a bot. Detection and mitigation is Google's responsibility, so (beyond completing your due diligence by reporting activity which may reflect poorly upon the status of your AdSense account) ...


2

What you suggest (use a bot trap to trap the bad bod, and then block it using .htaccess or your favourite scripting language) is indeed a much-used technique for dealing with robots from the dark side. You may want to look at another thread here about this particular technique: Tactics for dealing with misbehaving robots If you're looking for sample code ...


2

Modern inbound marketing does not just rely on getting indexed by Google's spiders, or even just Google and Bing/Yahoo. As SEO and SMM become more and more intertwined, more and more social media and social sharing services come into play. As such, you'll see crawlers that aren't just search spiders. When you post a link on Twitter and it gets shortened by ...


2

Since the user agent is blank, you could use that to trigger a block: RewriteEngine On SetEnvIfNoCase User-Agent "^-?$" bad_user Deny from env=bad_user I put in -? in case the user agent being sent is actually a dash. It is very hard to tell from your logs whether it is actually blank, or if it is a dash. The linked resource on StackOverflow has ...


2

To avoid bots, you can try any of the following, but CAPTCHA is the best way to avoid scripted attacks. You could use CSRF tokens to avoid this Insert or remove some value via JavaScript from the form element and verify the same on the server end. Check for the HTTP referer on sign up


1

If the bots aren't changing IP's often why let them hit your server and take up usage? I would ban the IPs's first in hosts.deny / ipchains then use .htaccess and robots.txt as back up


1

Are there any good tools that automatically monitor this background activity (specifically activity that throws errors on the web & db server) and proactively deal with these source(s) of mayhem? "CloudFlare leverages the knowledge of a diverse community of websites to power a new type of security service. Online threats range from nuisances like ...



Only top voted, non community-wiki answers of a minimum length are eligible