Hot answers tagged

35

Okay. Without knowing the sites in question, I will try and explain a bit of what is going on and I will provide just a few links. From: http://www.cradlecloud.com/ban-block-blackhatworth-com-spam-referrals/ I get the following domain names associated with the new method of referrer spam that people are seeing of late. BlackHatWorth.com Iskalko.ru Lomb.co ...


10

They use a vulnerability in Google Analytics to make fake visits so the only way to stop them for now, and until Google fix it, is to make a filter in GA since that is the source of the problem. Blocking them in the .htaccess file is pointless since this kind of Spam never visits your site. Check this answers for more information about this spam https://...


9

Yes, different email obfuscation methods do work with varying degrees of success. But each has to be weighed with whether they affect the ability for your customers to communicate easily with you. I wouldn't want to be losing any business just because a user finds it annoying or time consuming to contact me. It would be a particularly persistent customer who ...


8

I used to work for a bulk mail sender and I created one of his mass mail sender. As you pointed, is not a option to use a mail marketing provider, the answer to you question is build your own. As I suppose, you will be sending email only from your domain, and not for any third party, it will be a lot more complicated. To build your own mail marketing you ...


8

The Spam is getting out of control. The list it's growing and it's time-consuming and not even efficient to add a filter for each of the spammers since most of them shows up for a few days and then disappear and a new one comes. There is a lot of misinformation, the most common mistake is recommending to use the .htaccess, this file blocks the access to the ...


8

The bot is looking for a site that automatically publishes their comments, using a "Black-List" method. Most Webmasters use the "White-List" method and only approve comments they have personally read. If the bot was able to post for example 100 links and Google's bot were to see those links it would give their URL a PR boost, even if you remove the comment ...


8

We did two things: Sign up with JMRP via https://postmaster.live.com/snds/JMRP.aspx Sign up with SNDS via http://postmaster.live.com/snds The JMRP application will go through a form and a document you need to sign. In our case it took about two days to get approved. Make sure that your SPF/DKIM/DMARC is setup correctly - we are using Port25 and their ...


8

The deep link to get whitelisted for Microsoft's email network is: http://go.microsoft.com/fwlink/?LinkID=614866&clcid This gives you the form "Sender Information for Outlook.com Delivery"


6

This is unlikely to be "visitors" (real people) but is likely to be automated software testing for vulnerabilities in the software run by your website. I've seen these types of requests for years. The most common for my servers is requests for WordPress administration pages and Microsoft FrontPage extensions. If you are not running the software, these ...


6

It's not normal that your site is outranking you, but can happen. Google has its own tool to report Scrapped content, you can check it here -> https://docs.google.com/forms/d/1Pw1KVOVRyr4a7ezj_6SHghnX1Y6bp1SOVmy60QjkF0Y/viewform I also advise you to make a DMCA complaint, as addresses copyright issues and can act faster. I had that experience in the past ...


6

If you look at https://developer.apple.com/library/prerelease/ios/documentation/General/Conceptual/AppSearch/UniversalLinks.html it seems that the URL in question is supposed to be a JSON file linking paths on your website, back to your iOS app (when such an association exists, naturally). I got some hits too which left and wondering the same as you. My ...


6

Turns out, the WordPress install was indeed compromised. I did a diff of my existing install vs a new WordPress install, and diff reported new file: # diff -qr wordpress_installed/ wordpress_new/ Only in wordpress_installed/wp-includes: class-wp-init.php I also found wp-config.php had been edited to include this @include_once(ABSPATH . 'wp-includes/class-...


6

I can't claim to know all the motivations of spam bots, but the main motivation is creating links to help SEO. Most of the bots submitting this form don't even realize that it is a contact form. These bots submit every form they find trying to get their comments onto pages. The bots submit text that can get indexed in search engines. Then the spammer ...


6

Random unexpected URLs on your should be returning "404 Not Found" status. When so many weird URLs return "301 Permanent Redirect" instead, it is often a sign that your site has been hacked. Requests to wp-login and xmlrpc are common attack vectors for WordPress. If you are seeing tons of requests to those files, many of them are ...


5

The header X-CNFS-Analysis is added to emails processed by Cloudmark Authority, an email filtering engine, and appliances which use this engine such as Cloudmark Security Platform. In newer versions, it has been renamed to X-Authority-Analysis. In the case of Rackspace, they use Cloudmark Server Edition, a plugin for Microsoft Exchange, to provide filtering ...


5

You can exclude them by creating a filter. You need to find something specific enough so you don't accidentally block good visitors and it is tedious as you have to manually add each spammer but this will do the trick.


5

Recently there has been a spate of Google Analytics spammers. They typically: Send requests directly to Google's collector script without ever hitting your website. Put advertisements for their website into referrers or other places where the data shows up in your reporting Customize their requests only with your Analytics Id (but not with your domain ...


5

Since this does appear to be the real Googlebot, the recommended way to block access/crawling is to use /robots.txt: User-agent: googlebot Disallow: /blocked.php However, if you still want to block this IP using .htaccess then you can do something like the following, near the top of your root .htaccess file: RewriteEngine On RewriteCond %{REMOTE_ADDR} =66....


5

I looked up the IP 185.191.171.42, and it seems to be owned by SEMRush. So the possible reason is that you have second-hand domain that the old owner created those pages and SEMRush still has the list of those pages. So SEMRush is trying to crawl those pages, maybe to see the backlink or other parts of the pages for SEO analytic. To confirm that you may ...


4

I have a lot of experience stopping spam. In fact, I used to speak with GFI and shared some of my filter techniques with them. You can stop spam with near 100% effectiveness with a few simple steps. This does not negate the need for an anti-spam filter or mean that you will never get spam, however, just a couple of things will almost stop spam cold. It is ...


4

The bots are probably harmless. But I like to think that I'm starring in a Tom Clancy novel and it's a sleeper cell waiting to unleash a tidal wave of spam that could ultimately compromise national security. So I recommend deleting them on a routine basis. ;) When a user signs up, determine what country they're from. I find that MaxMind's GeoIP web service ...


4

These hits are from a content spammer using multiple proxy IP addresses to hide their own IP address. These attempts are often logged in honeypot projects by IP address and can be searched on there like I've done here. You can also lookup IP addresses in proxy databases like I've done here. A search for the path of the URL shows that it's part of a web ...


4

Panda / Penguin are algorithms, not manual actions, so they would not be notified or listed as manual actions. All current manual actions are shown in Webmaster Tools, even if they were put in place when someone else owned the domain. It sounds like you're doing the right thing with regards to the problematic links to the new domain - removing them, or ...


4

Blocking by referrer won't help: Googlebot doesn't send a referrer header when it crawls, so it will never see your block. Here is what Google's John Mueller (who works on Webmaster Tools and Sitemaps) has to say about 404 errors that appear in Webmaster tools: HELP! MY SITE HAS 939 CRAWL ERRORS!!1 I see this kind of question several times a week; ...


4

The ideal way to do this is to send a hard fail on email that isn't coming from your server IP address or your specified MX record by doing this: v=spf1 +a +mx -all This however will not stop the email from being sent. Spam filters do various checks on an email that has been sent out, one of them will be a check on the SPF record of the domain it is ...


4

SPAM reasons, Yes. Google no. There are non-Google spiders that look specifically for email addresses, presumably for SPAM purposes. So over the years people have tried to find ways to make email addresses less "visible" to spam crawlers. A very common way is to display name (at) domain (dot) com with a script behind it to allow the link to work as an e-...


4

To be honest with you I would like to think that Mail Chimp will have spf records and domain keys etc all sorted out and generally keeping the reputation of their infrastructure clean. Hence I would imagine this will be issues with your content and interactions from your recipients. A couple of things I have noticed straight off. It looks quite image ...


4

Sometimes people may post comments with a lot of dangerous keywords like casinos, poker, gambling, viagra and linked with low quality sites. Also sometimes people are using keywords instead of their original name to get the link for their target keywords. As a result your site or blog with low quality or unnatural links. So it will affect your rankings ...


4

To block all "blank" User-Agents or User-Agents consisting of a hyphen, you could use the following in your .htaccess RewriteCond %{HTTP_USER_AGENT} ^-?$ RewriteRule ^ - [F]


4

You almost had it; the text of the record should only be what follows "Value:" v=spf1 include:hotmail.com ~all See the syntax documentation on the OpenSPF website. In the new DNS manager interface, just add a TXT record like so: In the old DNS Manager, when you add a TXT record you will see the following: Note: Using TXT records for SPF information is ...


Only top voted, non community-wiki answers of a minimum length are eligible