Spam

Okay, so i've gotten completely sick of those stupid referrer spams. Lately I've been seeing more and more spams with embedded comma characters with multiple sites in the referrer field. So, with a little bit of work, I figured, why not write a mod_rewrite apache rule to block them.



Pretty simple, and works with a properly configured .htaccess file.

So, a lot of people have asked me over the past year or so how I manage to prevent getting so much spam from China without needing to outright block all of China's IP space either in iptables/firewall or DNSbl lists.

Well, I'm about to give you our secret.

The Chinese govt dislikes us (the SOSDG) - alot. We tend to host sites that their govt does not want its people seeing (Falun Gong anyone?).

So, what does any great opressive govt do to sites that are on its banned list? They filter out all of our IP space in their network so their users can't get to our servers.

This does have an interesting side effect though - the filter blocks more then just HTTP traffic (port 80 tcp). SMTP connections are blocked as well. Spammers in China can no longer reach our servers at all.

So, if you want to cut back on spam from China without having to implement blocklists or filters your customers may not appreciate, host a site that pisses the Chinese govt off on your mail servers. I've seen them block new IP ranges hosting Falun Gong sites in under 12 hours.

Easy because it requires no major changes on your end. Fun because you get to irritate everyone's favorite oppressive country and waste their time.

So, it seems Richard Scumville finally discovered my blog (~6 months after the fact). So, what you think of it, Dick? Going to write a 4 page diatrabe about how me writing a blog is a sign of me being scared?

Mwahaha.

/var/log/httpd/blog.sosdg.org-access_log:24.174.169.194 - - [11/Oct/2005:09:45:44 -0500] "GET /bruns/ HTTP/1.1" 200 9569 "http://www.google.com/search?q=marc+wigle&hl=en&lr=&start=20&sa=N" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
/var/log/httpd/blog.sosdg.org-access_log:24.174.169.194 - - [11/Oct/2005:09:45:44 -0500] "GET /bruns/templates/default/img/somerights20.gif HTTP/1.1" 200 1836 "http://blog.sosdg.org/bruns/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
/var/log/httpd/blog.sosdg.org-access_log:24.174.169.194 - - [11/Oct/2005:09:45:44 -0500] "GET /bruns/serendipity.css HTTP/1.1" 200 1739 "http://blog.sosdg.org/bruns/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
/var/log/httpd/blog.sosdg.org-access_log:24.174.169.194 - - [11/Oct/2005:09:45:45 -0500] "GET /bruns/templates/default/img/background.png HTTP/1.1" 200 674 "http://blog.sosdg.org/bruns/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
/var/log/httpd/blog.sosdg.org-access_log:24.174.169.194 - - [11/Oct/2005:09:45:45 -0500] "GET /bruns/plugin/pngbehavior.htc HTTP/1.1" 200 1013 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
/var/log/httpd/blog.sosdg.org-access_log:24.174.169.194 - - [11/Oct/2005:09:45:45 -0500] "GET /bruns/templates/default/img/emoticons/smile.png HTTP/1.1" 200 556 "http://blog.sosdg.org/bruns/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
/var/log/httpd/blog.sosdg.org-access_log:24.174.169.194 - - [11/Oct/2005:09:45:45 -0500] "GET /bruns/templates/default/img/back.png HTTP/1.1" 200 468 "http://blog.sosdg.org/bruns/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
/var/log/httpd/blog.sosdg.org-access_log:24.174.169.194 - - [11/Oct/2005:09:45:45 -0500] "GET /bruns/templates/default/img/s9y_banner_small.png HTTP/1.1" 200 4101 "http://blog.sosdg.org/bruns/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
/var/log/httpd/blog.sosdg.org-access_log:24.174.169.194 - - [11/Oct/2005:09:45:45 -0500] "GET /bruns/templates/default/img/forward.png HTTP/1.1" 200 477 "http://blog.sosdg.org/bruns/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

Congrats to Robert Braver on winning a $10 mil judgement against spammer Robert Soloway!

PDF Of Judgement

Why am I doing a followup post to DollarTrader vs. Matt from SORBS?

Well, because I feel like it.

So, its time to do my most favorite game - break down and blow apart a spammer's claim!

William claims to have lost 6.5 million dollars because of the SORBS listing of his IP address. Some of you are probably wondering what that wild laughing coming from my post is right now - well, thats me trying to compose myself after reading the above link.

But, back to the point...

1. Why is a company that supposedly is making 6.5 million USD in a day hosting their website on a shared web server without their own dedicated IP address? Shouldn't they have an IT department, dedicated servers either in their facility or a co-loc place?

2. He claims to have lost 40 someodd customers because of this - shouldn't a company that makes 6.5 million USD a day have other means of contacting their customers then just e-mail?

3. Why is a company that supposedly is making 6.5 million USD a day letting their 'CEO' make legal threats? Multi-million dollar companies usually have a whole team of highly paid lawyers to make legal threats.


And some good points from Matt himself:

Even funnier was it aparently was an order to 'sell' stocks that was
delayed/refused.... I figure 2 things...

1/ It has to be a mighty big trade to loose $6.5m on one delayed sell
2/ knowing the reliability of email to base a $6.5m time sensitive
transation on email... well it's Doomed.. DOOMED I say!

Of course it was also funny that baing a $31b cap company (so say he) he
was phoning me and not his legal team.

I really like the part where William tells Matt that its against FCC rules to run your own mail server.

Found a great site today - SpamHuntress - that deals with blog/referrer/trackback spams.

Some good comments from the site about spam are here, and worth a read.

Oh god, a name I haven't heard forever (well, only about two years, but thats a long time for me), Bernard Shifman. For those of you who don't know about our friend Bernie, hes the 'computer consultant' who decided to spam his way to kookdom!

Neil Schwartzman did an excellent page on Bernie here.

Check out the blog here too.