{"id":18053,"date":"2009-06-02T10:00:01","date_gmt":"2009-06-02T10:00:01","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2009\/06\/02\/spam-trackback-attack-returns-its-not-a-matter-of-whether-but-how-much\/"},"modified":"2009-06-02T10:00:01","modified_gmt":"2009-06-02T10:00:01","slug":"spam-trackback-attack-returns-its-not-a-matter-of-whether-but-how-much","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20090602-01\/?p=18053","title":{"rendered":"Spam trackback attack returns, it’s not a matter of whether but how much"},"content":{"rendered":"

Like microsoft.com, the question isn’t whether<\/i> blogs.msdn.com site is under attack but rather how bad the attack is right now<\/a>. <\/p>\n

There are a number of regular culprits, like codedstyle.com<\/code>, anith.com<\/code>, simplynetdev.com<\/code>, but those sites tend to focus on the most recent few articles. A new category of trackback spammer is here: The I’m going to scrape your entire site and create a trackback for every article<\/i> trackback spammer. <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Site<\/th>\nFrom<\/th>\nTo<\/th>\nCount<\/th>\nRate (pings\/hr)<\/th>\n<\/tr>\n
paidsurveyshub.info<\/code><\/td>\n5\/28\/2009 04:27 PM<\/td>\n5\/28\/2009 04:41 PM<\/td>\n27<\/td>\n111<\/td>\n<\/tr>\n
www.newillinoismesotheliomalawyers.co.cc<\/code><\/td>\n5\/28\/2009 05:18 PM<\/td>\n5\/28\/2009 05:18 PM<\/td>\n1<\/td>\n<\/td>\n<\/tr>\n
codedstyle.com<\/code><\/td>\n5\/29\/2009 07:25 AM<\/td>\n5\/29\/2009 07:26 AM<\/td>\n5<\/td>\n240<\/td>\n<\/tr>\n
asp-net-hosting.simplynetdev.com<\/code><\/td>\n5\/29\/2009 07:34 AM<\/td>\n5\/29\/2009 07:36 AM<\/td>\n2<\/td>\n30<\/td>\n<\/tr>\n
www.anith.com<\/code><\/td>\n5\/29\/2009 08:24 AM<\/td>\n5\/29\/2009 08:24 AM<\/td>\n1<\/td>\n<\/td>\n<\/tr>\n
paidsurveyshub.info<\/code><\/td>\n5\/29\/2009 09:07 AM<\/td>\n5\/29\/2009 10:26 AM<\/td>\n73<\/td>\n55<\/td>\n<\/tr>\n
microsoft-sharepoint.simplynetdev.com<\/code><\/td>\n5\/29\/2009 10:39 AM<\/td>\n5\/29\/2009 10:39 AM<\/td>\n2<\/td>\n<\/td>\n<\/tr>\n
paidsurveyshub.info<\/code><\/td>\n5\/29\/2009 12:09 PM<\/td>\n5\/30\/2009 04:33 AM<\/td>\n584<\/td>\n36<\/td>\n<\/tr>\n
outdoorceilingfansite.info<\/code><\/td>\n5\/30\/2009 11:49 PM<\/td>\n5\/31\/2009 12:09 AM<\/td>\n206<\/td>\n615<\/td>\n<\/tr>\n
woodtvstand.info<\/code><\/td>\n5\/31\/2009 02:47 PM<\/td>\n5\/31\/2009 06:01 PM<\/td>\n507<\/td>\n157<\/td>\n<\/tr>\n
patiochairsite.info<\/code><\/td>\n5\/31\/2009 08:47 PM<\/td>\n5\/31\/2009 09:18 PM<\/td>\n24<\/td>\n45<\/td>\n<\/tr>\n
hammockstandsite.info<\/code><\/td>\n5\/31\/2009 10:20 PM<\/td>\n5\/31\/2009 10:44 PM<\/td>\n28<\/td>\n68<\/td>\n<\/tr>\n
indoorgrillsrecipes.info<\/code><\/td>\n6\/01\/2009 12:46 AM<\/td>\n6\/01\/2009 01:00 AM<\/td>\n20<\/td>\n81<\/td>\n<\/tr>\n
portablegreenhousesite.info<\/code><\/td>\n6\/01\/2009 03:05 AM<\/td>\n6\/01\/2009 04:35 AM<\/td>\n102<\/td>\n67<\/td>\n<\/tr>\n
uniformstores.info<\/code><\/td>\n6\/01\/2009 05:41 AM<\/td>\n6\/01\/2009 07:00 AM<\/td>\n68<\/td>\n51<\/td>\n<\/tr>\n
asp-net-hosting.simplynetdev.com<\/code><\/td>\n6\/01\/2009 07:13 AM<\/td>\n6\/01\/2009 07:13 AM<\/td>\n1<\/td>\n<\/td>\n<\/tr>\n
codedstyle.com<\/code><\/td>\n6\/01\/2009 07:40 AM<\/td>\n6\/01\/2009 07:40 AM<\/td>\n2<\/td>\n<\/td>\n<\/tr>\n
woodtvstand.info<\/code><\/td>\n6\/01\/2009 10:27 AM<\/td>\n6\/01\/2009 11:48 AM<\/td>\n397<\/td>\n294<\/td>\n<\/tr>\n
patiochairsite.info<\/code><\/td>\n6\/01\/2009 11:46 AM<\/td>\n6\/01\/2009 12:02 PM<\/td>\n10<\/td>\n38<\/td>\n<\/tr>\n
hammockstandsite.info<\/code><\/td>\n6\/01\/2009 12:07 PM<\/td>\n6\/01\/2009 12:15 PM<\/td>\n21<\/td>\n158<\/td>\n<\/tr>\n
indoorgrillsrecipes.info<\/code><\/td>\n6\/01\/2009 12:17 PM<\/td>\n6\/01\/2009 12:36 PM<\/td>\n51<\/td>\n161<\/td>\n<\/tr>\n
portablegreenhousesite.info<\/code><\/td>\n6\/01\/2009 12:36 PM<\/td>\n6\/01\/2009 01:03 PM<\/td>\n67<\/td>\n149<\/td>\n<\/tr>\n
uniformstores.info<\/code><\/td>\n6\/01\/2009 01:04 PM<\/td>\n6\/01\/2009 01:38 PM<\/td>\n80<\/td>\n141<\/td>\n<\/tr>\n
paidsurveyshub.info<\/code><\/td>\n6\/01\/2009 10:47 PM<\/td>\n6\/02\/2009 01:20 AM<\/td>\n16<\/td>\n6<\/td>\n<\/tr>\n<\/table>\n

I’m pretty sure this will continue for at least the next week. I think I’m going to have to write a script that auto-deletes all these bogus trackbacks. <\/p>\n","protected":false},"excerpt":{"rendered":"

Like microsoft.com, the question isn’t whether blogs.msdn.com site is under attack but rather how bad the attack is right now. There are a number of regular culprits, like codedstyle.com, anith.com, simplynetdev.com, but those sites tend to focus on the most recent few articles. A new category of trackback spammer is here: The I’m going to […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[103],"class_list":["post-18053","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-non-computer"],"acf":[],"blog_post_summary":"

Like microsoft.com, the question isn’t whether blogs.msdn.com site is under attack but rather how bad the attack is right now. There are a number of regular culprits, like codedstyle.com, anith.com, simplynetdev.com, but those sites tend to focus on the most recent few articles. A new category of trackback spammer is here: The I’m going to […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/18053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=18053"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/18053\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=18053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=18053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=18053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}