New Spam Threat Hits 90,000 Sites - Is Yours Next? Get the Trellian Seo Toolkit
Get our FREE SEO Guide
Subscribe to our newsletter to receive useful SEO tips, tricks, strategies, free ebooks that are available only to our subscribers and get this amazing SEO guide for free!

Your email is safe and will NEVER be shared with any other parties. And of course, you can unsubscribe at any time.

Name:
Email:
SEO Elite - #1 SEO Software

Who Else Wants To Finally Get A #1 Google Ranking In As Little As 7 Days... And Drive A Minimum Of 789 Unique Visitors To Your Websites Per Day?

Search engine spider simulator PHP script

With this PHP script, you can take a look at any website with the eyes of a search engine spider

Only $9.95
Coming soon ...


Self SEO Store  
Website templates
Flash templates
Submit your article

Register
Login

Search
XML news feeds
Free RSS news reader
Contact
Impressum
Mobile phone accessories.


AddThis Feed Button

New Spam Threat Hits 90,000 Sites - Is Yours Next?

Posted by Richard Adams on: 2006-04-28 16:50:33

Self SEO > Anti Spam Articles


On Tuesday I received 423 emails from an unknown spammer attacking my site.


On Wednesday I received 789 emails from the same spammer.

Action had to be taken.

The emails were copies of posts to my discussion forum - the typical spammers posts - keyword stuffing, numerous hyperlinks to junk sites crammed with even more keywords.

It was clear I was being hit by one spammer, with an automated script, for a number of telltale reasons:

1) Nobody could post 789 posts to a forum in 24 hours manually

2) All posts were from random .co.za email addresses (South African domains, but likely false)

3) All posts pointed to very similar spammy sites obviously made with the same auto-generation software

4) Checking various domains promoted within these posts in WHOIS showed they were all owned by a certain guy in Paris

I carefully combed my forum for these junk posts but couldn't see anything out of the ordinary. So I checked for posts by .co.za email addresses, or French IPs but couldn't see a problem anywhere.

Where were they coming from, and where were the posts?

To help me in my quest I did a search on Google for the text that began every email which read:

"The following was posted in the on

But couldn't find any links that were any help.

So next I investigated the content of the emails for common factors and found the following Javascript snippet began every message body:

"var defDoor"... before launching into other Javascript elements, followed by the keywords and links.

I wonder...

A quick search on Google and two factors astonished me...

1) Google showed up 92,600 pages with this code on, of which every one I checked matched the exact spam posts I was seeing in style and content. So we were dealing with a professional of some magnitude.

2) They were all on forums, but not the one I used, but WWWBoard as available from http://www.scriptarchive.com/wwwboard.html

A quick search with my FTP software through the bowels of my admittedly large site that has been online for 5 years or so and has seen more reworkings than Pamela Anderson showed I *had* got WWWBoard installed on my site but had stopped using it years ago in place of my current forum software.

I had completely forgotten about it, and there were the hundreds of spam posts sitting there on my server!

Obviously I don't use the script so instantly deleted it and the spamming stopped dead overnight but if I'm one of over 90,000 victims this guy has duped then a little advice is necessary:

1) Appreciate that there are security flaws to WWWBoard and you either need to watch your forum very carefully or consider switching to another script.

2) Don't leave old scripts sitting around on your server waiting for spammers to abuse them. Use them, or delete them.

3) Try to avoid using obvious folders for scripts. Whilst I didn't link to my old forum from anywhere on the site, it was in an obvious folder so a spammer (or a script) could easily have guessed it.

4) Realise that security threats are very real if you get reasonable traffic and take steps *in advance* to minimize the risk to your own site.

Copyright 2006 Richard Adams

=======================================================
Richard Adams is the founder of http://www.merchantaccountforum.com , one of the net's most popular merchant account advice sites.
=======================================================




Print this article    Tell a friend