Mathematics trackbacks
I got a rash of trackbacks spamvertizing a mathematics site today. Two different sites. One spamvertized on spamhuntress, the other on annelisabeth. But it’s the same spammer.
Various IP numbers. To me these look like compromised boxes, not proxies.
user agent:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Can anyone help me with a logging pluging for the WP trackback script? By that I mean logging all the http headers.
I couldn’t find a master spambot associated with this attack. Unless this one that I found after a few trackbacks on annelisabeth is related:
67.19.111.242
It tried fetching a number of posts, but is blacklisted. Could be another spammer, though. But it did have the same user agent. It started pulling posts yesterday, and kept going today.
I received a few of these trackback spams today as well. What is strange is that all of mine where trackbacking to FOLDOC which is the well respected Online Dictionary of Computing hosted by Imperial College London.
Is this a test of trackback spamming before a big wave hits?
The IPs that spammed me came from Belgium and the US.
The my log file shows the host headers for the 3 different IPs as all being:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
I’ve written a plugin that tracks all information I can get. I am not releasing it to the general public, as it would provide clues as to how I am blocking the spammers. I will however, provide a stripped version to you if you would like. I have mine logged to a non-WordPress database and I could customize it to your setup if you let me know how you want to log it.