Trackback Spam II
Back at the end of June, I reported that trackback spam directed against this site had soared to nearly 13,000/month. That was, by any measure, a pretty hefty amount of spam. You might well have wondered what has happened since then.
Automated Trackback Spam, Feb-Oct 2005.
As you can see from the graph at left, my trackback spam load has settled down to just shy of 12,000/month. Most of these come from a withering array of open proxies and (increasingly) zombie PCs. Almost all of them are automatically blocked, but if even 1/2 of 1% sneak through, that’s still an undesirably large amount of spam to clean up manually. I strive for, and almost achieve an Ivory Snow-level of effectiveness.
More than just blocking them, I do my best to tarpit the spammers. As I write this, there are 212 tarpitted connections open. Each of these stay open for as long as two days. You’d think that would have a significant impact on the spammers. But, with an unlimited number of open proxies and zombie PCs to choose from, the spammers don’t seem to care much.
Starting in July, I noticed a new trend: rather aggressive trackback spammers operating from fixed IP addresses. They’re indicated by the dark rectangles in the graph. Trackback spamming from a fixed IP address is dumb. It makes you too easy to block or, in this case, to harass. Once I got serious about counter-attacking those fixed-IP spammers, their numbers dropped rather precipitously (from 3769 in August to 59 in October).
A minor triumph, perhaps, but one that does little to ease my anxiety. There are clearly a number of new groups out there, writing new trackback spambots. Like someone nervously watching the levée as the floodwaters rise, I wonder how long my blocking techniques will remain effective.