Serendipity Forums

User and developer community
https://board.s9y.org/

Need to find out an efficient way to stop trackback spam

https://board.s9y.org/viewtopic.php?t=10845

Page 1 of 1

Need to find out an efficient way to stop trackback spam

Posted: Mon Aug 20, 2007 7:56 pm
by deminy
I use Site5.com to host my websites. My personal website was blocked several times by Site5.com (a webhosting provider) because of resource usage issues in last few months.

Finally, I found that trackback spam costed lots of server resources (including database connection resources). So I added an Apache rewrite rule to stop trackback requests:

Code: Select all

# http://httpd.apache.org/docs/1.3/mod/mod_rewrite.html#RewriteRule
RewriteCond %{REMOTE_ADDR}     !^MY_SERVER_IP$
RewriteCond %{SCRIPT_FILENAME}  comment\.php
RewriteCond %{QUERY_STRING}     type=trackback
RewriteRule (.*) - [F]
2 days ago, I got an technical email from Site5 telling me that my websites were blocked again because of DDoS attack which was overloading the server:

Code: Select all

80.11.24.11 - - [18/Aug/2007:05:34:01 -0400] "POST /blog/comment.php?type=trackback&entry_id=3354 HTTP/1.0" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:01 -0400] "POST /blog/comment.php?type=trackback&entry_id=3781 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:01 -0400] "POST /blog/comment.php?type=trackback&entry_id=3161 HTTP/1.1" 403 - "-" "-"
80.11.24.11 - - [18/Aug/2007:05:34:02 -0400] "POST /blog/comment.php?type=trackback&entry_id=3761 HTTP/1.0" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:02 -0400] "POST /blog/comment.php?type=trackback&entry_id=2809 HTTP/1.1" 403 - "-" "-"
80.11.24.11 - - [18/Aug/2007:05:34:02 -0400] "POST /blog/comment.php?type=trackback&entry_id=3058 HTTP/1.0" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:02 -0400] "POST /blog/comment.php?type=trackback&entry_id=3089 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:02 -0400] "POST /blog/comment.php?type=trackback&entry_id=3227 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:02 -0400] "POST /blog/comment.php?type=trackback&entry_id=3065 HTTP/1.1" 403 - "-" "-"
80.11.24.11 - - [18/Aug/2007:05:34:02 -0400] "POST /blog/comment.php?type=trackback&entry_id=3699 HTTP/1.0" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:02 -0400] "POST /blog/comment.php?type=trackback&entry_id=3380 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:02 -0400] "POST /blog/comment.php?type=trackback&entry_id=3672 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:03 -0400] "POST /blog/comment.php?type=trackback&entry_id=3032 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:03 -0400] "POST /blog/comment.php?type=trackback&entry_id=2809 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:03 -0400] "POST /blog/comment.php?type=trackback&entry_id=3089 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:03 -0400] "POST /blog/comment.php?type=trackback&entry_id=3227 HTTP/1.1" 403 - "-" "-"
80.11.24.11 - - [18/Aug/2007:05:34:03 -0400] "POST /blog/comment.php?type=trackback&entry_id=3165 HTTP/1.0" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:03 -0400] "POST /blog/comment.php?type=trackback&entry_id=2945 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:03 -0400] "POST /blog/comment.php?type=trackback&entry_id=3584 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:03 -0400] "POST /blog/comment.php?type=trackback&entry_id=3714 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:03 -0400] "POST /blog/comment.php?type=trackback&entry_id=3418 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:03 -0400] "POST /blog/comment.php?type=trackback&entry_id=3106 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:03 -0400] "POST /blog/comment.php?type=trackback&entry_id=3240 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:03 -0400] "POST /blog/comment.php?type=trackback&entry_id=3593 HTTP/1.1" 403 - "-" "-"
80.11.24.11 - - [18/Aug/2007:05:34:04 -0400] "POST /blog/comment.php?type=trackback&entry_id=2905 HTTP/1.0" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:04 -0400] "POST /blog/comment.php?type=trackback&entry_id=2945 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:04 -0400] "POST /blog/comment.php?type=trackback&entry_id=3741 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:04 -0400] "POST /blog/comment.php?type=trackback&entry_id=3418 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:04 -0400] "POST /blog/comment.php?type=trackback&entry_id=3453 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:04 -0400] "POST /blog/comment.php?type=trackback&entry_id=3431 HTTP/1.1" 403 - "-" "-"
125.103.6.230 - - [18/Aug/2007:05:34:04 -0400] "POST /blog/comment.php?type=trackback&entry_id=3053 HTTP/1.0" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:04 -0400] "POST /blog/comment.php?type=trackback&entry_id=3561 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:04 -0400] "POST /blog/comment.php?type=trackback&entry_id=3593 HTTP/1.1" 403 - "-" "-"
80.11.24.11 - - [18/Aug/2007:05:34:04 -0400] "POST /blog/comment.php?type=trackback&entry_id=2809 HTTP/1.0" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:04 -0400] "POST /blog/comment.php?type=trackback&entry_id=3584 HTTP/1.1" 403 - "-" "-"
80.11.24.11 - - [18/Aug/2007:05:34:04 -0400] "POST /blog/comment.php?type=trackback&entry_id=3562 HTTP/1.0" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:05 -0400] "POST /blog/comment.php?type=trackback&entry_id=3320 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:05 -0400] "POST /blog/comment.php?type=trackback&entry_id=3561 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:05 -0400] "POST /blog/comment.php?type=trackback&entry_id=3275 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:05 -0400] "POST /blog/comment.php?type=trackback&entry_id=3661 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:05 -0400] "POST /blog/comment.php?type=trackback&entry_id=3470 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:05 -0400] "POST /blog/comment.php?type=trackback&entry_id=3660 HTTP/1.1" 403 - "-" "-"
62.215.3.45 - - [18/Aug/2007:05:34:06 -0400] "POST /blog/comment.php?type=trackback&entry_id=3551 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:06 -0400] "POST /blog/comment.php?type=trackback&entry_id=3320 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:06 -0400] "POST /blog/comment.php?type=trackback&entry_id=3275 HTTP/1.1" 403 - "-" "-"
80.11.24.11 - - [18/Aug/2007:05:34:06 -0400] "POST /blog/comment.php?type=trackback&entry_id=3425 HTTP/1.0" 403 - "-" "-"
80.11.24.11 - - [18/Aug/2007:05:34:06 -0400] "POST /blog/comment.php?type=trackback&entry_id=3611 HTTP/1.0" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:06 -0400] "POST /blog/comment.php?type=trackback&entry_id=3714 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:06 -0400] "POST /blog/comment.php?type=trackback&entry_id=3661 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:06 -0400] "POST /blog/comment.php?type=trackback&entry_id=3470 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:06 -0400] "POST /blog/comment.php?type=trackback&entry_id=3660 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:07 -0400] "POST /blog/comment.php?type=trackback&entry_id=3551 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:07 -0400] "POST /blog/comment.php?type=trackback&entry_id=3106 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:07 -0400] "POST /blog/comment.php?type=trackback&entry_id=3453 HTTP/1.1" 403 - "-" "-"
221.232.159.112 - - [18/Aug/2007:05:34:07 -0400] "POST /blog/comment.php?type=trackback&entry_id=3431 HTTP/1.1" 403 - "-" "-"
80.11.24.11 - - [18/Aug/2007:05:34:07 -0400] "POST /blog/comment.php?type=trackback&entry_id=3756 HTTP/1.0" 403 - "-" "-"
80.11.24.11 - - [18/Aug/2007:05:34:07 -0400] "POST /blog/comment.php?type=trackback&entry_id=3032 HTTP/1.0" 403 - "-" "-"
I emailed back Site5.com and told them that actually it's not DDoS attack but trackback spam, and I had tried my best to protect the server by forbidding trackback requests.

Site5.com replied me later saying "Although you may be redirecting the requests through mod_rewrite, the connections are still coming in to the server and using mod_rewrite uses additional server resources. If your account is constantly being posted to, it will still use a considerable amount of resources."

Finally, I promised them that "I will try to figure out a better way (if could) to stop using too much server resources", and they turned on my websites.

So, my question is, how can I stop trackback spam in a more efficient way (to save more server resources)? I prefer not to change URLs. Thanks.

Re: Need to find out an efficient way to stop trackback spam

Posted: Mon Aug 20, 2007 10:53 pm
by garvinhicking
Hi!

You might want to kindly ask your server admins from Site5.com to add some kind of iptables protection to their server racks, so that quickly incoming requests from at least the same IP address can be triggered.

Of course that doesn't protect you from Botnets, but nobody can really do something against them.

Anyways - you can block trackbacks completely by following the FAQ on www.s9y.org on how to disable the trackbacks through adding a

Code: Select all

if ($_REQUEST['type'] == 'trackback') die('No, thank you')
line in your comment.php at the beginning. That completely shuts of trackbacks and doesn'T cost much performance.
Site5.com replied me later saying "Although you may be redirecting the requests through mod_rewrite, the connections are still coming in to the server and using mod_rewrite uses additional server resources. If your account is constantly being posted to, it will still use a considerable amount of resources."
That much is true, but you can't do anything against that! Nobody can be protected against DDoS, you can't even do it at iptables level, let alone at application level. There it's already too late to block.

So even my indicated measurement doesn'T block the resources. There is no way to prevent DDoS -- if a hosting company blocks your site because of DDoS attacks, then they shouldn't be hosting pages at all. Every webpage can be attacked because of the botnets.

The legislations of the world are the only ones who can try to deal with it by putting large jail times or harsh fines on creating and running botnets. And people should learn to use the internet, so that Trojans can no longer be installed by stupid people clicking on stupid emails.

Yes, this makes me mad, really mad. Much more mad, because there's no technical means to block these things! :-(

Regards,
Garvin

Posted: Tue Aug 21, 2007 8:58 pm
by blog.brockha.us
A way to block these bots at least from PHP/SQL level is to block them by .htaccess modification.

See my article (http://blog.brockha.us/index.php?archiv ... lected]=en) for some clues how to do this. But this won't stop the DoS attack itself, it will only reduce the resources needed to handle the calls.

Posted: Sun Sep 30, 2007 3:50 am
by atiensivu
I ran into the exact same issue. I suspect there are some compromised systems out there that are being used to try to post spam. I posted my workaround here - http://board.s9y.org/viewtopic.php?p=63441#63441

It should kill most of the CPU/SQL/etc usage but it won't kill all of the network usage, obviously.

Update: Just checked out the link in the post above me - your method is much more elegant. :)

Normal Hosting provider behavior?

Posted: Tue Oct 09, 2007 4:00 pm
by gregfuller
I have limited experience with hosts, but it seems they should be trying to protect you and themselves with techniques like the ip table mentioned earlier, rather then cutting you off.

Is this a normal behavior for a hosting provider? I think on my next switch, I'll ask beforehand what they do in such a case.

Thanks - Greg
All times are UTC+02:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited