<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	>
<channel>
	<title>Comments on: Name and shame</title>
	<atom:link href="http://www.annelisabeth.com/blog/2005/01/28/name-and-shame/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.annelisabeth.com/blog/2005/01/28/name-and-shame/</link>
	<description>writes about tech, faith and whatever</description>
	<pubDate>Tue, 07 Feb 2012 20:06:29 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.6.2</generator>
		<item>
		<title>By: Justin Mason</title>
		<link>http://www.annelisabeth.com/blog/2005/01/28/name-and-shame/#comment-288</link>
		<dc:creator>Justin Mason</dc:creator>
		<pubDate>Tue, 01 Feb 2005 18:23:20 +0000</pubDate>
		<guid isPermaLink="false">http://www.annelisabeth.com/blog/2005/01/28/name-and-shame/#comment-288</guid>
		<description>Hi Ann --

I would suggest looking at what's been done before in the email spam world.

SpamHaus, for example, collates IP addresses and puts those in a list -- but then periodically "crunches the numbers" to map IP to ASN, and therefore figure out the top N spam-emitting ASNs worldwide.  it's then possible to map ASN to network name.  reverse DNS can help here too, of course.

In other words, there's *both* an IP blocklist, and an informational, "these are the world's spammiest networks" page for PR and public pressure.

BTW, there's a lot of best-practice guidelines from the email spam world, and we can definitely give advice where it may be useful ;)

I'm the original author of SpamAssassin, and we've just started a mailing list for blogspam discussion there -- mail blogspam-subscribe /at/ spamassassin.apache.org to subscribe, if you like!
</description>
		<content:encoded><![CDATA[<p>Hi Ann &#8211;</p>
<p>I would suggest looking at what&#8217;s been done before in the email spam world.</p>
<p>SpamHaus, for example, collates IP addresses and puts those in a list &#8212; but then periodically &#8220;crunches the numbers&#8221; to map IP to ASN, and therefore figure out the top N spam-emitting ASNs worldwide.  it&#8217;s then possible to map ASN to network name.  reverse DNS can help here too, of course.</p>
<p>In other words, there&#8217;s *both* an IP blocklist, and an informational, &#8220;these are the world&#8217;s spammiest networks&#8221; page for PR and public pressure.</p>
<p>BTW, there&#8217;s a lot of best-practice guidelines from the email spam world, and we can definitely give advice where it may be useful <img src='http://www.annelisabeth.com/blog/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' /><br />
I&#8217;m the original author of SpamAssassin, and we&#8217;ve just started a mailing list for blogspam discussion there &#8212; mail blogspam-subscribe /at/ spamassassin.apache.org to subscribe, if you like!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rob</title>
		<link>http://www.annelisabeth.com/blog/2005/01/28/name-and-shame/#comment-287</link>
		<dc:creator>Rob</dc:creator>
		<pubDate>Fri, 28 Jan 2005 19:32:08 +0000</pubDate>
		<guid isPermaLink="false">http://www.annelisabeth.com/blog/2005/01/28/name-and-shame/#comment-287</guid>
		<description>I like it and approve - but it's kind of unwieldy  - bots can shft faster than lists can follow unless youre willing to invest the time in a full on battle.

I dont know about the blogging engine you use but I've found in mine a flag that checks the referrer for the actual link to me -if theres no link - theres no entry in the referral log.

also - it seems that the user agent of this attack is unique - if you can look at the user agents in your web stats - look for

MSIE 6\.0; Windows NT 5\.2; \.NET CLR 1\.1\.4322\

meaning an agent running on  windows server 2003 - using the latest dot net updates
(or using the latest .net code in a script) - very odd to see someone hitting your site with a server OS----- very very odd to see servers leading your stats. - I've tracked it down to 4033 hits in the last couple months on mine - and the traffic pattern and usage all tell me the spammers are using a bot on this platform.

As of Today I've banned that User Agent in my htaccess file -  Since booting that user agent and checking if the site actually links to me - I have gotten zero logs in my referrer stats from abusive morons.

I think maybe rather than a list of abusers - you might want to think pro-active and just interrupt their google ranks by disallowing their attack.

After all it all comes down to google right ?


</description>
		<content:encoded><![CDATA[<p>I like it and approve - but it&#8217;s kind of unwieldy  - bots can shft faster than lists can follow unless youre willing to invest the time in a full on battle.</p>
<p>I dont know about the blogging engine you use but I&#8217;ve found in mine a flag that checks the referrer for the actual link to me -if theres no link - theres no entry in the referral log.</p>
<p>also - it seems that the user agent of this attack is unique - if you can look at the user agents in your web stats - look for</p>
<p>MSIE 6\.0; Windows NT 5\.2; \.NET CLR 1\.1\.4322\</p>
<p>meaning an agent running on  windows server 2003 - using the latest dot net updates<br />
(or using the latest .net code in a script) - very odd to see someone hitting your site with a server OS&#8212;&#8211; very very odd to see servers leading your stats. - I&#8217;ve tracked it down to 4033 hits in the last couple months on mine - and the traffic pattern and usage all tell me the spammers are using a bot on this platform.</p>
<p>As of Today I&#8217;ve banned that User Agent in my htaccess file -  Since booting that user agent and checking if the site actually links to me - I have gotten zero logs in my referrer stats from abusive morons.</p>
<p>I think maybe rather than a list of abusers - you might want to think pro-active and just interrupt their google ranks by disallowing their attack.</p>
<p>After all it all comes down to google right ?</p>
]]></content:encoded>
	</item>
</channel>
</rss>

