[typo] Typo 2.0.6 on Lighttpd and Textdrive

Jason Hoffman jason at jasonhoffman.org
Sat Jun 18 01:04:02 EDT 2005

On Jun 17, 2005, at 9:27 PM, Tobias Luetke wrote:
>> -dating spammers aren't too many, just about 10-20K a day textdrive-
>> wise.
> Holy $%^#!
> Do you have some statistics about the amount of spam you guys are
> getting? This sounds crazy!


For "web spam" (comment, trackback, forum, wiki ...), and across all  
the servers, there were 522,712 blocks over the last 24 hours (we  
parse it all audit data into remote audit logs and then into MySQL  
for an analysis that outputs a rbldnsd lists and mod_security rules;  
and run a few honey pots as well; this is how they're blocked).

The crazy thing is that it doesn't include the worse offenders  
anymore: about 2 weeks ago I wrote http://weblog.textdrive.com/ 
article/89/ and it was because last year we started our little  
"cspamhaus" project and started working with Tipping Point and the  
Planet to push the results of our pattern and header analysis into  
the Tipping Point appliances.

So the "poker" spammers still predominantly have 3 weird little  
signature headers that we found, and with both GET and POST blocks in  
the Tipping Point, it does a pretty consistent 400-500K blocks an  
hour (yes, that's half a million an hour; 1-5% are POST attempts).

It's believable, there are a couple good sized MT blogs that we've  
blocked almost 65,000 attempts a month (they --spammers -- literally  
hit every post > 4 weeks old, 2-3 times each and they do it everyday).

Email is still the worse though, in the last 24 hours, we've rejected  
1,118,952 incoming emails as spam.

I don't know. I still think this is nuts. I, for one, never realized  
the magnitude of the problem.

- Jason

More information about the Typo-list mailing list