The tactic of using .htaccess to shut out spammers has been widely successful, but not entirely. One spammer has somehow gotten through the block, and has attempted to spam this site 534 times in the past one week. Persistent little cockroach. Thank goodness for MT Blacklist.

I still haven’t found a way to deal with the other scumwads, namely referral spammers. Tried to do an htaccess script on them as well, blocking access to anyone coming from a certain URL, but for some reason the script made the site invisible to me, and I know I didn’t use keywords that are likely to be in my ISP’s URL. Anyone know about what to do about these spammers?

I can’t believe it, I got a one-shot solution to blog comment spam. At least for now…

I followed instructions laid out on other web sites to write an .htaccess file in the root directory–just a simple 4-line script in a text file uploaded to the main folder on my site, designed to block access to the Movable Type comment script file. And where I had been getting as many as a hundred spams per day, in the last four days I have gotten a grand total of two, both blocked by MT-Blacklist. Let’s hope it holds!

The script is available on the net, but if you’d like to know what it is (I’d rather not post it here) to use on your site, just comment (using any URL to block the email address from being visible) and I’ll email it to you.

Now to see if I can’t get rid of that blasted referrer spam…

So I’ve been trying a few new spam-fighting wrinkles before taking the plunge and going to MT 3.0. First of all, I started using a .htaccess file in the root directory with instructions to deny access to anyone trying to directly access the “mt-comments.cgi” script. We’ll see if that works.

I tried to include a few strings in the htaccess file with instructions to deny access to anyone with a referral from a domain with certain spam-worthy keywords, but for some reason it shut me out of the site (giving a “500 Internal Server Error”–anyone know why?), so until I get that worked out, it’ll have to wait. Very disappointing, I really wanted that to work. It was supposed to block referral spam; “IP Deny” in my site’s cpanel doesn’t seem to be working at all.

But I’ve also noticed a new wrinkle in referral spam: since August, the referral area on my stats page has been overloaded with referrals from ordinary blogs that appear not to have any links to me. All of these referral links end in “…mt-comments.cgi” or “…archives” after the blog domain. Before August, I used to get links like that (most noticeably from the Seattle Post-Intelligencer blog site), but they never hit me hard–I never got more than six or seven sites with referrals like that in any given month. Then in August, I got 38 with the mt-comments.cgi (92 with the “archives” one), and now, just three weeks into September, 142 with mt-comments.cgi (28 with “archives”).

After a search on Google, I found several other blogs which are experiencing the same thing–but nobody seems to be offering any explanation as to why.

The only thing I can figure is that maybe this is a quirk in a recent release of Movable Type version 3.x. But it doesn’t seem to be typical referral spam–only bloggers’ domains are affected.

Weird.

For some strange reason, every few months, the viewership of this blog tends to make a sudden jump. It just did it again, over the past few weeks–I’m now getting about 950 daily visitors on weekdays, and about 800 on weekend days, each up a few hundred per day over a month ago. The monthly total for September is likely to break 12,000.

At first I thought it was spammers, both blog comment spammers and referral spammers, and to be certain they have been on the rise–but they haven’t made that big a difference in the ‘unique visitors’ column. When the spam surged in June, the overall numbers did not.

It turns out that mostly the changes are from Google. Referrals from Google have, for some reason, doubled over the past few months, from over 4000 to over 8000, and that’s the only figure that jumped the same time overall numbers did. And it’s not search engines in general, but just Google.

Not that I am at all displeased–Google is the #1 search engine, and they have always sent more people my way than anywhere else. But it makes me wonder, why do these things happen so suddenly? What’s the equation? The only thing I can guess without research is that there must be thresholds involved; that if the total data on a site exceeds a certain amount, it gets ranked that much higher. And this blog’s archives are indeed getting rather thick.

In the past seven days, MT Blacklist (a program that stops blog comment spam for Movable Type blogs) has stopped no fewer than 1,400 blog comment spams from getting on my site–and another 100 got through the protection and had to be removed manually. That’s over 200 spams a day. This represents a rather significant surge in spam volume over previous levels.

I hate to do this, but next chance I get, I’m installing some sort of registration system–provided that they work. Anyone know if they do, or which system is best? I’d really like to stay with MT. I presume MT v. 3.0 would allow me to do that. Any advice would be appreciated.

It is pitiful to go around the web and look at blogs that are not cleaned out by their owners–their comment areas are a cesspool of spam. These people should just shut down comments altogether. They’re just making it worse for the rest of us.

I’m also getting a lot of referral spam, and they’ve evolved–IP Deny no longer blocks them out.

Spammers are the cockroaches of cyberspace. I don’t think anyone with a blog would disagree with that. Unless the blog is run by a spammer, of course. And even then…

The Expat is a second blog I keep up, this one collaborative; A Nagoya resident going by the handle “Yamantaka,” Sako Eaton and I all contribute there. Being a newer blog (half the age of BlogD), it doesn’t get as much traffic (about one third).

So imagine my surprise when I find CNN as the top referrer this week to The Expat. Following it back, I find myself mentioned by name in the second paragraph of their blog roundup:

Technorati’s Liberal Politics Attention Index&trade showed liberal bloggers reacting strongly to Arnold’s jabs at Democrats: Luis Poza described the speech as “full of sound and fury and signifying nothing.”

Go figure.

Still, only thirty visitors through the link, I guess not to many people read that page. Google sent 20 times that many people in the same time. Still, it’s nice to be recognized.

I have just successfully logged on to the Internet here in Shanghai. Ken’s personal DSL has been switched off for the vacation season, and I got a scare that maybe blogging would be difficult, as you cannot put USB Flash or a CD-ROM into the computers at the Internet cafe–so I’d have to come to a hot, smoky room full of people playing video games, and uploading photos would be impossible.

But fortunately, the people here are incredibly nice–and they allowed me to hook up my Mac (a platform apparently rare in China) directly to their network, with a tech guy typing in the IP addresses and everything. Got on the network no problem–and now I can upload a blog entry typed offline earlier in the day, as well as upload photos and check on my email accounts using Eudora, again for offline consideration if I want.

The lady in charge, a Ms. Ke (pronounced “Kuh”) just came over, and in her best English, welcomed me to the cafe and expressed a hope that I’d come every night–a definite possibility, especially if the Starbucks WiFi does not work out (and the closest Starbucks that has WiFi is an hour by train and bus each way, so…).

Still, the network here is slow. Ken tells me that any DSL around here can be relatively glacial (definitely much less than a megabit), and this cafe spreads the connection between a few dozen people. Just getting my email took ten minutes (though that was padded out by more than a hundred spam). That means that photo uploads from here may be pretty slow, so for the time being I can only append a precious few each time. I’ll post more when I get back to Tokyo.

Ken and I in Qingpu Village today.

My apologies for this site not being available over much of the past day. I am seriously beginning to think about looking for a new web host. First was Surpass Hosting’s major outage of a month or two ago–I got away with only 8 hours off the air, but some were knocked off for days. Just a bit more than a week ago they lost an entire domain of mine (not blogd, but another one), taking up to a day to get it back.

And then yesterday, they were knocked out by the hurricane–but it has become apparent that this was not necessary. They advertise redundant power supply, but claim it malfunctioned. And then, for some reason, that they had to take all the servers off line for three hours to do something else… and now (I am writing this during the blackout, you are seeing this many hours later) the site has been knocked out yet again, for several hours now–and they are still blaming it on the hurricane. Even though other web hosts in Orlando, also hit by the hurricane, managed to stay on line without any problems. I don’t know… I’ll probably give them one more chance, but I’m this close….

In the meantime, anyone know a good web host?

This site was down for a few hours just until now. The cause was Hurricane Charley hitting Orlando, Florida, where this site’s data center is located. Hopefully, we’ll be up continuously from now.

The site, that is. I just fixed a stylesheet problem that should make the blog and the right-hand sidebar display correctly. But each browser (especially Explorer) has its quirks, and a web page will display differently on different computers, on different browsers (with different versions), and with the monitor set at different resolutions.

Unfortunately, most people (60% of the visitors here) still use Explorer, despite its flaws and lack of features, even despite the security flaws that constantly pop up to the extent that experts have warned everyone not to use it at all (PC World comments, “It’s hard to imagine that anyone would continue to use Internet Explorer faced as it is with such massive security issues”). But Microsoft owns the desktop, and they put Explorer there, so people use it for no better reason that it’s the only one there. (Honestly, Mozilla / Firefox are far superior and easy as pie to download and install, from Mozilla.org.)

So most people use Explorer, but many use Mozilla/Firefox, a good number use Safari, and the rest use Netscape, opera and a few other odd third-party browsers. Some people have large monitors set to higher resolutions, some still use a 600 x 800 setting; some people use Windows PCs, and the rest of us use Macs. Which means that your web page has to be designed specifically to fit each and every one of those combinations.

This site will always be best-optimized for Mozilla/Firefox, but I try to make it fit as many conditions as possible.

So let me know: does the site display poorly for you? You should be able to see the sidebar at right, with the Linkboard, the “Best of” list, calendar and other links; all the text should be visible, not obscured or shifted askew, not unduly large or tiny.

If something is displaying wrong or poorly, please add a comment and let me know, and kindly include your platform (Mac or PC), OS version, the browser you’re using, the browser version, and if you know it, your screen resolution (e.g. 1280 x 854).

Your help is much appreciated!

Well, vacation is now fully underway for me, and so I took this opportunity to tweak the site a little bit. There are a few small cosmetic changes, like moving the calendar down below some other items on the right-hand sidebar on the main page (I don’t think many people ever use that), and the elimination of the calendar on individual entry pages (where the calendar never functioned anyway). The main addition, however, is The Best of BfAD.

This blog has gotten so big–766 posts as of this one–that surfing the main categories sometimes leads to a hundred or more posts coming down. It becomes harder and harder to find just the topic you might be interested in. And as much as I might like to think that every word I write is riveting, I am fully aware that a person going through these posts might find less of it as armchair-gripping as I might. Searching for exactly what you want is just fine, but you have to know what to search for. So I went through all 765 existing posts and found the ones that I thought were most noteworthy–133 of them in all, or nearly one in every six. The top 25 are now listed just below the linkboard on the right-hand sidebar. At the bottom of that list is a link to the “Best Of” special page, which lists all 133, categorized and summarized in a single line each.

After looking through all the political posts, I think I could probably paste them together into a book or something; it’s hard to believe I’ve done that much essay-writing on the topic. But they do hold the basic principles of my political ideology, and a lot of important facts and views that I think people should read, particularly before this coming election.

Other categories on the “Best Of” page include Japan Information & Resources, Audio/Video Posts, and Other Popular Posts.

Enjoy!

Although I started this blog about 15 months ago, it was last year, August 1st, that I last missed a day of blogging–which makes today the 366th consecutive day of blogging for me.

The blog will hopefully get cleaned up a little during my August break (working at a university has its perks, long vacations being one of them). Other BfAD news: while the four-month increase in viewership (which peaked in June) has slowed, the number of visitors is still growing and is now nearly double what it was in February. July had roughly 10,300 different people visit the blog (as the IP counts), with an average of 680 daily visitors downloading almost 7 GB of data.

The blog successfully made the transition from Myacen to Surpass Hosting without any hitches (despite a short outage a few weeks ago), and Surpass is so far doing OK. You have to stay with a host for 6 months to a year before you can really gauge their effectiveness, so we’ll see.

Otherwise, we’ve survived a barrage of blog comment spam and referral spam without yet resorting to requiring registration for commenting, and although “eyelid twitching” is still the most-searched-for term, the category “Reasons to Vote for Kerry” is right up there near the top, which means that people are looking at Kerry more–and “Bush” is not anywhere near the top of the search terms, despite the fact that I mention him almost every other entry. “Air America” fills out the top of the search list, as befits their good performance in the radio ratings.

Google sent 3,910 people to this blog this month, followed by Yahoo with 2,048, and MSN with 1,361. Among the more exotic locales from which visitors came are Latvia, Syria, Niue (huh? Oh, it’s in Polynesia), Lebanon, Belize, and the Cocos Islands.

Now for year two.

So I’ve been getting blog referral spam lately. Spammers fake a link from their page to my site so as to get listed in my referral statistics, so that in turn their page will be listed higher in the search engines.

Well, I just got a new one: a total of 1556 hits from a new page, all generated within the last 24 hours, as if a link on that page sent 1556 people to my own web site. One would think that this was a classic referral spam attack.

Except the hits are coming from the web site of the International Atomic Energy Agency (IAEA). I checked out their site, there’s no link to mine.

What the heck is that about?!?

When I look at the stats for any occurrence of the number “1556,” I find that one web host/ISP, ool-18b8e8a7.dyn.optonline.net, is listed with this exact number of hits. Sure enough, it’s a commercial site–but it is a legitimate ISP, a Cablevision site in the New York area (where the IAEA is located). Not your usual spammer. So probably they are not the culprits. Optonline.net gets no referral link, and I seriously doubt that the IAEA is spamming me.

This seems to make no sense. Does anyone have any ideas?

Update: I’ve found out a bit more about it now. Seems to be a malicious email-address-harvesting spambot. Swell. Apparently it’s been terrorizing sites for over a year now. Obviously it spoofs the referrer, and it seems that the hacker who wrote it has either a weird sense of humor or a grudge against the IAEA.

See this page about how to block this bot and others like it.

Usually, when you get blog comment spam, the link given in the spam leads directly to the spammer’s advertising web site. That’s often the way you can identify blog comment spam. If the comment’s link goes to another blog, you tend to think it’s OK. But today I got spammed in a new way: the comment’s link leads to a blogspot blog–but when you go to that blog, it’s a false front, a blog filled with obscenities and links to the actual spam site. Fortunately, the comment in my site was easily identifiable as spam, from the email address given and the short, generic and unrelated content of the comment itself. Still, an interesting wrinkle.

I also just realized that I never gave a completely clear definition of “blog comment spam,” and such a definition may be hard to find. So here it is:

Many blogs allow visitors to leave comments. When leaving the comment, one may (or may be required to) leave one’s name, email address, and web site. When the comment is automatically posted on the blog, the web site given in the comment automatically becomes a link to that site. This is intended to allow people to see where the poster was coming from, or which site they want you to look at. Additionally, some blogs allow HTML coding in the comment, so that further links can be created within the comment text. This is usually allowed so that visitors can point to interesting new web sites.

Spammers take advantage of these allowances. Spammers want their own web sites to be widely advertised, but more importantly, they want their sites to show up as close as possible to the top of search engine listings. For example, if you go to a search engine and look for “real estate,” you will likely look only at the first several listings that pop up. So the spammers want to be at the top of that list.

But how do they do that? One answer is to get linked to. Google and other search engines keep track of how many other people’s web sites make links to your web site. After all, making a link to a web site usually involves a conscious decision and some effort on the part of that person; therefore, the more links there are to a web site, the higher chances are that this web site is a really good one, and the search engines bump up the site’s ranking. So the spammers know that if a zillion sites make links to theirs, they’ll be in spammer heaven.

And one way to get that done is blog comment spam. The spammer finds your blog. The spammer leaves a comment. The spammer leaves their web site address, which is automatically made into a link to their site. Presto! They get an ad posted on your blog and a link to their site which increases their ranking, hosted by you–and they didn’t even have to ask you!

Of course, writing real comments to thousands of blogs can be time-consuming and expensive. The first spams I got were hand-made, but the spammers soon tired of that. So they turned to automated scripts. Instead of having any one person sit down, search for blogs, and enter comments, they created software which would automatically scour the web for blogs, or more specifically for the parts of the blogs which create comments. These programs can find thousands of blogs quickly and efficiently. Once they find a blog, they leave an automated comment. Again, presto! Now within a day or two, you have thousands of links pointing back to you, and you are the Spammer King!

Of course, most bloggers despise such spam. They usually delete it on sight. And since automated programs usually cannot read a blog entry and reply intelligently like a human being, the comments they leave behind must be either (a) carefully generic, or (b) obviously spam. Some spammers are obvious, but most want to disguise themselves as real people so they won’t get deleted. They use a few tactics for this.

One tactic is to be complimentary and short. “Great blog! I really enjoy this one, and will be coming back to read it often!” Flattery will get you everywhere, right? Sometimes, it’s just “Great blog!” and that’s it. However, these comments can be easily caught. Most blogs will send all comments to the owner in the form of email, so they can be screened. Any blog comment which is not specific in answering the blog posting is suspect, and all one has to do is look at the link–and if the link is to “pornpornporn.com” or the like, then zap! Dead spam. So spammers disguise their links, too; they will leave an innocuous-sounding link, like “fuzzykittens.com” or something, but when you go to the given site, it immediately redirects you to a godawful porn site.

Bloggers fight back, using a variety of tactics; a popular one for those who use the “Movable Type” weblog software is called “MT Blacklist,” which automatically scans blog comments for offending or spamlike text or web site addresses. This software has blocked a couple thousand spam at least from entering my own site, and catches about 95% of what comes in. But as you can see from the top of this post, spammers are constantly finding ways around these defenses. And as much as we diligent bloggers are erasing the comments as soon as they appear, a large number of lazy or clueless bloggers do nothing, and so the spammers win–and are encouraged to redouble their efforts.

So if you run a blog, fight back.

When running a blog, one has to deal with the inevitable annoyance of spam. Not email spam–blogs don’t reveal your email address (unless you foolishly post it on your site). But blog comment spam will get you. Blog comment spam is when advertisers use automated software to pummel your blog with fake comments, usually in long-ago archived posts. The blog comment spam can be as innocuous as a single line of text (e.g., “Love your blog!”) with a link to the spam site, or it can be as obnoxious as a list as long as your arm, full of dozens or even more than a hundred links to spam sites, many or most of them obscene. The blog comment spam is primarily created by spammers so that your site will host one or many links to their site, thus improving their site’s search engine rating, better advertising their scummy business. Software add-ons like MT-Blacklist or comment registration sequences help stem the tide of spam.

As if that weren’t enough, now we have a completely new type of blog spam rearing its ugly head: “Referrer Spam” (sometimes called “referral spam” or “stat spam”).

Referrer spam is a fairly new phenomenon. I noticed it first in January, when, according to my statistics, a Paris Hilton site seemed to send 13 people to my site via a link from their site. Curious as to why they were linking to me, I cautiously checked them out (never by clicking on the direct link to their site in my referral logs, then they would see where I came from–instead, I copied the URL and pasted it into a new window). But their site had no link to mine. Puzzled, I set it aside and forgot about it–until March.

Then a Nude Celebrity web site seemed to send 12 people my way via an apparent link from their site, and again their site seemed to have no such link. Again, WTF? But I again dismissed it as an anomaly.

But then in April, my site was “visited” 156 times by a dating service, 125 times by another celebrity porn site, and 105 times by a generic porn site. That set off alarm bells, and I started looking into it more. And I found out what it was: Referral Spam.

So what is it? Referral spam is when spammers hit your site with a fake referrer (a “referrer” is the site which sent viewers your way via a link on that page). That is, they have an automated program “look” at your web site, while falsely telling your site that they came from the spammer’s web page. This is counted as a hit on your site, and is reflected in your web site’s statistics page.

So why do they do it? Well, first of all, it’s cheap and easy for them, so they’ll do it for even a negligible payback. But they do get a payback: a link to their site on your statistics page, or you clicking on the link to visit their site and maybe buying something, or–the holy grail for these scumwads–if your web site automatically displays your top referrers, they get a big, fat, free link on your main page, one that will increase their search engine standings and may get dozens or hundreds of people following the link on your site to their page. In other words, free advertising for them, at your expense.

So it benefits them just a little, but it annoys, inconveniences, and sometimes costs you–and will soon make all statistics for web pages completely useless. It’s annoying because when you look at your stats, you have to look at all those porn sites and other spam invade your numbers. It’s inconvenient because those hits are not “real” visits, and so in the total numbers, you’re not sure what’s real and what’s not. It costs you because sometimes these idiots will hit your site thousands of times, which takes up bandwidth, and that can cost money.

But most of all, we are just seeing the beginning of this. At the end of last August I got my first blog comment spam. Within 3 months, blog comment spam started getting too much to handle without MT Blacklist. And now, even with MT Blacklist, I am still having to manually delete several blog comment spams every day–and that’s after MT Blacklist stops dozens more each day, prompting me to look into establishing comment registration.

Following that model, we can expect referral spam to similarly explode over the next several months. Already, in just the first eight hours of July, out of 12 referrals to my site, 8 of them are from fake sites. And it’s not just the sites that throw 150 hits “from” one spam site, there are also a multitude of single hits. In addition, many of them are not identifiably from spam sites. You might get a couple of hits from “www.yourpetcrafts.com” (I just made that one up), a site that looks innocuous–but when you go to that site, it immediately redirects you to a heavy-duty triple-X porn site. Apparently, the porn and other spam sites are buying up innocent-sounding domain names so they can be set up as a conduit to the real–and more clearly offensive–spam sites.

The end game of this is that web site statistics will soon be completely meaningless. As the number of fake referrals from spammers starts to represent more and more of a web site’s traffic, it will be impossible to figure out how much of your web site hits are coming from spammers, and how many are real people visiting your site. Not that the spammers give a damn–it hardly costs them anything, and while the return for them is probably negligible, they would gladly make your life a living hell if they could get a nickel or two out of it.

These people have to be stopped.

Articles on this can be found at Wired News, Spyware Info, and M5 Computer Security, among other places.

Update (June 2005): FYI, referrer spamming has become devastating over the past year. In the month of May 2005, the top three “referrers” to my site were online gambling spammers; those top three referrers accounted for more than 4500 fake link visits to blogd.com. The next three referrers, also spam, also gambling sites, left another 3000 collective fake referrals. In fact, only one of the top 25 referrers was a legitimate site (http://blo.gs), and that was #21 on the list. The other top 24 “referrers” accounted for almost 10,000 false hits. Quite a progression from those first spammers leaving only a dozen fake hits almost a year and a half ago.

Techy-geeky admin stuff here, move along if you don’t care about such stuff…

My blog may have had an outage earlier today, depending on where you are dialing in from. The Domain Name Server is in transition, and while at work I have been getting the new site, at home I am getting the old site, which means that the transition of the domain name is incomplete. This is because not all ISPs update their domain name “phone book” at the same time, so some people looking for blogd.com will see this site, and some will see the old site–until all the DNS entries have been updated and everyone gets pointed here.

The outage would have been detected by those who saw the new site–which unfortunately did not latch on to the domain name fast enough, and was a dead link for perhaps several hours. Under my past web hosts, that kind of thing could potentially last for days, and if I wanted fast service I’d have to holler like the sky was falling–and I forgot that I was dealing with new people. So I hollered at the Surpass tech support people, who, within a half hour, had it all fixed. Those guys are good.

When everyone gets set up to look at the new site, I’ll start getting back to publishing photo stories. I have been avoiding them for about a month because of my bandwidth crisis–just a half dozen pictures every week would have sent me sailing past my bandwidth ceiling. But with 75 GB, 15x my previous limit, that should be no problem–heck, I might have to see if I can host some video or something!

Once Blogd gets settled down and humming along, I’ll be moving The Expat onto this account as an add-on domain, cutting the costs even more. It’ll muck up the stats a tad, but I figure I can live with that, at the tune of $50 a year less.

BlogD.com will be switching web hosts at some point over the next two days. Because of how DNS servers propagate, the change may be seen at different times by different computers. I will try to keep both sites mirrored so there will be no disconnect, but if you have any problems in that time, you’ll know why.

I’m switching from Myacen to Surpass (which I’ve blogged about before) because I’m scraping the ceiling on Myacen’s 5 GB bandwidth limit, and Surpass’ 75 GB limit offers some more headroom, not to mention some other reasons as well.

Here’s another interesting observation caught by checking the visitors logs for the site I run. Over at xpat.org, there were 43 hits on the site over the span of five minutes. Each hit came from a different IP Address, but they had a common cause: to try to find an automated email generation program on my site, so they could hijack it and send out thousands of spam from it.

Clearly they were all coming from the same sources, but just as clearly the IP Addresses were being faked, or “spoofed” in order to hide who was really doing this.

Here’s the list of addresses they attempted to access–all failed, because I don’t have a form mail script on that site:

/cgi-bin/email.pl
/cgi-bin/FormMail.pl
/cgi-bin/formtomail.pl
/cgi/FormMail.pl
/cgi-bin/ezformml.cgi
/cgi-bin/af.pl
/cgi/contact.cgi
/cgi-bin/form.cgi
/cgi-bin/mailto
/cgi-bin/mailer/mailer.cgi
/mail.cgi
/form-bin/deliver
/cgi-bin/contactus.cgi
/cgi-bin/referral.cgi
/cgi-bin/email.cgi
/cgi-bin/mail.pl
/cgi-bin/cgiemail/contact.txt
/cgi-bin/tellafriend.pl
/cgi-bin/mailto.pl
/cgi-bin/mail.pl
/cgi-bin/mailer.cgi
/cgi-bin/FormMail.cgi
/cgi-bin/tell/tell.cgi
/cgi-bin/mailer.pl
/cgi-bin/formmail.pl
/cgi-bin/sender.pl
/cgi-bin/feedback.pl
/cgi-bin/cgiemail/mailtemp.txt
/cgi/formmail
/formmail.cgi
/formmail/formmail.cgi
/contact.cgi
/cgi-bin/BFormMail.pl
/cgi-bin/npl_mailer.cgi
/cgi-bin/contact.cgi
/cgi-bin/mailform.cgi
/cgi-bin/mail.cgi
/email.cgi
/cgi-bin/asomail.cgi
/cgi-bin/chfeedback.pl
/cgi-bin/mailform.pl
/cgi-bin/tellafriend.cgi
/cgi-bin/formmail.cgi

These being, presumably, the common names for email generation scripts. Now just imagine that attack being levied against thousands of machines over the course of a day and you can imagine that they probably found a large number of the scripts–and are now gleefully hacking into them and sending millions of spam through them. Just a tiny peek into the world of spamming.

One positive point–they seem to depend on the form mail script being named the same thing–which means that if you give the script a random name they won’t find it.

Just passed the threshold… Alas, it was pro-Bush, conservative criticism of Michael Moore–but the comment wasn’t nearly as rabid or quick-fire as most such comments often are.

If you are at all interested in the blogging news and culture, you’ll want to read this story in TIME Magazine about the history and influence of the newest media.

Bloggers are unconstrained by such journalistic conventions as good taste, accountability and objectivity — and that can be a good thing. Accusations of media bias are thick on the ground these days, and Americans are tired of it. Blogs don’t pretend to be neutral: they’re gleefully, unabashedly biased, and that makes them a lot more fun.

But what’s this about not giving Wil Wheaton a nod?