Trackback-Spam


 * 1) TrackbackSpammer raus! (WordPress User-Agents)

subnet[0]="62.213.0.0/21" subnet[1]="212.158.0.0/17" subnet[2]="217.23.0.0/20" subnet[3]="62.213.64.0/17" subnet[4]="212.24.32.0/19" subnet[5]="217.23.128.0/19" subnet[6]="212.158.160.0/20"
 * 1) 62.213.0.0 - 62.213.5.255  SAMTEL Network of the Samara Telegraph  RU
 * 1) 212.158.0.0 - 212.158.127.255 EU-EN-990217 Cable & Wireless Telecommunication Services GmbH  EU
 * 1) 217.23.0.0 - 217.23.15.255    PT-COFINA-20001004      IDCentre, S.A.  PT
 * 1) 62.213.64.0 - 62.213.127.255  RU-CARAVAN-20011109     PROVIDER        RU
 * 1) 212.24.32.0 - 212.24.63.255   RU-CARAVAN-990216       Provider Local Registry RU
 * 1) 217.23.128.0 - 217.23.159.255 RU-CARAVAN-20001005     PROVIDER        RU
 * 1) 212.158.160.0 - 212.158.175.255       RU-CARAVAN-990714       PROVIDER        RU

for spammer in ${subnet[@]} do       $IPTABLES -A INPUT -s $spammer -j LOG --log-prefix "* TRACKBACK SPAM * " $IPTABLES -A INPUT -s $spammer -j DROP done

To Do
[1] Set up a Webalizer for the Logfiles to find the most frequent trackbacking Blogs, trackbacked s23 Pages, User Agents, hostnames, IP ranges (mutante)

RU-CARAVAN seems evil

ranges from ipindex

related: trackback spam, iptables, Spam, Apache, Mediawiki, subnet calculator

Sorry for any false positives this might cause.