Big increase in spammer count since ugrade.

WassUp Forums » WassUp Bug report

Big increase in spammer count since ugrade.

(2 posts) (2 voices)

Started 1 year ago by dougweb
Latest reply from helene

Tags:

false spam

dougweb
Member

I've noticed in a huge increase in the number of spam/hacker items since the latest upgrades. Google referrers seem to be one of the biggest:

* Visit type: Spammer/Hacker
* IP: 66.249.72.173
* Hostname: crawl-66-249-72-173.googlebot.com
* Url Requested: /2010/12/multiple-crashes-close-i-270-near-frederick-montgomery-county-line/index.php?wpgb_public_action=query&visit_delta=-1&closed=&logged_in=&referrer=&url=http%3A%2F%2Fstopthemud.org%2F2010%2F12%2Fmultiple-crashes-close-i-270-near-frederick-montgomery-county-line%2F&title=Multiple%20crashes%20close%20I-270%20near%20Frederick-Montgomery%20county%20line%20%7C%20Stop%20the%20Maryland%20Unsafe%20Driver
* Referrer:
* User Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
* Wassup ID: 30aad0055a0b8e9ecc0b67ddee4379c8
* End timestamp: 2011-01-07 15:14:22 ( 1294413262 )

The above is a googlebot suspected of hacking and the next appears to be a user referred by a Google search:

* Visit type: Spammer/Hacker
* IP: 199.15.184.2
* Hostname: 199.15.184.2
* Url Requested: /2010/11/maryland-state-police-new-move-over-for-public-safety-law/
* Post/Page ID: 2267
* Post/Page Title: Maryland State Police: New Move Over for Public Safety Law
* Referrer: http://www.google.com/search?hl=en&source=hp&q=NEW MARYLAND DRIVERS LAW FOR PASSING STOPPED POLICE OFFICER&btnG=Google Search&aq=f&aqi=&aql=&oq=&gs_rfai=
* Search Engine: Google Search: NEW MARYLAND DRIVERS LAW FOR PASSING STOPPED POLICE OFFICER Page: 1
* User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
* Browser: IE 7
* OS: Win2003
* Locale/Language: us
* Wassup ID: cd7865fae496917d1b970dab3c76873b
* End timestamp: 2011-01-07 14:02:45 ( 1294408965 )

This appears to be a user:

* Visit type: Spammer/Hacker
* IP: 68.57.101.253
* Hostname: c-68-57-101-253.hsd1.va.comcast.net
* Url Requested: /index.php?wpgb_public_action=query&visit_delta=-1&closed=&logged_in=&referrer=http%3A%2F%2Fwww.google.com%2Furl%3Fsa%3Dt%26source%3Dweb%26cd%3D4%26sqi%3D2%26ved%3D0CDEQFjAD%26url%3Dhttp%253A%252F%252Fstopthemud.org%252F%26rct%3Dj%26q%3Djan%25201%25202011%2520vehicle%2520crashes%2520md%26ei%3DSk0nTd_oI8KB8gaOx-jsAQ%26usg%3DAFQjCNFcUFM2pNHvP2tS4dEylQa6M4pWlw&url=http%3A%2F%2Fstopthemud.org%2F&title=Stop%20the%20Maryland%20Unsafe%20Driver
* Referrer: http://stopthemud.org/
* User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
* Browser: IE 8
* OS: WinXP
* Locale/Language: us
* Wassup ID: e40f9b443713f2327c481961d8fa3ce7
* End timestamp: 2011-01-07 13:33:15 ( 1294407195 )

/index.php?wpgb_public_action=query(...)le=Stop the Maryland Unsafe Driver Referrer: From your blog
Hostname: c-68-57-101-253.hsd1.va.comcast.net

* Probably hack attempt!

* User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)

* us OS: WinXP
* BROWSER: IE 8

* 13:29:35 ->/index.php?wpgb_public_action=query&visi(...)/&title=Stop the Maryland Unsafe Driver
* 13:30:14 ->/page/2/index.php?wpgb_public_action=que(...)yland Unsafe Driver - Part 2 – page 2
* 13:31:02 ->/2011/01/one-dead-in-i-95-crash-near-washington-beltway-baltimore-sun/
* 13:31:06 ->/2011/01/one-dead-in-i-95-crash-near-was(...)e Sun | Stop the Maryland Unsafe Driver
* 13:31:41 ->/2010/06/one-dead-one-critical-in-single(...)alvert-southern-maryland-headline-news/
* 13:31:45 ->/2010/06/one-dead-one-critical-in-single(...) News | Stop the Maryland Unsafe Driver
* 13:32:01 ->/page/2/index.php?wpgb_public_action=que(...)yland Unsafe Driver - Part 2 – page 2
* 13:32:34 ->/2011/01/police-are-on-the-prowl-this-new-years-eve-colesville-md-patch/
* 13:32:39 ->/2011/01/police-are-on-the-prowl-this-ne(...)Patch | Stop the Maryland Unsafe Driver
* 13:32:59 ->/2010/06/man-guilty-in-fiery-fatal-crash(...)-www-hometownannapolis-com-the-capital/
* 13:33:05 ->/2010/06/man-guilty-in-fiery-fatal-crash(...)ital) | Stop the Maryland Unsafe Driver
* 13:33:15 ->/2011/01/police-are-on-the-prowl-this-ne(...)Patch | Stop the Maryland Unsafe Driver

I have over 90 spam and hack attempts shown which probably are NOT spam and hack attempts.

Posted 1 year ago #
helene
Moderator

The 1st and 3rd items were erroneously detected as hack attempts because of the parameter 'visit_delta=-1' in the request URL. The 2nd item was probably a return visit from a previous spammer.

The use of negative numbers in the URL query string is a classic hacker tactic to break into MySQL databases. This looks like something the GreetBox plugin has added to your URL and should be changed by that plugin author because it is like an exploit.

You can stop WassUp from recording these as hack attempts by disabling the option, 'Record admin break-in/hacker attempts' (uncheck it) in Wassup-Options>>[Statistics Recording] tab. This turns off all 'hack' detection, but that is what you need to do to use WassUp 1.8.1 with your current WP setup.

-Helene D.
http://techfromhel.webege.com

Posted 1 year ago #

RSS feed for this topic

Reply

You must log in to post.