re: [development] My site is under attack (trackbacks, spam and cpu usage).
When we initially converted our site to Drupal, we were getting lots of spider hits on old URLs, and I put into our .htaccess rewrite rules based on http://drupal.org/node/53523 These redirect to "GONE", rather than using "access denied". Maybe not any more helpful for a spambot, but any legit bot should get the hint. example: #some rules to block requests for old pages from search engines RewriteCond %{REQUEST_FILENAME} !-f RewriteRule .*\.htm$ - [G,L] I also like the idea of redirecting to the loopback address- does that really work? -Peter Date: Mon, 18 Sep 2006 11:14:49 +0800 From: "Augustin (Beginner)" <drupal.beginner@wechange.org> Subject: [development] My site is under attack (trackbacks, spam and cpu usage). To: development@drupal.org Message-ID: <200609181114.49182.drupal.beginner@wechange.org> Content-Type: text/plain; charset="us-ascii" Hello, I am curious: is anyone using the trackback.module and allowing incoming trackbacks? Spammers have a vicious script designed for Drupal, that submits spam trackbacks in a loop, every few minutes, 24/24h.
These redirect to "GONE", rather than using "access denied". Maybe not any more helpful for a spambot, but any legit bot should get the
Yes, they wouldn't be - spambots never check their return values, which is why my... "malicious" redirection of traffick back to them only serves to waste their traffic attempting to POST data at themselves. For what it's worth though, you really should have put in aliases for all your old URLs. Linkrot is the devil, and I fault you for it.
I also like the idea of redirecting to the loopback address- does that really work?
Yes - hit http://www.gamegrene.com/trackback/ and your browser will attempt to load http://127.0.0.1/. Now, the question is: do these spambots actually /follow/ redirects. That, I can't answer - I do know, however, that a redirect is far smaller in traffic and processing time than a 404, 403, or what have you. -- Morbus Iff ( whooooooo's hoooouuuuuse? ) Technical: http://www.oreillynet.com/pub/au/779 Culture: http://www.disobey.com/ and http://www.gamegrene.com/ icq: 2927491 / aim: akaMorbus / yahoo: morbus_iff / jabber.org: morbus
participants (2)
-
Morbus Iff -
Peter Wolanin