In the control panel, the box with recent comments/tb entries does NOT show trackbacks. I received several nasty trackbacks and only the most recently commented entries show in this box. Along with the fact that there’s no search in the control panel, it makes finding these entries to delete the offensive trackbacks incredibly difficult.
I can confirm this. I can also confirm that there appears to be someone testing a rather nasty trackback spam script out there which has been slamming my blogs all afternoon. I got 15 trackbacks to one of my blogs in under 13 minutes which means they’re getting around the max trackbacks per hour feature. I’ve dashed off an email to Paul and Rick letting them now about this with a suggestion for a possibly quick way of at least making deleting the trackbacks easier. I’ve volunteered my time and effort to helping them devise a solution.
Wasn’t sure if anyone else had told them about this yet so I sent off an email just in case. They’re probably really aware of it by now.
Nope, not just you. Weblog name is A.M.? Entry title is some variant with the word ‘rape’ in it? Links to a rape story website that presents a 404 error if you try to go to it? IP address is all over the map as though it’s coming from completely different parts of the world? The entry excerpt is three or four words of text seemingly clipped at random making no sense at all?
If so, same guy. All of that leads me to think he’s testing out a new tool.
I just got hit too, though in my case for some reason the common thread seems to be ‘incest.’ I also got a lot fewer, perhaps in proportion to the relative popularity of my blog.
He’s hit my blogs repeatedly throughout the day. First URL was for a rape site, second was for an incest site and the third was for a beastality website. Just high quality content all the way around.
I have discovered one way to limit the damage. Go into the Weblog Management screen and edit the preferences for each of your blogs and change the Maximum number of allowed trackback pings per hour setting from whatever you have it set to (default is 5) to 1 and this will limit the number of spams that get through to one per IP address every hour. I did this and the last round of spam from this jerk was reduced to just 7 items split over two of my blogs. Three on one of them and four on the other. EE returns a message indicating the maximum number of pings has been reached for the hour and I’m thinking this guy’s script is watching for that message and then spoofing a different IP address to get around it. I noticed back when I had it set to five that I’d get five spams from the same IP before the IP address would change, lowering it to one puts a throttle on it.
Paul has sent me a modified trackback module to test which will cross-reference with the referer spam blacklist built into EE so any URLs in there will also be blocked as trackback spam. I mentioned this might be a good thing to do with comment URLs as well as an added layer of protection. Plus it’ll add two new tags for use in the notification email template: one to list the IP address of the originating site and the other to include a link to take you directly to the trackback deletion page from the email to make cleanup a snap. I’ve just tested it and the delete link doesn’t seem to be working quite right just yet, but once it’s available it should make life easier in this regard.
For the time being, though, lower how many pings you allow in an hour. Had I left mine set at 5 I would’ve cleaned up an additional 28 trackbacks this last go round.
Seriously, this is the first time I’ve ever experienced trackback spam. EE is a relatively new product: it’s only version 1.0 and it’s crammed with features that took years to develop on other platforms. Some things inarguably aren’t going to be implemented perfectly in the first release of a platform. Yes, the CP needs a search function. Yes, there needs to be a better way of listing entries, comments and trackbacks. Yes, there needs to be an eaiser way to make mass changes to entries. The team isn’t unaware of these issues and they are working on them, but they’re also being asked to get a gallery module out and a forum module out and a host of other things. Give them a chance to react to this.
Do you know why this idiot is doing trackback spam rather than comment spam? Because EE already has enough things in place to make trying to do comment spam a waste of time. You can’t put a captcha on a trackback though. Consider that the best solution to comment spam under MovableType was MT Blacklist and that wasn’t even a Six Apart creation, it was from Jay Allen who wrote it as a plugin. Six Apart’s big solution was to implement comment throttling and automatic IP banning which did little to nothing to stop the spam getting through.
Right now Paul has been hard at work to modify the trackback code so that it A) puts a link in each email that will take you DIRECTLY to the delete screen for the trackback in question and B) will cross-reference the Referrer Blacklist for URLs to block. He’s got it about half-working at the moment. Yes, it’s a pain, but it’s being addressed and we’ll move beyond it soon. Just lower the allowed number of pings for the moment to limit the damage done and hang in there for a little bit.
What Paul is putting together is sweet and will go a long way at making EE superior at handling trackbacks.
Does the Referrer Blacklist use wildcards? If not, I don’t think it’s going to make much difference since you can use a number of different iterations of a URL - they’re going to be switching the exact URLs like they switch IPs.
Thanks for pointing me in this direction Les. The solution being worked on sound good to me! I love the idea of having a link in the notification e-mail that brings me right to the delete comment/trackback page.
Lynda, I believe Paul mentioned someplace that the Referrer Blacklist now allows for URL fragments and checking it will show that the list downloaded from pMachine includes fragments like “-adult.” and “.adult-” and “casino” so I believe wildcards aren’t really necessary.
McGehee, don’t sweat it dude. I can certainly understand your frustration. It’s not like we didn’t go through something similar with comment spam under MovableType awhile back. It’s hard to anticipate these things ahead of time. Take comfort in the idea that you’re not alone and that there are folks working on the problem.
If you guys want to keep track of some of this information I’ve got a thread going on my blog that you’re more than welcome to keep track of. I’ll be updating it with information as I learn it. One of my commenters is also tracking IP addresses of open/anonymous proxies so you can make an Apache .htaccess file if you want to mass-block these things. Link is in the entry at my site.
I just tested and the Recent Comments/TB at the home page of the Control Panel *does* include Trackbacks. To test the new trackback file, I set up a completely new site and was only doing trackbacks and their entries were showing up in the box.
Everyone else -
If you want the new file *right now*, then send me an email and I will send it back. More or less, it is just checking the Blog URL for the trackback against the referrer Blacklist. It also has two new variables for the Trackback notification email {trackback_ip} and {delete_link} (must be logged in for this to work).
Well, when I receive a bunch of nasty trackbacks and look in the recent comments/tb box on the homepage, I only see the entries with the most recent comments. The entries with the most recent trackbacks are not displayed or mixed in or anything.
I can confirm that I’m seeing the same thing, Paul. None of the trackback pings I received from the spammer showed up in the recent comments listing for my blog.
