We have experienced a “massive attack” of SPAM on our blogging system from various hosts all pointing to two websites:
http://www.cosmicbuddha.com/blog/archives/ 001169.html (I have broken the URL intentionally)
And
http://anthony.ianniciello.net/blog/archives/ 000079.html (I have again broken the URL intentionally)

The comments contained very brief sentences and links to the above web sites.

From what it looks like it was an act of an attack against automatic blacklisting and un-moderated comments, probably not conducted by authors’ of the above blogs.

Some of the IPs that have SPAMed our Blog contained at least one port that was acting as a proxy.

In some cases legitimate but badly configured proxies, such as in the case of a Cisco proxy (Application and Content Networking System Software 5.3.3).

In other cases the proxies were what appeared to be backdoor based proxies - the server’s/computer’s intent was not to act as a proxy.

In two instances the IP from which came the attack was the firewall/router, making me believe that the infected/zombie host was on the inside of the network, rather than on the outside.

I one of the more funny instances, the host that SPAMed us was a Windows NT with IIS 4.0 without any service packs, I was sure I would never see such a machine on the Internet, but I was shown to be wrong .

In any case if we do find out a bit more on this SPAM attack, we will let you know.

-

Is your site safe from SQL Injection? Use Active Network Scanning to protect your network!