Web logs, dealing with bots, and an AutoHotKey tip

I've written about my site’s log files before, noting some strange activity and popular search terms. Every time I check my log I find attempts to break into an admin area on my site or to post something, even though I don’t allow comments on my blog. Sometimes I take time to add offending IP addresses to a blacklist, although that’s like trying to plug a leak in a dike.

One such log entry that caught my eye today was one from someone looking for the page “/blog/tag-Whining Goto: Forum List "Attach a file ..." illumination&ct=clnk.” I do have a Whining blog tag but there’s no place on my website where people can attach files. This entry came from 192.69.90.198, which belongs to volumedrive.com, which seems to host a lot of spambots.

Another log entry was from 192.119.154.162, an Avante Hosting Services address assigned to Ryan Wilson. This entry had POST data for a spammy comment (“Me and my neighbor were just preparing to do a little research about this. We got a grab a book from our area library however I think I found out more clear from this post.”). I won’t include the URL but will mention that it was for a domain that is not even registered. Perhaps this spammer was just testing to see if a comment would go through, although a quick glance at this site would show that there are no comments.

Another set of interesting log entries were from IP addresses 95.160.18.178 and 95.160.105.174, both of which belong to the Polish cable company Vectra. Someone from Poland wanted to log into my website’s WordPress admin page but wasn’t able to. If you’d like to try, visit http://www.davidlauri.com/wp-login.php. Why don’t I care if you try to get into WordPress on my site? Because WordPress isn’t installed on my site. I do have a WordPress login page, but it’s just a dummy page I set up after I realized people were trying to hack into WordPress here. I don’t doubt that there are hackers who could get into WordPress if I had it installed, which is why they look for it, but it’s not really here to be found.

I used to block unwanted IP addresses using my site’s .htaccess with rewrite lines like:

RewriteCond %{REMOTE_ADDR} 192\.119\.154\.162
RewriteRule .* - [F]

but a couple years ago I switched my site’s DNS to CloudFlare, which blocks a lot of abusive bots and crawlers automatically and also makes it much easier to block additional IP addresses, either individually or by entire ranges (e.g., 95.160.18.0/24). CloudFlare offers free and paid accounts, but the free account’s been sufficient for my needs and has drastically reduced the amount of hits on my site from bots, although some, like the ones mentioned above, do still get through.

Images used in AutoHotKey macro I visit CloudFlare about once a week to block some more IP addresses. That’s often enough that I wrote an AutoHotKey macro so that I can press F1 on CloudFlare’s threat control page to activate the IP address field and then F1 again to click on the block button. If you have AutoHotKey, you can copy the macro below (click on the to expand it). You’ll also need to copy the two images to the right.

 myImageSearch(ByRef X, ByRef Y, X1, Y1, X2, Y2, options, image) {

myImageSearch(ByRef X, ByRef Y, X1, Y1, X2, Y2, options, image) {
  ; search for an image and exit gracefully if there's an error in the search
    optionsandimage := options . " " . image
    ImageSearch, X, Y, X1, Y1, X2, Y2, %optionsandimage%
    if (ErrorLevel = 2) {
      ; problem with the search
      MsgBox % "Error conducting image search: " X ", " Y ", " X1 ", " Y1 ", " X2 ", " Y2 ", " optionsandimage
      return -2
    } else if (ErrorLevel = 1) {
      ; just haven't found it yet
      return 0
    } else {
      ; found it
      return 1
    }
} ; end myImageSearch

$F1::
WinGetTitle, Title, A
if ((substr(title, 1, 14) = "Threat control") && (substr(title, -6) = "Firefox")) {
  ; make F1 the shortcut for the custom rule IP address field and the custom rule block button (depending on which is available)
  
  ; get window's width and height for image search
  CoordMode, Pixel, Relative
  CoordMode, Mouse, Relative
  WinGetPos, Xpos, Ypos, Width, Height, A
  
  ; first look for a blank IP address field (actually we're going to look for a greyed out block button)
  searchresult := myImageSearch(X, Y, 0, 0, Width, Height, "*10", "cloudflare-greyblock.png")
  if (searchresult = -2) {
    ; problem with the search
    CoordMode, Pixel, Screen
    CoordMode, Mouse, Screen
    return
  }
  if (searchresult) {
    ; found it, so click on it (to the left a ways because we actually searched for the block button)
    ; MsgBox, Found it at %X% %Y%
    MouseClick, Left, X - 100, Y + 5, 1, 0
    CoordMode, Pixel, Screen
    CoordMode, Mouse, Screen
    return
  }
  
  ; next look for red block button
  searchresult := myImageSearch(X, Y, 0, 0, Width, Height, "*10", "cloudflare-redblock-part.png")
  if (searchresult = -2) {
    ; problem with the search
    CoordMode, Pixel, Screen
    CoordMode, Mouse, Screen
    return
  }
  if (searchresult) {
    ; found it, so click on it
    ; MsgBox, Found it at %X% %Y%
    MouseClick, Left, X + 5, Y + 5, 1, 0
    CoordMode, Pixel, Screen
    CoordMode, Mouse, Screen
    return
  }
  
  MsgBox, Unable to find CloudFlare fields %searchresult% - %width% - %height%
  CoordMode, Pixel, Screen
  CoordMode, Mouse, Screen
} else {
  Send {F1}
}
return

Proven SEO Stategy and SEO Results

From: Jane R. Villarreal info@janervillarreal.mygbiz.com
To: David Lauri david@davidlauri.com
Date: Wednesday, July 24, 2013 5:02 AM
Subject: Proven SEO Strategy and SEO Results
Hi,

While doing some research on your industry I have come across your site www.davidlauri.com and decided to run an analysis on your competition and your current search rankings. I’m very impressed with your company, but there are some real opportunities for growth that you currently are missing.

Would you like to understand several strategies used for Search Engine Optimization (SEO) which have lead to better traffic, driving higher sales, increased leads and more revenue! We are rated as one of the top SEO and digital marketing companies in the US. In 20 minutes I can show you how to fuel your brand and generate more revenue from search engines and social networks.

All I’d like to do is follow up this with a quick phone call and see if we can arrange a time where you can see how this works online in real time. Can I call you this week to discuss your campaign?

Thank you
Best regards,
Jane R. Villarreal
2719 Romrog Way, Grand Island, NE 68801.

I get shit like this all the time, both regarding my personal website and my employer’s website. Someone must actually pay for SEO services from “top SEO companies” who send out SPAM like this, because these SPAMmers wouldn’t do this if they didn’t earn any money from it, but really, how stupid are the people who respond to these emails?

As you already know, davidlauri.com is not the website for a business. I don’t have any competitors. And my website is already the top search result for my name.

But these SEO SPAMmers don’t care. They just know I have a website and that david@davidlauri.com is my email address. (Yes, yes, if I really cared, I’d try to hide my email address, but it’s been out there a long time, and Gmail has pretty good SPAM filters, though one or two SEO SPAMs do get through every day or so.)

A funny thing about SEO SPAM is that for my employer the SPAM is addressed to our “info@xxx.xxx” address. If these SEO SPAMmers cared about any pretense, they’d at least look at our staff listing to figure out who’s responsible for our website (hint: me).

Earlier this week I found out that SEO SPAMmers also try to pitch their services via cold calls. Our receptionist let such a call get through to me. Usually she’s pretty good about screening calls, but this time someone asked to talk to whoever was in charge of our website, and our receptionist just transfered the call. An Indian woman launches into her spiel after first asking if I was in charge of our website. I said no thanks and hung up on her.

Here’s the deal: If you can’t find out from the info on our website who is in charge of our website, you’ve no business talking to the person in charge of our website.

Besides which anyone who pays for SEO services is stupid.

They succeed, at sending SPAM

Back in February I got two emails from Jessica Walters of WeSucceed Solutions.

Jessica’s first email was to ask to speak with me about how WeSucceed could assist me with Microsoft Office SharePoint 2010 (MOSS 2007 & SharePoint 2010), Custom Application development using .NET, and Quality Assurance and Testing services. I ignored this email because my employer doesn’t use SharePoint or .NET.

In Jessica’s second email, she said, “I am following up with you on the below email send [sic] to you on Wednesday” and that she would like to “share our success stories and value adds we could bring forth working with you.”

Um, yeah, I’m not really interested in hearing about “value adds,” thanks.

I sent Jessica a reply, saying that we didn’t use SharePoint or .NET and that we weren’t looking for any outside consultants. I got absolutely no reply, which was fine.

In April I got another two emails, this time from Sandra Phillips. The first was an exact duplicate of Jessica’s first message, and the second was also a duplicate of Jessica’s followup message, including the typo of “below email send to you on Wednesday” (see “[sic]” above).

Late last month and then today I got another set of these same two exact messages again from Sandra.

I’m taking the same action I took the last time I got ongoing SPAM from a company wanting my business:

1. Setting up a Gmail filter to delete all messages from the SPAMming company.
2. Writing a blog post to let people know about company’s SPAMmy practices

Ineffective SPAM

Ring, ring! Pick up the clue phone, RingCentral! RingCentral won’t leave me alone.

On May 6th, Bryan McDonald sent me the following email:

I am doing some research on your company to determine if there is any interest in a cloud business phone system. Your business will benefit from more control, more features and 50-70% lower telecommunications costs.

Fair enough. Technically, because this is unsolicited email, it's SPAM, but it didn’t seem outrageous, so I sent a short reply:

We already use 8x8 for our phone system and have no interest in switching.

So I was a bit annoyed when Bryan McDonald sent another message on May 9th, saying, “Just following up on the last email I sent you about your business phone system.” Yeah, if you’d actually read my reply, you wouldn’t have needed to send a followup message.

So I filled out RingCentral’s online contact form (no use replying to Bryan McDonald), saying again that we weren’t interested in switching from 8x8.

I got a reply back from Rheychelle N, apologizing and saying, “we assure that we will inform Brian McDonald or other account representatives not to contact you anymore.”

Today I get an email from Jenny Lindgren. Surprise, surprise, the email has the exact same text that Bryan sent.

I am doing some research on your company to determine if there is any interest in a cloud business phone system. Your business will benefit from more control, more features and 50-70% lower telecommunications costs.

Um, no. Just no. I’ve set up a filter to automatically delete any messages from anyone at ringcentral.com, which is what I should have done in the first place.

And I’ve also written this blog entry, so people searching for info about RingCentral will know what kind of marketing practices they endorse (hint: the kind that guarantees that people won’t want to deal with RingCentral).

Update 6/24/2013: Today Denny Merrow sent RingCentral’s standard boilerplate SPAM message to the finance director at the company I work for. We’re still not going to buy hosted VoIP services from RingCentral, even if they send their SPAM to each one of our employees.

Really out-of-date SPAM marketing lists

I just got an e-mail that made me laugh out loud, from someone working for roam4less.com.
Logo of a clueless corporation What made me laugh was the line, “I'm sure that  The Mazer Corporation 's executives are looking for ways to reduce IT costs and diminish international cell phone roaming charges.”

Logo of a dead corporation Two problems with this e-mail from roam4less.com:

1) I haven’t been concerned with reducing IT costs for the Mazer Corporation for about ten years now.

2) No one at all at Mazer has been concerned with reducing IT costs or anything since the company abruptly shut its doors the last week of 2008.

Looks like the folks at Roam4Less need better marketing intelligence.