The spam is real

Mon Oct 26 22:03:39 UTC 2015

On 10/26/2015 3:25 PM, William Allen Simpson wrote:
> What's the exploit that corrupted the sites?
> ...
> All the sites that I checked (without the added suffix) seem
> legit.  But maybe they are spammer sites?  How do we know?
>

Most involve wordpress vulnerabilities that a spammer exploited, where 
the spammer then installed their spammy content on someone else's 
otherwise legit website. (other vulnerabilities happen too.)

NOTE: Anyone using wordpress need to be vigilante about keeping it 
updated (and associated plugins updated)!

That makes these particularly hard to blacklist because they always 
involve SOME amount of "collateral damage" (though often a small and 
well-justified amount) AND the same algorithms that help URI/domain 
blacklists to not have FPs, likewise often (and often mistakenly) 
prevent many of these from getting blacklisted... which explains why 
many of these were not on very many URI or domain blacklists.

-- 
Rob McEwen