jhardin at impsec
Nov 16, 2009, 10:27 AM
Post #2 of 4
(663 views)
Permalink
|
On Mon, 16 Nov 2009, Kenneth Porter wrote:
> I've been seeing pill spam with lots of identical URIs pointing at
> feedproxy.google.com over the last week or two. All the URI's seem to be
> this (leading http slash slash removed):
>
> feedproxy.google.com/~r/CraigslistHoustonAllForSale/WantedSearchquothealthquot/~3/3yX2enlGlyE/
>
> I've no idea where to report this. Going to the root of Google's site
> reveals no abuse report links.
Can't help with reporting it to goog, but this has been in my sandbox for
a bit. It might help:
rawbody __FEEDPROXY m;http://feedproxy\.google\.com/;
tflags __FEEDPROXY multiple
meta MANY_GOOG_PROXY __FEEDPROXY > 5
describe MANY_GOOG_PROXY Many Google feedproxy URIs
It has to be a rawbody rule because uri rules collapse multiple hits on
the same URI.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
A well educated Electorate, being necessary to the liberty of a
free State, the Right of the People to Keep and Read Books,
shall not be infringed.
-----------------------------------------------------------------------
38 days since President Obama won the Nobel "Not George W. Bush" prize
|
