I'm running a public wiki (MediaWiki) on a VPS from a hosting company (a2 hosting) and I'm using reCaptcha v2 to prevent spam content.

Recently, I've noticed spam articles that have slipped by. They are all advertising links to external websites, as per usual spam. What I've noticed is that the links to the websites have all been to websites hosted on the same hosting company to me. The IP addresses that the spam has originated from has been from all over the place and show no clear correlation to one another.

I can anticipate spam that would not be caught by reCaptcha, and I would expect them to seem to originate from all over the place. But the fact that they all advertise websites on the same hosting company would seem to me to be statistically unlikely: a2 hosting isn't one of the really big companies (I believe?) and this is approximately 10 incidents so far (about 1/day for the past week or so).

What's the explanation for this? Is this reCaptcha's algorithms failing or is the hosting company at fault for misconfiguring something?


Clarification: the sites being advertised are, I believe, hosted by a2 hosting since they are using the default a2 hosting name servers. That's not conclusive, but the mere fact that they all share the same nameservers is statistically unlikely. The websites are:

  • der maj oie cre am .com
  • tes toe dge .net
  • nut riv ano for sko lin .net
  • z-v ita l .com
  • pro hdg arc ini a .net
  • der man uix cre am .com
  • ket ope rfo rma nce plu s .net

They don't deserve any traffic, but you can check their whois records.

  • What did you find when you checked your logs? – Michael Hampton Nov 12 '18 at 18:08
  • The IPs are unremarkable -- probably bots. The content might have passed reCaptcha via human input, but names of accounts are mostly all formulaic: NameSurnameNumber. I don't know what else to see from my logs. What's unusual is that the content is advertising links all hosted by the same company – Zorawar Nov 12 '18 at 18:24
  • I don't see why that should be too odd. A2 hosting is a rather large web hosting provider. I don't know where you got the idea that it "isn't a big company". – Michael Hampton Nov 12 '18 at 18:29
  • Well, I'm guessing on number of websites hosted. They're not godaddy etc. I was make a statistical point... I'll emend the question – Zorawar Nov 12 '18 at 18:32
  • 2
    So why wouldn't a spammer host three sites at the same hosting company? Especially if it's one they compromised rather than purchased? Which, of course, they will do whenever possible. Your "statistics" are fatally flawed because they don't take into account how spammers actually operate. I can't tell you how they bypassed reCaptcha. But there's nothing strange about the sites being hosted at a2hosting. The thing to do is to report the spamvertised sites to a2hosting and so they can take them down (if they haven't already). – Michael Hampton Nov 12 '18 at 19:53

I think that @Michael Hampton has a point when he advises you to report the spamming activity to your hosting company. You should tell them all spam sites hosted by them that are being advertized on your wiki so they can take action resp. take these hosts down.

I would also send them a list of IP adresses from which spam has been placed on your wiki. With MediaWiki you could find them out by executing this query:

SELECT  r.rev_user_text AS IP, 
FROM revision r 
LEFT JOIN text t 
ON r.rev_text_id = t.old_id 
WHERE t.old_text LIKE '%http://der.com%'
OR t.old_text LIKE '%http://maj.com%'
OR t.old_text LIKE '%http://a.net%';

Maybe these are 'only' some spam bots, but maybe they know more about it or can scan their traffic for the addresses. You could consider to block the addresses afflicting your wiki, if those should not prove to be dynamic IPs.

  • Thanks. Of course, I will contact my hosting company and block the accounts and IP addresses (as I have done before). I just found this to be an interesting coincidence and wondered if there was something else behind it. I thought maybe there might be something funny going on with the hypervisor I'm on with a2 (unlikely though that seemed)? Perhaps this is just a fluke? I'll update the question over the coming days as I see more incidents and we'll see... – Zorawar Nov 12 '18 at 21:46
  • I won't discuss this further here and indeed, it's curious! Maybe those are some script kiddies havin' their warscripts directed to the ip block of a2. But serverfault is not a forum, it's all about you got a question, you get advice (hopefully ;-)). – digijay Nov 12 '18 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.