Comments on: What Is This? A WordPress Attack Using “PLM”

By: Michael Clark

Michael Clark — Mon, 18 Aug 2008 18:11:10 +0000

I never found out what this was, but you need to track down “weird” things in your logs. Running your own site/server means you need to be a bit paranoid.

Comments on this post are now closed due to the insane amount of comment spam it is attracting.

By: Mike

Mike — Mon, 18 Aug 2008 17:10:52 +0000

I have heard that WP is not all that secure, but there is really not contest between WP and Blogspot if you’re wanting true control.

I’m wanting to know: Did you find out what this was, an attack or what? I ask because I see weird things in my logs sometimes and I never know whether to be suspicious or if I’m just paranoid. Please update if you can

By: Sriki

Sriki — Mon, 18 Aug 2008 07:30:22 +0000

Is blogger more secure than wordpress? I always prefer blogger.Now the latest improvements to blogger is amazing.Thousands of free inbuilt gadgets and a brand new look to dashboard.What else do you need.Remember it’s all FREEE!!

By: Annie Keys

Annie Keys — Mon, 18 Aug 2008 03:01:44 +0000

Jason there are a lot of reasons not to use blogspot depending on what you are trying to accomplish and the flexability you would like to have in your blog. If neither of those matter to you and you just want to write about getting up early in the morning and drinking your coffee, then you have nothing to worry about. Go ahead and use blogspot otherwise you might want to consider using WordPress.

By: jason

jason — Sat, 19 Apr 2008 21:33:32 +0000

Wow another wordpress attack? Why not just use google blogspot?

By: David Kaspar

David Kaspar — Thu, 10 Apr 2008 11:20:55 +0000

I got this recently as well, you are first on Google for PLM 😉

The referrer is simpy URL encoded, you can use http://meyerweb.com/eric/tools/dencoder/ to decode it.

I am pretty sure it is an automated way of submitting spam. There must be an error in the configuration because it should not leave such a juicy trail in the referrer field!

First it tells some script to get an URL, then it instructs to post to an URL (it is easy to block spam that POSTs directly without getting first).

The numbers could be relating to what spam message(s) to post (think of it as indexes in a spam DB).

The qeustion is, can we block it easily with RewriteCond %{HTTP_REFERER}?