The most up-to-date database of spammy, malicious IPs & emails. Get geolocation & associated user details. Protect your site with Zero Spam. #WebsiteSecurity
Austin, TX
Joined July 2020
- Tweets122
- Following86
- Followers72
- Likes34
From November 20, Meta's updated commercial terms let it crawl websites tied to any business using its products, even a plain Facebook Page.
Meta's 5 crawlers, and which ones to block in robots.txt:
zerospam.org/meta-commercial…
PHP2Shell update: CISA has added both PHP flaws to its Known Exploited Vulnerabilities catalog, after a researcher's honeypot caught an attack succeeding.
What to update and how to check your server:
zerospam.org/php2shell-php-v…
Chrome now has a softer "suspicious site" warning, judged by Gemini, and asks every user before opening HTTP sites. Google hasn't said how site owners can dispute the new label.
6 checks for your site:
zerospam.org/chrome-suspicio…
Scammers put fake "Helpline" numbers in the address fields of real Dell and Staples orders, so the stores' own emails delivered them, passing DMARC.
If your forms email back what visitors type, here's how to close the gap:
zerospam.org/confirmation-em…
PHP2Shell update: Unit 42 reports a confirmed break-in at a government body in Europe. Within two hours, attackers had password hashes and MFA secrets.
If your server isn't patched yet, here's what to do:
zerospam.org/php2shell-php-v…
AI helped find PHP2Shell, and OpenAI expects similar findings to rise sharply. Cloudflare saw tens of thousands of attack attempts within 45 minutes of the news.
What it means for site owners:
zerospam.org/ai-found-vulner…
PHP2Shell update: PHP published an advisory for a related flaw, CVE-2026-115560, and suggests every server set session.upload_progress.enabled=0 until the next regular release, even if patched.
What changed:
zerospam.org/php2shell-php-v…
PHP2Shell: two critical PHP flaws let attackers run code on web servers without logging in, and attacks have started. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Who's at risk, who isn't, what to do (updated daily):
zerospam.org/php2shell-php-v…
Scamwise users report a never-before-seen fake store about every 3 minutes, many copying real brands and buying Google and Meta ads.
5 steps to find and report copies of your store:
zerospam.org/fake-online-sto…
Fake meeting invites reached 40,000+ organizations this fall, and they can sit on your calendar even when the email gets filtered.
The settings that stop it:
zerospam.org/stop-calendar-i…
Meta's Muse AI agent is filling in website forms from cloud servers, without saying it's an AI agent. In DataDome's sample, forms got 81% of its sensitive-page traffic.
5 decisions for your forms:
zerospam.org/meta-muse-ai-ag…
Microsoft disrupted Yam Store, a phishing marketplace tied to over one billion scam emails and texts. Some of its accounts reused names of organizations whose domains had expired.
5 checks for your domains:
zerospam.org/yam-store-phish…
A Ghostscript flaw (CVE-2026-39919) lets a crafted PDF corrupt memory when your server makes a thumbnail. WordPress sites that take PDF uploads should check.
How to check in 3 steps:
zerospam.org/ghostscript-cve…
Some Rank Math PRO 3.0.123 downloads from Oct 15-16 contained malware. If an affected copy was active, updating to 3.0.124 doesn't clean the site.
How to check when your copy arrived:
zerospam.org/rank-math-pro-3…
Some phishing emails now carry a second, hidden message for your AI assistant, like a fake vendor payment change in the summary.
How it works, plus 5 defenses:
zerospam.org/hidden-prompt-i…
Google now calls fake author profiles a form of deception: AI headshots, made-up names, false credentials.
What changed, plus 5 checks for your site:
zerospam.org/google-fake-aut…
Fake ChatGPT, Gemini and Meta Muse ad tools are phishing ad-account logins. The "Connect" pop-up is drawn inside the page, and a live operator asks for your MFA code.
5 checks for marketers:
zerospam.org/fake-ai-ad-tool…
Phishing was the way in for 23% of intrusions in Microsoft's 2026 Digital Defense Report, up from 7%.
What AI phishing means for site owners, plus 5 checks:
zerospam.org/microsoft-digit…
WordPress 7.1.3 fixes 7 security flaws. One is a stored XSS on the Comments screen, exploitable via pending comments.
Update, and don't click links in pending comments until you do:
zerospam.org/wordpress-7-1-3…
In Cloudflare, setting AI Training bots to Block also blocks Googlebot, and Google drops pages that return 403s.
How to check your site in 15 minutes:
zerospam.org/cloudflare-ai-b…
