Comments on: Spam Floods Pissing me off! http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/ Weblog Tools Blogging Tools Blog Thu, 20 Nov 2008 09:18:41 +0000 http://wordpress.org/?v=2.6 By: Avrila http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1161533 Avrila Sun, 10 Jun 2007 20:08:41 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1161533 I use Akismet and WP-Ban in combination by manually harvesting IP addresses from Akismet spam when I weed through for false positives every few days (used to be every couple weeks but it got overwhelming). I think I need something a bit stronger, but I don't want to lose the ability to gather and ban IP addresses since I've had some issues with mindless repeating spam from the same IP before. I don't have it as bad as some of you guys, yet, but my pagerank's pretty low...I shudder to think how it'll get as I get easier to find. I also have a running list of banned IPs available publicly if anyone's interested, on a page called "Wall of Shame" on the blog I gave as my URI. I use Akismet and WP-Ban in combination by manually harvesting IP addresses from Akismet spam when I weed through for false positives every few days (used to be every couple weeks but it got overwhelming). I think I need something a bit stronger, but I don’t want to lose the ability to gather and ban IP addresses since I’ve had some issues with mindless repeating spam from the same IP before. I don’t have it as bad as some of you guys, yet, but my pagerank’s pretty low…I shudder to think how it’ll get as I get easier to find.

I also have a running list of banned IPs available publicly if anyone’s interested, on a page called “Wall of Shame” on the blog I gave as my URI.

]]> By: Abazza http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1160611 Abazza Sun, 27 May 2007 20:06:09 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1160611 Seit wir Askimet benutzen ist das Thema eigentlich durch. Nur vereinzeln treten noch kleine Spammereien auf,... im Gegensatz zu Früher ist das allerdings verschwindend gering. Seit wir Askimet benutzen ist das Thema eigentlich durch. Nur vereinzeln treten noch kleine Spammereien auf,… im Gegensatz zu Früher ist das allerdings verschwindend gering.

]]> By: Wordpress 用家如何對付spam？ at Just another Sidekick… » Wordpress 用家如何對付spam？ http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1154538 Wordpress 用家如何對付spam？ at Just another Sidekick… » Wordpress 用家如何對付spam？ Tue, 20 Feb 2007 17:29:59 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1154538 [...] 其實這一浪的spam侵襲是國際問題。 Weblog Tools Collection在12月13日有這一篇：Spam Floods Pissing me off! Blogging Pro在12月11日有這一篇：Recent Spam on Blogging [...] [...] 其實這一浪的spam侵襲是國際問題。 Weblog Tools Collection在12月13日有這一篇：Spam Floods Pissing me off! Blogging Pro在12月11日有這一篇：Recent Spam on Blogging [...]

]]> By: Amadeo http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1052334 Amadeo Wed, 20 Dec 2006 01:46:54 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1052334 one of the blog I host on my server got more the 40 000 (yep, real numbers) of spam within the last week only, too often DoS style. Okay, akismet caught them, but it caused tremendous server load and provoked some [large] downtime. So, akismet caught them, but -after- it had been posted, so I needed to at least prevent the comments from being posted. After trying uncessfully some ip / hostname ban plugins, after tried bad behavior, I've tried the last option I'd never use before closing any comments: the did you pass math plugin. It a written captcha, that asks the user to solve a simple math problem (e.g. how much does 1 plus 1?) and the same day I went from 50 spams caught per minutes to.... 2 per day. It's really boring for visitors to do, I know, but hell it's working! http://www.herod.net/dypm/ one of the blog I host on my server got more the 40 000 (yep, real numbers) of spam within the last week only, too often DoS style. Okay, akismet caught them, but it caused tremendous server load and provoked some [large] downtime.

So, akismet caught them, but -after- it had been posted, so I needed to at least prevent the comments from being posted. After trying uncessfully some ip / hostname ban plugins, after tried bad behavior, I’ve tried the last option I’d never use before closing any comments: the did you pass math plugin. It a written captcha, that asks the user to solve a simple math problem (e.g. how much does 1 plus 1?) and the same day I went from 50 spams caught per minutes to…. 2 per day.

It’s really boring for visitors to do, I know, but hell it’s working!

http://www.herod.net/dypm/

]]> By: May C http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1048183 May C Mon, 18 Dec 2006 05:46:31 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1048183 I have BB, Akisimet and SK2 installed, and although it looks like BB is blocking the spam, I still seem to get some spam caught by Akisimet and SK2, which is disturbing. Previously, with BB, I didn't get any spam and this is troubling. Spam annoys me so much that even knowing that they're there raises my blood pressure. I just wished there were something else better out there. But at least, it seems that most of them are blocked. If there is a better contact form spam blocker, that would be so nice. I have BB, Akisimet and SK2 installed, and although it looks like BB is blocking the spam, I still seem to get some spam caught by Akisimet and SK2, which is disturbing. Previously, with BB, I didn’t get any spam and this is troubling.

Spam annoys me so much that even knowing that they’re there raises my blood pressure. I just wished there were something else better out there. But at least, it seems that most of them are blocked.

If there is a better contact form spam blocker, that would be so nice.

]]> By: ColdForged http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1041482 ColdForged Fri, 15 Dec 2006 18:17:18 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1041482 I recently <a href="http://www.coldforged.org/archives/2006/12/13/im-out-of-the-comment-taking-business/" rel="nofollow">blogged about this very thing</a> and I've actually taken the, for me, extraordinary step of simply turning off commenting at this point. I don't feel like getting booted by my host again and doing the host swap churn. I have a feeling the server load was mostly my fault, after further consideration. I've been working on a plugin to SK2 that takes the worst offenders, both IP and domain, and generate mod_security rules to block the IPs entirely and block the domains from appearing in POST requests. It had been doing quite nicely up until the fated day that I got hit with 10,000 POSTs in about 18 hours. My account got suspended and I disabled commenting as a result. What I realized after the fact was that I was still logging denials in the mod_security log... to the tune of just over 75M of logs. <em>That</em> is likely what pushed me over the server usage edge, so I'm tempted to keep working at it. I recently blogged about this very thing and I’ve actually taken the, for me, extraordinary step of simply turning off commenting at this point. I don’t feel like getting booted by my host again and doing the host swap churn.

I have a feeling the server load was mostly my fault, after further consideration. I’ve been working on a plugin to SK2 that takes the worst offenders, both IP and domain, and generate mod_security rules to block the IPs entirely and block the domains from appearing in POST requests. It had been doing quite nicely up until the fated day that I got hit with 10,000 POSTs in about 18 hours. My account got suspended and I disabled commenting as a result. What I realized after the fact was that I was still logging denials in the mod_security log… to the tune of just over 75M of logs. That is likely what pushed me over the server usage edge, so I’m tempted to keep working at it.

]]> By: Beth http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1041385 Beth Fri, 15 Dec 2006 17:15:12 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1041385 Earlier this week I was hit with over 1000 spam comments, all caught by Akismet and BB, but the issue still remains with blocking the IPs- it would be a tedious task to say the least to go in and blacklist 1000 different IPs- since none were from the same block. I deleted all without going through them and apologized to my readers if they commented and the comment never showed on the post and explained what happened. Luckily, no legitimate comment was caught and deleted. Earlier this week I was hit with over 1000 spam comments, all caught by Akismet and BB, but the issue still remains with blocking the IPs- it would be a tedious task to say the least to go in and blacklist 1000 different IPs- since none were from the same block. I deleted all without going through them and apologized to my readers if they commented and the comment never showed on the post and explained what happened. Luckily, no legitimate comment was caught and deleted.

]]> By: Michael Hampton http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1040441 Michael Hampton Fri, 15 Dec 2006 08:29:08 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1040441 And of course this blog for some reason decides my comment is spam... And of course this blog for some reason decides my comment is spam…

]]> By: Michael Hampton http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1040437 Michael Hampton Fri, 15 Dec 2006 08:28:26 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1040437 I'm actually on a blacklist which is floating around amongst the spammers, so not as many of them actually hit my sites as I'd like. So the fact that some spammer was running an overly aggressive bot was news to me, and I actually heard about it from one of my users. I've been testing some changes to Bad Behavior which should slow down such rapid-fire bots. Not by much, but maybe just enough. I should have the next release (and a fix for the Verizon Wireless issue) out in a day or two. I’m actually on a blacklist which is floating around amongst the spammers, so not as many of them actually hit my sites as I’d like. So the fact that some spammer was running an overly aggressive bot was news to me, and I actually heard about it from one of my users.

I’ve been testing some changes to Bad Behavior which should slow down such rapid-fire bots. Not by much, but maybe just enough.

I should have the next release (and a fix for the Verizon Wireless issue) out in a day or two.

]]> By: Quix0r http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1038737 Quix0r Thu, 14 Dec 2006 20:24:56 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1038737 I'm using a battery of spam-kicking plug-ins here: SK2, BB2, Akismet-SK2 plus my own CPR plug-in which prevents spambots sending their POST request to wp-comments-post.php by inserting a server-unique hash. I hope I'm not getting blacklisted when I'm trying to tell people why they can use it additionally... :-/ I’m using a battery of spam-kicking plug-ins here: SK2, BB2, Akismet-SK2 plus my own CPR plug-in which prevents spambots sending their POST request to wp-comments-post.php by inserting a server-unique hash. I hope I’m not getting blacklisted when I’m trying to tell people why they can use it additionally… :-/

]]> By: Mark http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1038692 Mark Thu, 14 Dec 2006 20:07:05 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1038692 azrin, that is an interesting idea. I will try and put something together and see if that works. Thanks azrin, that is an interesting idea. I will try and put something together and see if that works. Thanks

]]> By: Just a Sidekick…… » Blog Archive » Wordpress 用家如何對付spam？ http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1038683 Just a Sidekick…… » Blog Archive » Wordpress 用家如何對付spam？ Thu, 14 Dec 2006 20:00:58 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1038683 [...] Alex說受害者，都是使用icdsoft.com.hk的用家，不知是否有關連。 其實這一浪的spam侵襲是國際問題。 Weblog Tools Collection在12月13日有這一篇：Spam Floods Pissing me off! Blogging Pro在12月11日有這一篇：Recent Spam on Blogging Pro [...] [...] Alex說受害者，都是使用icdsoft.com.hk的用家，不知是否有關連。 其實這一浪的spam侵襲是國際問題。 Weblog Tools Collection在12月13日有這一篇：Spam Floods Pissing me off! Blogging Pro在12月11日有這一篇：Recent Spam on Blogging Pro [...]

]]> By: azrin http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1038534 azrin Thu, 14 Dec 2006 19:03:25 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1038534 Hey Guys. I used none of em, and seems that an effective way to block them is telling yr ISP off. I used to have LOADS,and they still do keep on trying, but at http://Marlindaradzi.com, where my wife puts up her recipes and all, a good trick is to require the index.php as the HTTP_REFERRER in order to pull up the WP-COMMENTS.PHP and other php scripts. Also, I made it a point to Spool my spam list from the b2Evolution list,which is updated hourly.(my daughter's site uses B2E). so, it basicly gets themselves killed off, and easy way is to deny eastern european ISP, or IP addresses from SERVERS or ISPS eq: 65.*-70.* unless they produce a user-agent,cos Googlebot too gets on nerves with private posts being published! Hey Guys.
I used none of em, and seems that an effective way to block them is telling yr ISP off. I used to have LOADS,and they still do keep on trying, but at http://Marlindaradzi.com, where my wife puts up her recipes and all, a good trick is to require the index.php as the HTTP_REFERRER in order to pull up the WP-COMMENTS.PHP and other php scripts.

Also, I made it a point to Spool my spam list from the b2Evolution list,which is updated hourly.(my daughter’s site uses B2E).

so, it basicly gets themselves killed off, and easy way is to deny eastern european ISP, or IP addresses from SERVERS or ISPS eq: 65.*-70.* unless they produce a user-agent,cos Googlebot too gets on nerves with private posts being published!

]]> By: Stephen http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037972 Stephen Thu, 14 Dec 2006 16:40:46 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037972 I use a variation on the Bad Behavior/ Spam Karma/ Akismet combo, in that I use Akismet via a plugin for Spam Karma. That of course only helps if the spammers are actually successfully posting to your blog, which you say is not happening... http://www.striderweb.com/nerdaphernalia/2006/10/if-spam-blockers-were-superheroes-this-would-be-the-jla/ It occurs to me... Would it be helpful to change the name of comments.php to something else? I would think a grep search/replace through all the WordPress files could swap that out for whatever you rename it to. Might this throw off some of the spammers who are just blindly hammering away at what they "know" is the comments function? Haven't tried, because I haven't needed to, but it seems this might help some.... I use a variation on the Bad Behavior/ Spam Karma/ Akismet combo, in that I use Akismet via a plugin for Spam Karma. That of course only helps if the spammers are actually successfully posting to your blog, which you say is not happening…
http://www.striderweb.com/nerd.....e-the-jla/

It occurs to me…
Would it be helpful to change the name of comments.php to something else? I would think a grep search/replace through all the WordPress files could swap that out for whatever you rename it to.

Might this throw off some of the spammers who are just blindly hammering away at what they “know” is the comments function? Haven’t tried, because I haven’t needed to, but it seems this might help some….

]]> By: Bob http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037924 Bob Thu, 14 Dec 2006 16:06:17 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037924 One thing that bears mentioning, if you have access to your firewall configuration, is that IP addresses can be assigned the DROP parameter as Mike commented above. A DROP will tell the firewall to not respond to the bot at all. Typically this works well for DOS type attacks because the server doesn't waste any overhead or bandwidth telling the bot that it's rejected. In fact, this often ties up the software on the spammers end because it's waiting for an http response that never comes. One thing that bears mentioning, if you have access to your firewall configuration, is that IP addresses can be assigned the DROP parameter as Mike commented above.

A DROP will tell the firewall to not respond to the bot at all. Typically this works well for DOS type attacks because the server doesn’t waste any overhead or bandwidth telling the bot that it’s rejected. In fact, this often ties up the software on the spammers end because it’s waiting for an http response that never comes.

]]> By: GaMerZ http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037895 GaMerZ Thu, 14 Dec 2006 15:45:52 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037895 I got a plugin which bans people from site by IP, http://www.lesterchan.net/wordpress/2006/09/26/wp-ban-100-beta/ I got a plugin which bans people from site by IP,

http://www.lesterchan.net/word.....-100-beta/

]]> By: Rich Boakes http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037883 Rich Boakes Thu, 14 Dec 2006 15:37:40 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037883 Howdy, Worst Offenders is not a 1.0 stable plugin - it was released to fill a hole and see if there is a public requirement for something like it - it seems to have proven useful. Please do <a href="http://boakes.org/talk/tags/worstoffenders" rel="nofollow">feedback</a> experiences, problems and suggestions. I have my own experience with the plugin, but reading that someone thinks it's "touchy" doesn't give me much to go on - I need to know when it fails to live up to expectations, what those expectations are, and why it fails so the next release can do the job better. :) Perhaps it's worth getting it into the WP code management thing so more eyes and fingers can improve it. Howdy,

Worst Offenders is not a 1.0 stable plugin - it was released to fill a hole and see if there is a public requirement for something like it - it seems to have proven useful.

Please do feedback experiences, problems and suggestions. I have my own experience with the plugin, but reading that someone thinks it’s “touchy” doesn’t give me much to go on - I need to know when it fails to live up to expectations, what those expectations are, and why it fails so the next release can do the job better. :)

Perhaps it’s worth getting it into the WP code management thing so more eyes and fingers can improve it.

]]> By: Mark http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037868 Mark Thu, 14 Dec 2006 15:30:45 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037868 Soccer Dad, that exactly what I was thinking. The details of the flood should be configurable to ensure that false positives do not occur. Soccer Dad, that exactly what I was thinking. The details of the flood should be configurable to ensure that false positives do not occur.

]]> By: Quessa.com - » Wordpress DOS Spam Floods http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037436 Quessa.com - » Wordpress DOS Spam Floods Thu, 14 Dec 2006 15:13:02 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037436 [...] “This recent trend of almost DOS like spam floods is really starting to tick me off. Akismet seems to be doing its job but the BOT just keeps asking for wp-comments.php even though it is not allowed to post a comment. The IPs, as usual, are very different in each query and the attacks have all the signs of a new bot farm with a new script that just does not want to take no for an answer.” Weblog Tools Collection [...] [...] “This recent trend of almost DOS like spam floods is really starting to tick me off. Akismet seems to be doing its job but the BOT just keeps asking for wp-comments.php even though it is not allowed to post a comment. The IPs, as usual, are very different in each query and the attacks have all the signs of a new bot farm with a new script that just does not want to take no for an answer.” Weblog Tools Collection [...]

]]> By: Quessa.com - » Wordpress DOS Spam Floods http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037433 Quessa.com - » Wordpress DOS Spam Floods Thu, 14 Dec 2006 15:11:51 +0000 http://weblogtoolscollection.com/archives/2006/12/13/spam-floods-pissing-me-off/#comment-1037433 [...] Weblog Tools Collection [...] [...] Weblog Tools Collection [...]

]]>