post-page

Three Strikes and Out Damned Spam, Out I Say!

85
responses
by
 
on
September 24th, 2004
in
WordPress Hack
 




heading
heading
heading
85
Responses
Leave A Comment
Comments Feed

 

Comments

  1. Jeff Minard (8 comments.) says:
    9/24/2004 at 12:45 pm

    You may also wish to have it do a “demo” spam check.

    For instance, have it process all (or a large sample) of previous comments so that users can see what kind of comments will be accepted, moderated, or just bounced.

  2. Mark says:
    9/24/2004 at 12:47 pm

    That is a great idea! I will have to think about how to implement that though.

  3. Charles (2 comments.) says:
    9/27/2004 at 1:15 pm

    Works like a charm (tested on my local machine) – though I guess one thing that would be nice would be to have it email you (as comments get emailed, when you have that option enabled) when it has diverted someone away. Couldn’t see how to do that. Or would it happen anyway?

  4. Mark says:
    9/27/2004 at 1:30 pm

    Actually, I monitor strikes as well as keeping track of who got diverted. Look at the source of this page to see the strikes for each comment. I also have the script send me an email when it gets triggered. I will post that part of the script here in a few.

  5. Mark says:
    9/27/2004 at 5:35 pm

    Look towards the bottom of the plugin and find

    //This is where the strikes are processed.
    if ($strike >= $SpamThreshold) {
    header("Location: $RedirectSite");
    die('Too Bad Spammer');
    }

    Replace that with:

    $_POST['comment'] .= "<!-- strikes = ".$strike." -->";
    //This is where the strikes are processed.
    if ($strike >= $SpamThreshold) {
    // Your email address
    $email = "your@email.com";

    // The subject
    $subject = "Mail from blocked comments";

    // The message
    $message = $comment."<br />".$author."<br />".$email."<br />".$url."<br />".$userip."<br />"."<!-- strikes = ".$strike." -->";
    mail($email, $subject, $message, "From: $email");
    header("Location: $RedirectSite");
    die('Too Bad Spammer');
    }

    Now, replace your@email.com with your real email address.

  6. Kaimi says:
    10/1/2004 at 10:24 pm

    Very nice. I had previously tinkered with setting blacklist to auto-block. This might be a better approach.

    FYI, one thing I did slightly differently. I worried about false positives, which are a real possibility with any filtering. And I didn’t want someone to type up a great comment, inadvertently trip a filter, and lose their comment. So my die looks like this:

    {
    echo (‘Your Comment: ‘);
    echo ($comment);
    echo (‘

    ‘);
    die( __(‘Sorry, but some of the content of this comment appears to violate our comment policies. This determination has been made using filtering software. If you believe you have received this message in error, please contact us by e-mail as soon as possible. In addition, please note that this comment will not be saved on our server. Therefore, if you wish to preserve any of the content of this comment, you should copy it from this screen right now. Thank you.’) );
    }

  7. Charles (2 comments.) says:
    10/3/2004 at 11:33 am

    I like Kaimi’s suggestion, though what’s frustrating is that what we *want* to do is slow the spammers down. But I don’t think they wait for the site to respond. I expect they have systems that spew out these spams by connecting to the site and pressing the buttons and ignore any response *at all* from the systems they’re targeting.

    How then do we get the server to hold them up? And do they ever, ever look to see if their stuff appears? Only IP banning would work, I suspect, but that’s not going to work because they use networks of Trojanned machines.

    This feels like trying to eradicate malaria. Some damn fool keeps leaving empty tyres out in the rain.

  8. Stephen (1 comments.) says:
    10/3/2004 at 2:26 pm

    I don’t currently have a blacklist and yet any comment anyone tries to post gives 5 strikes right away – why is this?

  9. Mark (34 comments.) says:
    10/4/2004 at 7:54 am

    Try adding one word to your blacklist, not sure what else you have installed.

  10. pmk (2 comments.) says:
    10/23/2004 at 7:14 am

    I’ve dropped this in along with my other WP plugins, but it never appears in the Plugins admin section. Anyone else had this problem?

  11. Mark says:
    10/23/2004 at 9:45 am

    What version of WordPress are you using?

  12. Mark says:
    10/28/2004 at 8:08 am

    Hmmmm….thats weird and not necessarily a bug in the code. Can you do me a favor and look at the comments in your wp-admin and see if there are any IPs recorded there?
    Either this is something new that the spammers have started OR your server somehow does not have the $_SERVER superglobal for PHP implemented. The second error can be fixed by making sure that register_globals is turned on for PHP and replacing $_SERVER with $HTTP_SERVER_VARS[‘REMOTE_ADDR’].

    For $_SERVER to work, you should be on PHP version 4.1.0 or above.

  13. Pamela (2 comments.) says:
    10/27/2004 at 12:41 am

    I’m in the process of converting an MT blog to WP. I have about half my old posts uploaded. I have the WP blacklist, Kitten’s Spam Words, and Three Strikes plugins. The first test comment I tried to post, using my own name/email/domain and body consisting of ‘test’ got me redirected to fbi.gov. Deactivating Three Strikes let the comment go through. I haven’t yet messed with the threshold for Three Strikes, so I’m kind of surprised that the default level blocked me.

  14. Mark says:
    10/27/2004 at 8:13 am

    Make sure that there are no exmpty spaces or line breaks in the common spam words inside your wp-admin. Empty lines would cause problems and I have noticed that Kitten’s spam words sometimes puts in empty spaces.

  15. Charles (4 comments.) says:
    10/28/2004 at 7:28 am

    I’m not getting the IP of blocked comments – which I’d like to see.
    My code:
    $subject = “Mail from blocked comments”;
    // The message
    $message = $comment.”
    “.$author.”
    “.$email.”
    “.$url.”
    “.$userip.”
    “.”“;
    mail($email, $subject, $message, “From: $email”);

    However the mail I get when a comment is blocked doesn’t have anything in the $userip field. It gets the comment, the author and author email (faked as they are) fine.

    Seems like a bug in the code?

  16. Charles (4 comments.) says:
    10/28/2004 at 9:23 am

    Sorted it – it was a bug, but in my code. I had put $userip instead of $user_ip in the thing I wanted mailed.

    Now have put together a much more comprehensive response, which includes hyperlinks to ARIN and RIPE (as I get Euro-generated comment spam). Here’s the code:

    $message = $comment.” allegedly by “.$author.” at “.$email.” Url “.$url.” IP: “.$user_ip.” (RIPE) “.$user_ip.” (ARIN) \n \n “;

    Untested so far, but some spammer somewhere has been banging on my server all day, so sure to get tried out in a moment.

  17. Charles (4 comments.) says:
    10/28/2004 at 9:50 am

    agh, my hyperlinks in the code got commented out. If you copy the code above and the text of the link you’ll get close to it. Apologies. I may try to post the code on my site.

  18. Charles (4 comments.) says:
    10/28/2004 at 11:15 am

    OK, and now I’ve worked out what I did wrong. This version now has a lookup so you can do a lookup all round the world for where the IP is coming from. This is if you get an email telling you whether you’ve had blocked comments.

    I haven’t put HTML in this because I don’t use an HTML email client. It converts text beginning with http: directly into links. Your mileage, as they say, may vary, in which case you’ll have to write the a href= stuff yourself.


    $message = "Comment: "$comment."
    allegedly by ".$author." at ".$email." Url ".$url."

    RIPE: http://www.ripe.net/whois?form.....earchtext=".$user_ip."

    ARIN: http://ws.arin.net/cgi-bin/whois.pl?queryinput=".$user_ip."

    LACNIC: http://lacnic.net/cgi-bin/lacn.....N&qr=".$user_ip."

    APNIC: http://www.apnic.net/apnic-bin.....earchtext=".$user_ip."

    strikes: ".$strike;
    mail($email, $subject, $message, "From: $email");

  19. Raena (2 comments.) says:
    10/28/2004 at 11:16 am

    It’s user_ip, that’s why.

  20. Raena (2 comments.) says:
    10/28/2004 at 11:17 am

    …oops, never mind. ;)

  21. Bowen (1 comments.) says:
    10/29/2004 at 4:15 am

    BTW, you can use $email = get_settings(“admin_email”); instead of hard-coding $email = “your@email.com”;

  22. Kelson (20 comments.) says:
    10/31/2004 at 10:41 pm

    Great plugin! It’s just saved me from a positively ridiculous spam run (230 comments in one day. All moderated, but I got all the notices…)

    One problem: On my site, the add_magic_quotes lines cause apostrophes to get double-escaped in comments that pass. My guess is that it’s because magic_quotes_gpc is disabled on my server, so both this plugin and the regular WP code run it — and the comments end up with backslashes in front of every apostrophe.

    It *looks* like it’s not necessary in the code this plugin runs, so I’ve commented out those lines on mine and things seem to be working OK.

    Another suggestion I’d make is having it issue a 403 error instead of redirecting. While I like the idea of sending the spammer to the FBI’s page, chances are it’s a bot doing the posting, and an “Access denied” error is more likely to get noticed in the unlikely event that the bot’s been written well. Simple version:

    if ($strike >= $SpamThreshold) {
    // this next line depends on what version of PHP you have.
    // see wp-blog-header for an example
    header('Not allowed', TRUE, 403);
    print '

    Get lost, spammer!

    ';
    die();
    }

  23. Kelson (20 comments.) says:
    10/31/2004 at 10:43 pm

    D’oh! In a comment about problems with escaping, I forgot to escape my HTML sample code! Sorry about that!

    print '<html><head><title>Access Denied, Spammer!</title></head><body><h1>Get lost, spammer!</h1></body></html>';

  24. Pamela (2 comments.) says:
    11/3/2004 at 12:36 am

    Currently, there aren’t ANY words in my spam words list. I think I’m looking in the right place: Options -> Discussion -> Comment Moderation.

  25. Jeroen Evers (1 comments.) says:
    11/8/2004 at 7:40 am

    Hi,
    thanxs alot for the plugin!

    have a question though: when someone leaves the URI blank it automatically gets a strike? if so, is there a way to remove the URI strike, because i would like to make it a non-required field!

  26. Mark says:
    11/9/2004 at 5:13 pm

    That is not true. As long as you allow blank URIs in your blog, comments should still go through. The three strikes plugin does not check it.

  27. pmk (2 comments.) says:
    12/2/2004 at 10:22 pm

    1.2.1

  28. Sarah says:
    12/6/2004 at 10:34 am

    Your plugin has saved the day – I was being innundated with spam, and while it all got caught and put into a queue it was still a big nuiscence. Since using your plugin, the numbers have dropped rapidly, and I’m not having to moderate my site comments every day. Cheers :)

  29. Brenda (1 comments.) says:
    1/13/2005 at 1:09 am

    Hi, I have installed this plugin. But how do I test to see if it is working?

  30. Lauren Noelle (1 comments.) says:
    3/4/2005 at 8:42 pm

    Where are the configuration options? What do we do after activation? How do we set the number (3)?

  31. Vitaly Friedman (2 comments.) says:
    3/22/2005 at 5:25 pm

    Hm…. Actually, I use SpamPal (www.spampal.org) – and I haven’t experienced any problems so far… Still I’ll try this plug-in. Thanks!

    With warm greetings from Saarbruecken, Germany,
    Vitaly Friedman, http://www.alvit.de/vf

  32. Ella says:
    4/22/2005 at 1:53 pm

    All I did was post “test” and I was directed to the FBI page!

  33. Mark (118 comments.) says:
    4/22/2005 at 2:03 pm

    Ummm…just FYI for Ella, that plugin is not active on this blog so redirection to the FBI page is impossible.

  34. Newer says:
    2/13/2006 at 7:10 pm

    Nice site!



Trackbacks/Pingbacks

  1. wordlog.com » Delete Comment Spam Automatically says:
    9/24/2004 at 5:04 pm

    […] spam on my blogs. Looks like someone’s heard my prayer after all. Mark releases the Three Strikes Plugin and explains the rationale […]

  2. scriptygoddess says:
    9/25/2004 at 2:49 am

    […] ging tools. (WordPress, MT, Expression Engine, Textpattern) [via Weblog Tools Collection] Three Strikes You’re Out – spam plugin Another […]

  3. Woordenaar | over leven » 2 trapsraket says:
    9/25/2004 at 10:13 am

    […] an ik nu dus twijfel of die naar behoren werkt, heb ik nu ook Kitten’s Spam Words en Three Strikes geïnstalleerd. Spam Words voegt […]

  4. LostFocus - The Weblog of Dominik Schwind - Lörrach » Three Strikes says:
    9/25/2004 at 7:57 pm

    […] nly around 10 clicks for 140 messages – but it was annoying enough. So now I am using the “Three Strikes” Spam Prevention Plugin by M […]

  5. Charles on... anything that comes along » If your comments redirect you.. says:
    9/26/2004 at 3:10 pm

    […] f your comments redirect you.. I’ve just activated a WordPress plugin called “Three Strikes” which should kill a […]

  6. Synesthesia » Commenting changes says:
    9/26/2004 at 6:13 pm

    […] ges
    Filed under: Site News — Julian @ 7:11 pm

    I’ve installed the Three Strikes plugin from Mark Ghosh. Any prob […]

  7. serialdeviant.org(y) » You little fuckers. says:
    9/27/2004 at 10:46 am

    […] Some idiot comment spammer has been trying to flood my comments. I activated the Three Strikes plugin and I hope it’s good […]

  8. Weblog Tools Collection » Comment Spam Statistics says:
    9/30/2004 at 1:34 pm

    […] — Mark I thought that it would be useful to post my own experiences with the Three Strikes Plugin that I recently released. […]

  9. MyIrony.com » Do you have anything without spam in it? says:
    9/30/2004 at 3:52 pm

    […] e comment spammers finally found their way into my WordPress set up. But no worries. The Three Strikes plugin “scores” each new […]

  10. anti's blog » Comment spam says:
    9/30/2004 at 4:36 pm

    […] t weeks and I was getting tired of removing/disapproving it manually, so I installed this: Threestrikes Spam blocker If you try to commen […]

  11. Charles on... anything that comes along » Three Strikes plugin: working nicely, thank you says:
    10/1/2004 at 5:36 pm

    […] Back in If your comments redirect you.. I mentioned a new plugin for WordPress called Three Strikes for simply pushing annoying comme […]

  12. Nico.se - Nico's weblog » Du är ute efter tredje försöket! says:
    10/4/2004 at 12:14 am

    […] i kön som ska godkännas så har jag nu installerat ytterligare ett antispam-tillägg för WP, ThreeStrikes Spam prevention plugin. Detta till […]

  13. Nico.se - Nico's weblog » Du är ute efter tredje försöket! says:
    10/4/2004 at 12:14 am

    […] i kön som ska godkännas så har jag nu installerat ytterligare ett antispam-tillägg för WP, ThreeStrikes Spam prevention plugin. Detta till […]

  14. Valleballong webblogg » hmmm…skumt spamfilter? says:
    10/21/2004 at 11:53 am

    […] riva kommentarer…men vad ska vi in på FBI:s hemsa att göra? Läs mer! Weblogg Tools Collection […]

  15. Datenrausch » Blogspam :( says:
    10/22/2004 at 9:15 pm

    […] ng also check you are invited Danke für das:) Ausserdem kann ich jedem WordPress Blogger “Three Strikes” Spam Prevention in Verbindung mit Kitten’s Spam Words empfeh […]

  16. We Saw a Chicken ... » spam action says:
    10/23/2004 at 6:00 pm

    […] ion Filed under: General — scruss @ 13:59 Okay, I’ve now installed ThreeStrikesSPAM and Kitten’s Spam Words […]

  17. Pinwiz.net » And that makes for a productive evening… says:
    10/25/2004 at 11:22 am

    […] #8212; Pinwiz @ 6:21 am

    What have I accomplished? 1. I have installed both the Three Strikes Spam Filter and Kitten’s Sp […]

  18. Spam, spam, spam, merveilleux spam… (Almaren) says:
    10/26/2004 at 3:16 pm

    […] en modération) Vu notre emploi des plugins Spammer Tar Pit, Kitten’s Spam Words et Three Strikes Spam, il a du soumettre ses spams […]

  19. reBeLog » Broken comments… says:
    10/28/2004 at 1:43 am

    […] I apologize. I’m using two anti-comment-spam plugins – Kitten’s Spam Words and Three Strikes SPAM. I marked the first piece of […]

  20. Charles on... anything that comes along » We apologise for the lack of a front page earlier… says:
    10/28/2004 at 6:00 pm

    […] earlier… This was due to me messing up some characters in my editing of the Three Strikes Plugin which has been sorely test […]

  21. dwelle.org » Automatic comment spam blocking says:
    10/29/2004 at 7:50 am

    […] seems to work, I still end up having to “moderate” WordPress comment spam. The Three Strikes plugin works like SpamAssassin to […]

  22. It's Time: Cranky Letters and Other Rants » Comment Spam says:
    10/29/2004 at 1:43 pm

    […] s, automatically adding IP addresses, keywords, url’s etc to the spam word list. 2) Three Stikes This works in conjunction with th […]

  23. upsoclose » Comments are back online says:
    10/31/2004 at 2:47 pm

    […] Mike helpfully suggested the combination of Kitten’s Spam Words and a plugin called Three Strikes< […]

  24. Kitten's Project Blog » Comment Spam Thoughts says:
    10/31/2004 at 10:44 pm

    […] The current hooks in WP 1.2.1 don’t allow for this, but things look better in 1.3. Three Strikes Plugin This is another really coo […]

  25. Tri Nguyen » Blog Archive » What it Takes to Blog says:
    11/1/2004 at 5:02 am

    […] pblue.com/blog/%year%/%month%/%slug-name% anti-spam plugins: Kitten’s Spam Words and Three Strikes SPAM post-by-mail: via secret e- […]

  26. Woordenaar | over leven » Commentspam deel zoveel +1 says:
    11/2/2004 at 10:13 am

    […] den mening veel interessanter, is Kitten’s Spaminator, een combinatie van Tar pit en Three Strikes. De laatste gebruikte ik al in de […]

  27. Blog - Journal Thoughts » WordPress Blog: Fighting Spammers says:
    11/4/2004 at 7:43 pm

    […] mment Killer Comment Spam Words Three Strikes Anti […]

  28. A Different Lemming » Comment Spam says:
    11/5/2004 at 1:15 am

    […] e found a pretty damn effective way of dealing with these asshats: Laughing Lizard’s Three Strikes spam filter for WordPress. It doe […]

  29. Nico.se - blog » Blog Archive » Spam Stopgap och Kitten’s Spaminator says:
    11/13/2004 at 10:01 pm

    […] installerat ‘Kitten’s Spaminator‘, som kombinerar det bästa från ‘Three Strikes Spam Prevention Plugin‘ och […]

  30. Crime wouldn't pay if the government ran it. » ThreeStikesSpam by Laughing Lizard says:
    12/1/2004 at 7:22 pm

    […] nder: Reviews — crimespree @ 4:19 pm I just installed the WordPress Plugin ThreeStrikesSpam >by Laughing Lizard and I am s […]

  31. myownworld.org » The Spaminator says:
    12/1/2004 at 11:26 pm

    […] main interest lies in the fact that it combines the best of the other plugins (Tar Pit and Three Strikes for WP, and the high praise it g […]

  32. madlife » Plug It In says:
    12/2/2004 at 5:40 am

    […] be instantaneously sync’d with a livejournal I created (for my livejournal friends). Three Strikes Spam – not sure exactly how this […]

  33. The Peat Weblog » Spam Handling on the Weblog says:
    12/5/2004 at 10:38 pm

    […] features to identify spam, and adds them to the list of patterns to look out for, and also Three Strikes which uses the list of common fea […]

  34. Private Homepage von Nikolaus Lefin says:
    12/8/2004 at 10:29 am

    […] lugins installiert: http://blog.mookitty.co.uk/dev.....pam-words/ http://weblogtoolscollection.c...../2004/09/2 […]

  35. Private Homepage von Nikolaus Lefin says:
    12/8/2004 at 10:29 am

    […] lugins installiert: http://blog.mookitty.co.uk/dev.....pam-words/ http://weblogtoolscollection.c...../2004/09/2 […]

  36. spoken for: a love divine » holy crapola says:
    1/1/2005 at 6:25 am

    […] r 85 since the last time, making for a total of 690 spam comments that were turned away by this awesome plugin in two days […]

  37. hangingontonothing.com » Three Strikes says:
    1/19/2005 at 3:05 pm

    […] Filed under: Site News — Judd @ 9:01 am

    I’ve installed the “three strikes” comment spam plugin to see […]

  38. Slitið úr samhengi » Komment Spam says:
    1/20/2005 at 12:27 pm

    […] ara stimpla inn random kóða með hverju kommenti. En þá fann ég loksins almennilega plugin! ThreeStrikes! heitir þetta plugin og virðist vera v […]

  39. Persistent Illusion » Bloody Spam Perpetrators! says:
    2/18/2005 at 4:55 am

    […] at’s a new record for my little corner of the bloggosphere. Thanks to the WordPress Three Strikes pluggin, only 2 w […]

  40. netbib weblog says:
    9/25/2004 at 4:07 am

    Kommentarspam
    Eigentlich dachte ich ja, es erwischt uns nicht, aber in der letzten Woche sind um die 800 Kommentarspam-Einträge hier aufgeschlagen. Nur zur Info: Kommentare mit mehr als einem Link landen in der Warteschlange und müssen freigeschaltet (moderiert) we…

  41. Kick & Scream says:
    10/28/2004 at 11:30 am

    Three Strikes TarPit
    I was hit by a wave of spam today. On Raena’s recommendation, I had Kitten’s Spam Words running, so the spam wasn’t visible on the blog, but I still had to log in and delete it all from the moderation queue.

    Pain in the arse.

    So I went looking…

  42. Geeky Ramblings says:
    10/31/2004 at 3:08 pm

    Comment spam
    Sigh

    I’ve been getting hit with a lot of comment spam recently … pain in the a–.

    I found a nifty plugin, however, that let’s me dump comment spam based on certian criteria. Pretty nice.

    So far it has worked well … although I had some c…

  43. Canned !! -- my Atropine says:
    11/2/2004 at 2:30 pm

    SPAM Prevention with WP!!
    Are you being spammed? Do you use WP? If the answer is YES, then you MUST read this…..

  44. Cubelogic radar » Blog Archive » Spam protection says:
    3/4/2005 at 3:04 am

    […] Spam protection Since I am receiving a lot of spam comments, I installed ThreeStrikeSpam and Kitten’s Spam Words p […]

  45. Web Wonderland says:
    3/5/2005 at 12:24 pm

    Anti-Spam Plugins

    I finally installed anti-spam plugins. With this being my third new blog, I was lazy. But I hope I found the perfect plug-ins.

    Three Strikes Spam
    This gets rid of spam and doesn’t allow for a notification e-mail!

    The drawback: I’m pretty sure …

  46. Not quite there » Blog Archive » I hate spam says:
    3/8/2005 at 7:10 pm

    […] mers figured out a new way to leave comments via some trackback URI action. Next came the ThreeStrikesSPAM plugin. It did it’s job […]

  47. Woordenaar | Archief » Commentspam deel zoveel +1 says:
    3/27/2005 at 5:02 pm

    […] den mening veel interessanter, is Kitten’s Spaminator, een combinatie van Tar pit en Three Strikes. De laatste gebruikte ik al in de […]

  48. Taking Your Camera on the Road » WordPress Blog: Fighting Spammers says:
    3/31/2005 at 12:14 am

    […] mment Killer Comment Spam Words Three Strikes Anti […]

  49. Woordenaar » Uitgespamd (voorlopig) says:
    4/23/2005 at 1:38 pm

    […] ing “500 Internal Server Error”) Maar sinds 16:00 heb ik de deur dicht dankzij ThreeStrikesSPAM. Het resultaat, dankzij een ma […]

  50. We Saw a Chicken … » Blog Archive » spam action says:
    8/6/2007 at 11:11 am

    […] action Okay, I’ve now installed ThreeStrikesSPAM and Kitten’s Spam Words. This should help with my comment spam problem. tags: spamPopularity: […]

  51. hmmm…skumt spamfilter? says:
    7/4/2008 at 4:59 am

    […] Läs mer! Weblogg Tools Collection […]

Obviously Powered by WordPress. © 2003-2013

page counter
css.php