Comments on: Blog spamming http://www.geekrant.org/2004/10/28/blog-spamming/ Fri, 27 Jan 2012 05:44:11 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: Daniel http://www.geekrant.org/2004/10/28/blog-spamming/comment-page-1/#comment-121 Daniel Mon, 08 Nov 2004 10:13:22 +0000 http://www.geekrant.org/2004/10/28/blog-spamming/#comment-121 The IP address blocking stopped some of it, but what has really put paid to it is renaming WordPress's wp-comments-post.php file (and references to it). The comment spammers attack this file by name, and while it's not impossible now to work out what it's called, it's stopped them for now. The IP address blocking stopped some of it, but what has really put paid to it is renaming WordPress’s wp-comments-post.php file (and references to it). The comment spammers attack this file by name, and while it’s not impossible now to work out what it’s called, it’s stopped them for now.

]]> By: Daniel http://www.geekrant.org/2004/10/28/blog-spamming/comment-page-1/#comment-103 Daniel Fri, 05 Nov 2004 02:07:01 +0000 http://www.geekrant.org/2004/10/28/blog-spamming/#comment-103 A second wave today, using new IP addresses. After expansion, my current .htaccess deny list is: deny from 24.193.110.88 deny from 61.189.235.207 deny from 61.239.247.73 deny from 65.68.242.121 deny from 68.165.169.202 deny from 68.33.60.242 deny from 68.39.209.63 deny from 140.122.77.8 deny from 148.223.48.226 deny from 148.244.150.58 deny from 151.202.154.243 deny from 193.165.223.2 deny from 200.42.212.42 deny from 200.45.71.40 deny from 203.87.147.166 deny from 203.113.29.1 deny from 203.195.201.29 deny from 203.197.234.177 deny from 209.74.43.164 deny from 211.185.38.61 deny from 212.117.152.70 deny from 212.165.158.100 deny from 212.179.50.75 deny from 212.219.119.198 deny from 213.4.105.231 deny from 213.112.92.165 deny from 218.145.25.11 A second wave today, using new IP addresses. After expansion, my current .htaccess deny list is:

deny from 24.193.110.88
deny from 61.189.235.207
deny from 61.239.247.73
deny from 65.68.242.121
deny from 68.165.169.202
deny from 68.33.60.242
deny from 68.39.209.63
deny from 140.122.77.8
deny from 148.223.48.226
deny from 148.244.150.58
deny from 151.202.154.243
deny from 193.165.223.2
deny from 200.42.212.42
deny from 200.45.71.40
deny from 203.87.147.166
deny from 203.113.29.1
deny from 203.195.201.29
deny from 203.197.234.177
deny from 209.74.43.164
deny from 211.185.38.61
deny from 212.117.152.70
deny from 212.165.158.100
deny from 212.179.50.75
deny from 212.219.119.198
deny from 213.4.105.231
deny from 213.112.92.165
deny from 218.145.25.11

]]> By: Andy Merrett http://www.geekrant.org/2004/10/28/blog-spamming/comment-page-1/#comment-91 Andy Merrett Tue, 02 Nov 2004 13:57:15 +0000 http://www.geekrant.org/2004/10/28/blog-spamming/#comment-91 Maybe, but I am still getting 'error' hits (403s and 404s) so someone is still active - they've not sussed out the other part of my defence yet :) Maybe, but I am still getting ‘error’ hits (403s and 404s) so someone is still active – they’ve not sussed out the other part of my defence yet :)

]]> By: Daniel http://www.geekrant.org/2004/10/28/blog-spamming/comment-page-1/#comment-89 Daniel Tue, 02 Nov 2004 09:27:24 +0000 http://www.geekrant.org/2004/10/28/blog-spamming/#comment-89 Okay I looked through the caught comments, and came up with a list of 11 IP addresses, and put them into the .htaccess file on my blog thusly: <code># Prevent blog poker spam attack Nov 2004 <limit POST> order allow,deny deny from 148.223.48.226 deny from 148.244.150.58 deny from 200.42.212.42 deny from 203.113.29.1 deny from 203.195.201.29 deny from 203.197.234.177 deny from 211.185.38.61 deny from 212.165.158.100 deny from 212.219.119.198 deny from 213.112.92.165 deny from 218.145.25.11 allow from all </limit></code> ...and the attack stopped. But it also stopped on geekrant.org, so I can't be sure that it worked properly. The spammer might have shutdown. Hmmmmm. Okay I looked through the caught comments, and came up with a list of 11 IP addresses, and put them into the .htaccess file on my blog thusly:

# Prevent blog poker spam attack Nov 2004
<limit POST>
order allow,deny
deny from 148.223.48.226
deny from 148.244.150.58
deny from 200.42.212.42
deny from 203.113.29.1
deny from 203.195.201.29
deny from 203.197.234.177
deny from 211.185.38.61
deny from 212.165.158.100
deny from 212.219.119.198
deny from 213.112.92.165
deny from 218.145.25.11
allow from all
</limit>

…and the attack stopped. But it also stopped on geekrant.org, so I can’t be sure that it worked properly. The spammer might have shutdown. Hmmmmm.

]]> By: Andy Merrett http://www.geekrant.org/2004/10/28/blog-spamming/comment-page-1/#comment-79 Andy Merrett Mon, 01 Nov 2004 13:42:56 +0000 http://www.geekrant.org/2004/10/28/blog-spamming/#comment-79 Only a handful of IPs seemed to be trying to find my comments php page (which isn't there any more), and of those they are being forbidden before they even get to the not found (ie 403 before 404 - haha!). Nothing has shown up on my mod queue or comments since I did that. Give it time... :( Only a handful of IPs seemed to be trying to find my comments php page (which isn’t there any more), and of those they are being forbidden before they even get to the not found (ie 403 before 404 – haha!). Nothing has shown up on my mod queue or comments since I did that. Give it time… :(

]]>