I occasionally comment on the amount of comment spam I get here. But I felt further analysis might be a good idea, so I am not logging as much information as possible about the commenter when they submit a comment. This dump below I find fairly interesting (it's for approximately the last 24 hours).
mikal@daedalus:~/blog-comments$ find . -type f -name *.info -exec cat {} \; | \
grep REMOTE_ADDR | sort | uniq -c | sort -n
2 REMOTE_ADDR = 85.255.117.250
3 REMOTE_ADDR = 203.142.1.182
5 REMOTE_ADDR = 202.71.106.121
8 REMOTE_ADDR = 202.75.62.79
9 REMOTE_ADDR = 202.75.49.130
11 REMOTE_ADDR = 202.76.235.6
12 REMOTE_ADDR = 202.75.49.131
13 REMOTE_ADDR = 202.75.49.134
16 REMOTE_ADDR = 202.75.49.133
mikal@daedalus:~/blog-comments$
I wonder if blocking specific IPs would help the spam level, or if stopping comments on some posts would help? There certainly seem to be some "hot spot" posts:
264: /home/mikal/blog-comments/travel/usa/california/santaclara/000003 179: /home/mikal/blog-comments/diary/lca2005/000029 170: /home/mikal/blog-comments/linux/000038 158: /home/mikal/blog-comments/diary/000796 134: /home/mikal/blog-comments/diary/000795 92: /home/mikal/blog-comments/pdfdb/000001 87: /home/mikal/blog-comments/link/000065 81: /home/mikal/blog-comments/diary/toys/000001 79: /home/mikal/blog-comments/travel/usa/000006 70: /home/mikal/blog-comments/diary/toys/mp101/pymediaserver/000001
I think I will ponder more.
Tags for this post: blog(
) spam()
posted at: 19:36 | path: /diary/spam | permanent link to this entry
#1 Peter
I get "hot spot" posts for comment spam, but I assume it's just because someone somewhere has a database of links to known comment links on blogs -- so there is no particular pattern to identify where the hot spots will be.
#2 Michael Still
The bit that annoys me the most is that don't appear to be tracking which sites their posts actually end up on, so they keep sending me literally 50 or 60 comment spams a day, none of which end up hosted, and don't ever just move on to someone else.
Very annoying.
#3 Andrew Hutchings
I get 85.255.117.250 constantly trying it on, unfortunately for them the page it is trying to access has been removed about a year ago.
A google search for that IP shows a lot of comment spam, I am tempted to setup apache to detect that IP and send it into an infinite re-direct.