Asymmetrical Information

While you are at it, try this one

217.26.240.61

If I remember correctly he was posting kiddie porn links in the comments for older posts. Looks like they are out of Amsterdam.

I've been thinking...after deleting 10 commente spams from the same damn post this week. Comment spam is automated. It works because about a million of us have identical MT installs. Why not just change the file name of the cgi script that fires off comments? Then change the reference to it in your templated to match, and voila, automated comment spam will no longer litter your site.

What am I missing? This seems to easy.

"What am I missing? This seems to easy."

You aren't missing anything. Jacques Distler did precisely this with his own blog a while back.

I've got a blacklist going at the Chicago Report. Here's what I've got so far:

193.171.250.26
82.80.6.80
68.160.245.170
66.111.50.170
212.179.224.136
62.231.101.20
213.130.0.19
212.76.33.68
213.233.88.180
171.75.230.123
209.210.176.22
209.210.176.21
209.210.176.23
209.210.176.20
209.210.176.33
209.210.176.32
209.210.176.31
209.210.176.30
209.210.176.33
209.210.176.33
81.218.227.11
200.52.213.51
213.206.5.5
213.206.5.6
213.206.5.1
213.206.5.2
213.206.5.3
213.206.5.4
193.224.62.94
82.80.6.80
193.171.250.26
217.26.240.61

I manage several different network for different customers, and I've gotten so tired of the garbage comming out of 217.224.0.0/11 that I've null routed that entire netblock.

I'm presuming you have don't the Jay Allen MT Blacklist plug-in installed? I haven't had any more of this sense installing it a few weeks ago.

(That would of course be "since" installing.)

You should read this:

http://diveintomark.org/archives/2003/11/15/more-spam

You won't like it...

Got here chasing IP in this message, you already have it on your list. Please pass this on if its any help. Thanks.

http://www.blogherald.com/archives/000309.php

"November 07, 2003
Blogs used in attack on FDA: political statement or worse?
A new form on Blog spammer has emerged in the blogosphere over the last 24 to 48 hours. He goes by the name of Peter and he has a mission: bring down the United States Food and Drug Administration (FDA) web site. Blog Terrorist or Blog Activist? Only time will tell. Peter is driving extra traffic to the FDA website through Blog or Comment Spam on various blogs. Hailing from IP address 217.26.240.61, the Blog Herald has traced Peter to a host in Spain by the name of Global Internet Comunications S.L. of Av. Coast i Llobera 3-1º
07570 Artà I. Balears (Spain). Peter is running a bot through his host provider to generate the blog spam. We can only hope that Spain, being a friendly nation, will take action to prevent Peter from further abuse.
And a note to users of MT Blacklist: add fda.gov to your ban list before you are targeted.

Posted by editor at November 7, 2003 09:49 PM | TrackBack

Comments
There's a good chance that "Peter" is runsite. Blog Terrorist or Blog Activist? Only time will tell. Peter is driving extra traffic to the FDA website through Blog or Comment Spam on various blogs. Hailing from IP address 217.26.240.61, the Blog Herald has traced Peter to a host in Spain by the name of Global Internet Comunications S.L. of Av. Coast i Llobera 3-1º
07570 Artà I. Balears (Spain). Peter is running a bot through his host provider to generate the blog spam. We can only hope that Spain, being a friendly nation, will take action to prevent Peter from further abuse.
And a note to users of MT Blacklist: add fda.gov to your ban list before you are targeted..."

Got here chasing IP in this message, you already have it on your list. Please pass this on if its any help. Thanks.

http://www.blogherald.com/archives/000309.php

"November 07, 2003
Blogs used in attack on FDA: political statement or worse?
A new form on Blog spammer has emerged in the blogosphere over the last 24 to 48 hours. He goes by the name of Peter and he has a mission: bring down the United States Food and Drug Administration (FDA) web site. Blog Terrorist or Blog Activist? Only time will tell. Peter is driving extra traffic to the FDA website through Blog or Comment Spam on various blogs. Hailing from IP address 217.26.240.61, the Blog Herald has traced Peter to a host in Spain by the name of Global Internet Comunications S.L. of Av. Coast i Llobera 3-1º
07570 Artà I. Balears (Spain). Peter is running a bot through his host provider to generate the blog spam. We can only hope that Spain, being a friendly nation, will take action to prevent Peter from further abuse.
And a note to users of MT Blacklist: add fda.gov to your ban list before you are targeted.

Posted by editor at November 7, 2003 09:49 PM | TrackBack

Comments
There's a good chance that "Peter" is runsite. Blog Terrorist or Blog Activist? Only time will tell. Peter is driving extra traffic to the FDA website through Blog or Comment Spam on various blogs. Hailing from IP address 217.26.240.61, the Blog Herald has traced Peter to a host in Spain by the name of Global Internet Comunications S.L. of Av. Coast i Llobera 3-1º
07570 Artà I. Balears (Spain). Peter is running a bot through his host provider to generate the blog spam. We can only hope that Spain, being a friendly nation, will take action to prevent Peter from further abuse.
And a note to users of MT Blacklist: add fda.gov to your ban list before you are targeted..."

just a test

I see some of these "comment spammers" have started using the IP address of 205.252.160.97 as of a couple of days ago.

I see some of these "comment spammers" have started using the IP address of 205.252.160.97 as of a couple of days ago.

Comments are Closed.