{"id":214,"date":"2004-10-20T07:52:00","date_gmt":"2004-10-20T07:52:00","guid":{"rendered":"http:\/\/jclark.org\/weblog\/Rants\/spampire.html"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T04:00:00","slug":"spampire","status":"publish","type":"post","link":"https:\/\/jclark.org\/weblog\/2004\/10\/20\/spampire\/","title":{"rendered":"SpamWars: The Spampire Strikes Back"},"content":{"rendered":"

So here I was, idly checking my Bloglines feeds and lamenting the fact that I had nothing to blog about tonight. Silly rabbit, be careful what you wish for. Poing! New Mail. No, wait… 6 new e-mails in the 5 minutes since the last automatic check. That never<\/em> happens. Must be comment spam on the ol’ blog.<\/p>\n

Indeed. Not only that, but all of the spam comments showed up in my inbox as new comments, not spam attempts. This means my anti-spam measures have failed. Several months ago, I suffered a severe spam onslaught<\/a>, which lead to my disabling comments for three weeks. When my comment system returned<\/a>, I had implemented several changes to help stop the spam. I even kept the details to myself to slow the spammers from catching on. Looks like they’ve caught on.<\/p>\n

My countermeasures included rejecting all items without a referrer, and changing the default value in a hidden comment form field used by the Blosxom writeback plugin. Nice try. Tonight’s spammer is much more sophisticated. Each post came from a separate IP address. Referrer is present and correct, and the User Agent string looks innocuous, although I’d bet it’s a bot. The posts came in groups of three, and for each group of three I can see a single IP address GETing the original post plus other pages (archive links, etc); however the two “sniffer” IPs are different.<\/p>\n

These little weasels deserve all seven levels of Dante’s Inferno and a couple of new ones I just thought up. For now, I’ve shut off comments. Looks like I’ll be setting up the blosxom port of the MT blacklist very soon. Sorry for the inconvenience, feel free to email me in the interim. Unless you are a spammer… you may feel free to (Extremely violent and anatomically questionable recommendation censored)<\/em>.<\/p>","protected":false},"excerpt":{"rendered":"

So here I was, idly checking my Bloglines feeds and lamenting the fact that I had nothing to blog about tonight. Silly rabbit, be careful what you wish for. Poing! New Mail. No, wait… 6 new e-mails in the 5 minutes since the last automatic check. That never happens. Must be comment spam on the […]<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-214","post","type-post","status-publish","format-standard","hentry","category-rants"],"_links":{"self":[{"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/posts\/214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/comments?post=214"}],"version-history":[{"count":0,"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/posts\/214\/revisions"}],"wp:attachment":[{"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/media?parent=214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/categories?post=214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/tags?post=214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}