October 02, 2003
Comment spam

Grrr. Last night I was hit by a comment spammer, who injected an ad for his scummy website all over my blog. His IP address is 65.77.116.28, and the IP address of his accursed website is 207.44.162.33, so all you MT users should take preventative action and ban those addresses now. Meanwhile, I'm slogging through my recent comments deleting each one, which is an annoying and tedious task.

I forget who pointed me to this, but A Small Victory has a recent post about a gaggle of comment spams she's received, and she's included a list of IPs that she banned as a result. Even better, one of her commenters has pointed to this method for banning comment spam based on content, which I will be investigating.

Meanwhile, back to deleting I go...

UPDATE: All gone. I'm lucky that the jerk only spammed me about 20 times, instead of several hundred times. On to more productive things.

UPDATE: Here's another IP to ban: 206.163.168.8. I think I'm gonna have to bookmark this post, for everyone's easy reference. And I need to get off my butt and implement that aformentioned general solution.

UPDATE: The complete list of comment-spammer IP addresses to ban:

216.228.168.110
206.163.168.8
64.191.20.166
65.77.116.28
207.44.162.33
66.75.80.169
65.77.116.28
63.155.192.3
24.184.91.227
212.179.192.76
216.145.86.238
65.64.78.72
80.14.97.44
216.145.86.238
68.211.236.172
68.153.65.193
61.181.5.155
208.147.1.4
80.50.242.152
166.180.133.53
68.160.245.170
204.251.10.215
148.233.3.242
81.23.232.93
81.218.227.11
209.210.176.21
209.210.176.22
61.181.5.69
66.154.47.203
213.222.2.35
81.23.232.93
24.64.223.205
65.125.231.178
216.98.141.250
24.108.209.164
213.206.5.5
63.209.26.172
209.210.176.21
209.210.176.33
209.210.176.20
209.210.176.22
68.160.248.55
82.80.6.80
62.219.182.250
210.220.73.5
81.23.232.93
64.72.132.17
66.154.47.199

This includes the address from which the comment was posted as well as the address of the website they're shilling for. I'll add more as I need to.

UPDATE: Added two more IP addresses. I also see that Jay Allen has released a new version of his comment de-spammer. Must download...

UPDATE: Ironically, as I came to this post to add three more IP addresses, I saw that it had been comment spammed, something I failed to notice the last time I updated this. Sheesh.

Posted by Charles Kuffner on October 02, 2003 to Administrivia | TrackBack
Comments

Thanks for the heads up. I still think APCB is low profile enough to stay under their radar, but an ounce of pretension...or something like that.

Posted by: Pete on October 2, 2003 9:10 AM

Thanks for sharing the IP address. Nucleus isn't so well known to spammers, so it attacts fewer comment spammers, but I'm sure it's just a matter of time.

Posted by: kevin whited on October 2, 2003 12:41 PM

Charles:

Thank you. Thank you. Thank you.

I've been set to pull my air out over this issue.

L

Posted by: Lisa English on October 10, 2003 5:12 AM

When I was using MT, I installed MT-Blacklist, and I can't recommend it highly enough. It's pretty easy to install, set up, and nothing could be finer than seeing those blocked comment spam messages. Heh-heh-heh.

And it's pretty easy to de-spam comments if someone starts spamming with a new domain.

In a word, or three - Go get MT-Blacklist. For your Movable Type blogs, that is!

Posted by: jelyon on June 11, 2004 3:17 AM