Carpe Datum

Spam Flood

Spam Is Definitely Getting Worse
Image courtesy of Steve Jackson games.

I've said it before, I'll say it again: Thank God for MT-Blacklist, a nice little script that attaches to any Moveable Type powered blog. According to our blog's activity log, both blogs on this site (my wife's and mine) are getting lots of attempted comment spam. In the last week, it has averaged over 50 attempted spams per day. As 15-year-old Justin would say over and over, "I'm not lyin'!"

We probably only see about one-tenth of that total because MT-Blacklist automatically shuts out comments with certain strings (like "diet pills", "penis enlargement" or variations on the spellings of different prescription drugs) by comparing all text of comments to a master list of forbidden strings. This list is kept updated locally, and you can also add to it from a master list at the MT support site.

Still, some new spam that isn't on the list yet gets through occasionally. When it does, MT-Blacklist makes it really easy to delete it all at once, clean up the blog and update your blacklist to prevent future spams with the same string. I go a step further and research the IP numbers of spammers when I have time.

More than half of attempted spams are from IP addresses that track back (via ARIN) to either the "Asia Pacific Network Information Centre" in Australia or the "RIPE Network Coordination Centre" in the Netherlands. Those two entities control huge ranges of IP address (e.g. any IP address that begins with 58, 59, 60, 61, 80, 81, 82, 83, 84, 85, 86, 87, 88, 152, 159, 202, 203, 210, 211, 212, 213, 217, 218, 219, 220, 221, 222, and I am sure there are others I am missing). In other words, the addresses 58.128.95.54 or 58.4.5.6 or 58.255.243.1 all just track back to the same place, which controls all IP's with a 58 prefix.

I have decided to step up the battle a bit and ban those IP prefixes from accessing this site. I can't imagine who the hell would want to read either blog from Australia or the Netherlands anyway. I'm sure some regular readers will nevertheless get shut out of the blogs at some point, and I hope they figure out a different way to get access or email us or something.

Anyway, the rest of the spam comes from miscellaneous random addresses and is more than likely the result of virus software that posts spam comments from the computers of unsuspecting users who have been infected. I block out those individual IP's as they come in, but man, there's a flood of 'em. No telling how many attempted spams don't even show up in my activity log because they are simply banned from accessing the site.

I also get a ton of referrer spam. These are hits that seem to come from nude celebrity, poker, pharmaceutical, etc. web sites. I guess they do this because those referrals show up in web stats that are actually linked, like from extreme-dm.com. Then those URL's appear in published web pages and further increase that site's credibility with search engines like Google or Yahoo, I guess. Not much I can do about that other than banning IP's from Asia Pacific or RIPE and see if the totals drop.

I've been seeing lots more spam lately on other blogs, and it has all the hallmarks of the behavior of an exponentially increasing virus. I just hope I have enough gates shut to keep it down to a manageable trickle that I can delete with MT-Blacklist without getting overwhelmed. Of course, the internet gods are talking greatly increasing the number of available IP addresses in the near future, so I'm probably just spitting into a tidal wave.

Anyway, if you get banned from this site all of a sudden, don't take it personally (unless you are a troll, in which case please do take it personally). Email me and I'll fix it. Right now, I'm in "measure with a micrometer, mark with chalk, cut with an axe" mode, and it's a bit sloppy. There will probably be some collateral damage.

Posted by Observer at July 23, 2004 07:57 AM