Antispam bandwidth protection for my blog is working.

Last month I got fed up with the sucking of my bandwidth on my blog domains
by stupid referrer spammers. I was not entirely sure they were the problem
since it could have been because of a visit happy search engine as well.

Well I installed some 'anti-spam' measures across all six domains that would
automatically update the antispam and then recheck and remove any entries
that matched the blacklist. This is set up on a cronjob to run
automatically. I also included a nice little message for those trying to
access my blog sites from a blacklisted domain/keyword.

I spent some time this month checking back to see the referrer stats nice
and clear of spammer links for the most part. There were a few glitches a
long the way but not enough for it to have been a big deal.

My main issue was the bandwidth they were using up and my secondary issue
was how much time I had to spend checking all six sites and updating the
antispam etc. With a few more sites slated to use the blog as a CMS because
they work perfect for me I knew I was going to run out of time and lose the
fight.

Well I am pleased to say in both time saving and bandwidth what I did
worked. Below are the bandwidth stats for June and then for July. Big
difference ):

June:
domain one 142.14 Meg 22% used
domain two 888.90 Meg 85% used
domain three 558.23 Meg 86% used
domain four 809.26 Meg 86% used
domain five 652.42 Meg 87% used
domain six 300.67 Meg 47% used

July:
domain one 53.51 Meg 9% used
domain two 34.36 Meg 4% used
domain three 203.02 32% used
domain four 82.64 9% used
domain five 239.26 32% used
domain six 95.17 Meg 15% used

In article <zdsEe.3966$X76.2460@tornado.texas.rr.com>, blackcat2
@gmail.com says...
> Last month I got fed up with the sucking of my bandwidth on my blog domains
> by stupid referrer spammers. I was not entirely sure they were the problem
> since it could have been because of a visit happy search engine as well.
>
sorry... only read the first 10 words before.... <mind wandered>

DoobieDo <dave@bytext.co.uk> wrote in
news:MPG.1d4c766e6e049af89898c2@news-text.blueyonder.co.uk:

> In article <zdsEe.3966$X76.2460@tornado.texas.rr.com>, blackcat2
> @gmail.com says...
>> Last month I got fed up with the sucking of my bandwidth on my blog
>> domains by stupid referrer spammers. I was not entirely sure they
>> were the problem since it could have been because of a visit happy
>> search engine as well.
>>
> sorry... only read the first 10 words before.... <mind wandered>


Heidi's post was informative (as always).

I'm not sure what purpose your reply served.

robert blake <4444D@yahoo.com> wrote:

> DoobieDo <dave@bytext.co.uk> wrote:
>
>> Heidi says...
>>
>>> Last month I got fed up with the sucking of my bandwidth on my blog
>>> domains by stupid referrer spammers. I was not entirely sure they
>>> were the problem since it could have been because of a visit happy
>>> search engine as well.
>>>
>> sorry... only read the first 10 words before.... <mind wandered>
>
> Heidi's post was informative (as always).
>
> I'm not sure what purpose your reply served.

Perhaps you would try reading the "first ten words", and limber up your
sense of humour.

Grey

after careful consideration, GreyWyvern wrote in alt.www.webmaster

>
> Perhaps you would try reading the "first ten words", and limber up your
> sense of humour.
>
> Grey
>

naughtyGrey

My dad always said, 'it takes a dirty mind to run a clean newspaper.' :-)

--
Got lint?

GreyWyvern <spam@greywyvern.com> wrote in
newsp.sudoqphnsl6xfd@greywyvern.belkin:

> robert blake <4444D@yahoo.com> wrote:
>
>> DoobieDo <dave@bytext.co.uk> wrote:
>>
>>> Heidi says...
>>>
>>>> Last month I got fed up with the sucking of my bandwidth on my blog
>>>> domains by stupid referrer spammers. I was not entirely sure they
>>>> were the problem since it could have been because of a visit happy
>>>> search engine as well.
>>>>
>>> sorry... only read the first 10 words before.... <mind wandered>
>>
>> Heidi's post was informative (as always).
>>
>> I'm not sure what purpose your reply served.
>
> Perhaps you would try reading the "first ten words", and limber up your
> sense of humour.


ahhhhh, oops a daisy



solly, DoobieDo

"Charles Sweeney" <me@charlessweeney.com> wrote in message
news:Xns969CDD0E8933Cmecharlessweeneycom@130.133.1 .4...
> wrote
>
> > Here's a good start.
> >
> >
> > 12.148.209.196 #Bad Spiders and Bots
> > 12.39.35.130 #deny_hosts auto add
> > 12.44.209.227 #Korea
>
> [snip long list]
>
> > 81.64.11.17 #Korea
> > 81.86.230.210 #Korea
>
> Why when the bulk of spam (and presumably harvesters) is from the US,
> does your list mainly have China and Korea on it?


This is only partial. I left of Vietnam

I currently am blocking nearly 9,000 ips on every server we have.
The bulk is US, yes, but the nasties are PacRim.


> What's the point of having such a list, don't the bots simply use a new
> IP address after a while?

Yes, but the IP'll get used again, so most go /24


> How often do you update it?

I don't. It auto adds due to server activity.


> What processing is involved to check every request against it?

Authentication failures, Server requests, Exim and FTP.

mod_security - apf - bfd and a touch of me own scripting


--
When it absolutely, positively has to be smak'd - -
SmakDaddy