Blog spammers using zombies?

It seems there is another blogspam run:

Anelia
www#gbbbbg#com
Your blog is very interesint

Fri Sep 2 0259 2005 217.160.222.211
(csbetrieb.de)

Benny
www#aagbbbbg#com
Good blog with interesing information!

Fri Sep 2 16:14:56 2005 200.233.137.69
(200-233-137-069.xd-dynamic.ctbcnetsuper.com.br)

Benny
www#aagbbbbg#com
Interesting info

Fri Sep 2 2043 2005 67.15.56.5
(ev1s-67-15-56-5.ev1servers.net)

All times in GMT

From the looks, unrelated IP addresses, I would guess that zombies are used
to do this spamming.

I just changed my minimal message length to 80 :-)

Next step will be renaming some input fields (e.g. calling author url ;-) )


--
John Perl SEO tools: http://johnbokma.com/perl/
Experienced (web) developer: http://castleamber.com/
Get a SEO report of your site for just 100 USD:
http://johnbokma.com/websitedesign/seo-expert-help.html

John Bokma wrote:
: It seems there is another blogspam run:
: I just changed my minimal message length to 80 :-)
:
: Next step will be renaming some input fields (e.g. calling author url
: ;-) )

I just disabled comments across the board. no worries that way.

__/ [John Bokma] on Friday 02 September 2005 21:40 \__

> It seems there is another blogspam run:
>
> Anelia
> www#gbbbbg#com
> Your blog is very interesint
>
> Fri Sep 2 0259 2005 217.160.222.211
> (csbetrieb.de)
>
> Benny
> www#aagbbbbg#com
> Good blog with interesing information!
>
> Fri Sep 2 16:14:56 2005 200.233.137.69
> (200-233-137-069.xd-dynamic.ctbcnetsuper.com.br)
>
> Benny
> www#aagbbbbg#com
> Interesting info
>
> Fri Sep 2 2043 2005 67.15.56.5
> (ev1s-67-15-56-5.ev1servers.net)
>
> All times in GMT
>
> From the looks, unrelated IP addresses, I would guess that zombies are
> used to do this spamming.
>
> I just changed my minimal message length to 80 :-)
>
> Next step will be renaming some input fields (e.g. calling author url ;-)
> )

Join the club, John. I tried changing default fields (are you using
'in-house' forms by the way?), added CAPTCHA, added many filters including
Spaminator. I still struggle to purge about 50-100 messages per day in 2
sites. Only 10% will bubble through, but it is enough to upset a webmaster.
If not erased quickly enough, it only encourages more.

Save the trouble, John. Changes will only cater as a temporary solution.
Consider closing comments altogether. I know I do.

Roy

--
Roy S. Schestowitz | "Did anyone see my lost carrier?"
http://Schestowitz.com | SuSE Linux | PGP-Key: 74572E8E
8:15am up 9 days 20:26, 3 users, load average: 0.58, 0.43, 0.44

I have to concur with Roy S. Schestowitz. I have been running dozens of
geeklogs for a number of yrs and last year it didnt matter what you did
to filter out possible spam comment attacks or upgrade your cms. In the
end it was only wise to disable comments from those sites getting hit.
The comment spammers always find a new way to get on your sites,
especially if you have a decent google PR.
Chris
Webmaster Programs; http://www.www-webmaster.com/

WWW-Webmaster wrote:

> The comment spammers always find a new way to get on your sites,
> especially if you have a decent google PR.

I've started getting a bit of comment spam on my site, so I've switched
from retro-moderation to full moderation. Seems to have slowed down a bit
since.

--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~ http://tobyinkster.co.uk/contact

__/ [WWW-Webmaster] on Saturday 03 September 2005 11:54 \__

> I have to concur with Roy S. Schestowitz. I have been running dozens of
> geeklogs for a number of yrs and last year it didnt matter what you did
> to filter out possible spam comment attacks or upgrade your cms. In the
> end it was only wise to disable comments from those sites getting hit.
> The comment spammers always find a new way to get on your sites,
> especially if you have a decent google PR.
> Chris


Thanks for supporting my point.


__/ [Toby Inkster] added on Saturday 03 September 2005 15:01 \__


> I've started getting a bit of comment spam on my site, so I've switched
> from retro-moderation to full moderation. Seems to have slowed down a bit
> since.


You still need to manually handle comments, which can become a nuisance. If
it hasn't yet become a nuisance, you are yet to see the worst. As long as
there is financial incentive, the spammers will continue to hit. Getting
zombies/proxies is easy, losing them is rare.

Roy

--
Roy S. Schestowitz | "These characters were randomly picked"
http://Schestowitz.com | SuSE Linux | PGP-Key: 74572E8E
5:25pm up 10 days 5:36, 5 users, load average: 0.23, 0.28, 0.31

On Sat, 03 Sep 2005 08:19:42 +0100, Roy Schestowitz wrote:

> __/ [John Bokma] on Friday 02 September 2005 21:40 \__
>
>> It seems there is another blogspam run:
>>
>> Anelia
>> www#gbbbbg#com
>> Your blog is very interesint
>>
>> Fri Sep 2 0259 2005 217.160.222.211
>> (csbetrieb.de)
>>
>> Benny
>> www#aagbbbbg#com
>> Good blog with interesing information!
>>
>> Fri Sep 2 16:14:56 2005 200.233.137.69
>> (200-233-137-069.xd-dynamic.ctbcnetsuper.com.br)
>>
>> Benny
>> www#aagbbbbg#com
>> Interesting info
>>
>> Fri Sep 2 2043 2005 67.15.56.5
>> (ev1s-67-15-56-5.ev1servers.net)
>>
>> All times in GMT
>>
>> From the looks, unrelated IP addresses, I would guess that zombies are
>> used to do this spamming.
>>
>> I just changed my minimal message length to 80 :-)
>>
>> Next step will be renaming some input fields (e.g. calling author url ;-)
>> )
>
> Join the club, John. I tried changing default fields (are you using
> 'in-house' forms by the way?), added CAPTCHA, added many filters including
> Spaminator. I still struggle to purge about 50-100 messages per day in 2
> sites. Only 10% will bubble through, but it is enough to upset a webmaster.
> If not erased quickly enough, it only encourages more.
>
> Save the trouble, John. Changes will only cater as a temporary solution.
> Consider closing comments altogether. I know I do.

The best thing to do other than closing comments is use a seriers of
filters:
- Have users log in before posting comments
- Using Capcha
- Reject all comments with URls
- Use something like http://www.angrypets.com/tools/rdos/

and after all these filters, you should be left by comments left by
persistent human posters, hopefully very few or none, then do a full
moderation. Only usefull comments will be posted then.

I prefer to read blogs with good comments than blogs with no comments.



Karim
--
http://www.cheapesthosting.com - Innovative Web Hosting since 1998
Spam and Virus protected email - Online calendars with email notification
Camera phone photos automatic transfers to your photo album (RSS Enabled)