[geeklog-devel] About the forum spammer

[Dirk Haun]

Found this:

    http://wordpress.org/support/topic.php?id=20956

It's about a known case of comment spamming in weblogs. The author
noticed that all the domains used in the comment spams resolve to the
same IP address, 161.58.59.8

And look what we just got (thanks Tom, thanks SpamX plugin!):

| Please check some helpful info about<A HREF="http://internet-
| poker.fidelityfunding.net/"> internet poker

dirk at terra:dirk> ping fidelityfunding.net
PING fidelityfunding.net (161.58.59.8): 56 data bytes

The nice thing is that he's also setting up bogus "account terminated"
pages (try the above URL).

Anyway, the IP address might be another filter criterion, instead of
having to update the blacklist all the time. Anyone wanting to write a
SpamX module for this?

MT Blacklist is lagging behind, btw. The last few spam posts were only
caught because they contained "texas holdem" - whatever that is, but it
appears in all those posts.

bye, Dirk


-- 
http://www.haun-online.de/
http://www.macosx-faq.de/