[geeklog-devel] About the forum spammer
dirk at haun-online.de
Mon Jan 17 15:18:50 EST 2005
It's about a known case of comment spamming in weblogs. The author
noticed that all the domains used in the comment spams resolve to the
same IP address, 220.127.116.11
And look what we just got (thanks Tom, thanks SpamX plugin!):
| Please check some helpful info about<A HREF="http://internet-
| poker.fidelityfunding.net/"> internet poker
dirk at terra:dirk> ping fidelityfunding.net
PING fidelityfunding.net (18.104.22.168): 56 data bytes
The nice thing is that he's also setting up bogus "account terminated"
pages (try the above URL).
Anyway, the IP address might be another filter criterion, instead of
having to update the blacklist all the time. Anyone wanting to write a
SpamX module for this?
MT Blacklist is lagging behind, btw. The last few spam posts were only
caught because they contained "texas holdem" - whatever that is, but it
appears in all those posts.
More information about the geeklog-devel