[geeklog-devel] About the forum spammer

[Tom Willett]

On 1/17/2005 3:18 PM, Dirk Haun wrote:


>Found this:

>

>    http://wordpress.org/support/topic.php?id=20956

>

>It's about a known case of comment spamming in weblogs. The author

>noticed that all the domains used in the comment spams resolve to the

>same IP address, 161.58.59.8

>

>And look what we just got (thanks Tom, thanks SpamX plugin!):

>

>| Please check some helpful info about<A HREF="http://internet-

>| poker.fidelityfunding.net/"> internet poker

>

>dirk at terra:dirk> ping fidelityfunding.net

>PING fidelityfunding.net (161.58.59.8): 56 data bytes

>

>The nice thing is that he's also setting up bogus "account terminated"

>pages (try the above URL).

>

>Anyway, the IP address might be another filter criterion, instead of

>having to update the blacklist all the time. Anyone wanting to write a

>SpamX module for this?

>

>MT Blacklist is lagging behind, btw. The last few spam posts were only

>caught because they contained "texas holdem" - whatever that is, but it

>appears in all those posts.

>

>bye, Dirk

>

>

>  

>

Here you go. 

-- 

Tom Willett
tomw at pigstye.net

-------------- next part --------------
A non-text attachment was scrubbed...
Name: Spamx.IP.tar.gz
Type: application/x-gzip
Size: 1482 bytes
Desc: not available
Url : <http://eight.pairlist.net/pipermail/geeklog-devel/attachments/20050119/39b511ad/attachment.bin>