Spammer Tar Pit

While this will surely help for a little while, you should (and probably already do) realize that IP numbers are easily spoofed and blocking whole IP number ranges is almost always disadvantageous. As Jay Allen, author of MT-Blacklist, has noted several times, attacking the _method_ of the spammer doesn’t work in the long run, because methods can easily be changed. The tar-pitting is a nice idea, but ideally it should be triggered by a MT-Blacklist type of pattern matching against the author, e-mail, url, body fields of the comment.

Another idea would be to grab the important parts of the sourcodes of SpamAssassin and build a plugin based on them. for comparision: I get about 0.5 spam mails per month – before that: about 20 per DAY!
- so SpamAssassins spam detection engine should be very reliable regarding this topic.

cu, w0lf.

Hmm – I’m trying to deny an entire list of IP addresses from a particularly annoying spammer that seems to be using compromised machines from one provider. Basically, I want to block 212.235.32.0 – 212.235.95.255. (So just 212.235.32. – 212.235.95.)

So I’m looking at the $spammer_ips array, but can’t see what the regex should be for that list. Being lazy… um, programmer-style, I’m really not planning to write in the whole list going up by one IP each time (212.235.33, 212.235.34..). Hints appreciated..

installed the 1.2 version, same problem, when I activate the plugin, complete site goes white. tried it with commenting out sections, to see which section gives me the problems, site goes already white if I only have the first section (line 43 – 56) active. and I don’t see any errors there. any ideas what could cause the site to go white? (there is no space before or after the original tag, if I comment out the complete code and leave just the main tags, site is okay).

I’ve already exchanged emails with Marlyse, and she has this problem with some other plugins, as well. So I think it may be something specific to certain server setups, and not necessarily something in my code. Of course, if someone spots something that indicates otherwise, please let me know!

Wanted to let you know that I’ve finally found out what created the problem: it seems that sometimes when downloading a php file or somehow obtaining code from somebody else, unvisible characters sometimes translate not php friendly. Barely visible is the worst, the usually displayed as a dot ‘empty space’. Only when viewed as phps file, I saw that it would encode these spaces. Looking at it more closely, I found that even though these invisible chars where represented as dots, the dots where ‘fatter’ than the ‘normal’ dots. Once I cleaned that up, I also found that sometimes single quotes would transfer as ‘curly’ single quotes which also again gave problems. Replacing them all with ’straight’ single quotes handled that. At this point I don’t remember which of the above problems I found with your file (as mentioned before, I had these ‘white site’ problems with various – but not all – plugins. Hope this makes sense and if somebody else encounters the same problem a place to look at.

Um, isn’t this a little lame though (not in terms of the awesome work you’re doing, but just in terms of how it works)? I mean, you have to blacklist the individual ip by hand. I could do that in a darn .htaccess file and be done with it. But any spammer worth their salt is just going to post from another ip. Is there no way to atomate this in the interface?

I personally think this is a dangerous route, because IP-blocking only works for a short time. Unless you flush your IP list from time to time, you could be blocking legitimate users.

that’s too tight! can i put an hour’s delay?

It seems that when i activate tarpit characters on my site go weird. Ive got á and é and the likes in my site and it these ones which get changed through the site. Any ideas on a fix?

[…] […]

I agree with Frank about other information can all be used in the filtering process, because some of the universities and Libraries and other institutions share the same IP for all students and this is my case, always finding my IP to be blocked while I never entered the site before.

I’m amazed that you still have comments enabled given your experience, not sure I’d be so patient! Additionally this is still do-follow so congrats! In all seriousness though having repeated attacks from the same person is annoying, we had a guy in China trying to hack our real estate website for a while thinking(I guess) that we had stored some information there….little did he know that we were just using the Google database info

hey im rick just wanted to say nice post thanks a lot!