A Spammer’s a Spammer
I’ve noticed that, over the last couple of weeks, I’ve caught comment spam outbreaks before they start by watching the same spammers try to hit my referral logs. I use Referrer Karma to keep my referral logs from becoming spam pits, which saves me from having to remove things manually. I’ve been finding, though, that I can seed my spam blacklist with just the base domain.tld being spammed, to good effect. I can additionally seed Spam Karma 2’s IP blacklist with the IPs used to attempt referral spamming, which helps matters as well.
I guess that my advice is to watch referral logs and see what URLs are being spammed today—with my sites, those are the URLs that’ll be attempting comment spam come tomorrow.
Posted July 29th, 2005 in WordPress.
Indeed, there’s more than a connection in passing between the two. But usually, you shouldn’t really have to worry about it:
- If a comment spammer comes to the comment page with a fake referrer (as they often do), RK2 will block them before they even get the comment form.
- If spammers end up in SK2’s blacklist (with a score high enough), they’ll automatically get blocked by RK2 (provided you’ve enabled SK2 compat in RK2’s config file).
It used to be that repeating offenders in RK would get an IP ban (regardless of further use of referrers), but that lead to a handful of strange false positive problems, so I opted to disable IP blacklisting in RK and leave it to SK2 only…
July 29th, 2005 at 11:24 amDave: Good to know. [And yes, I let RK sneak a peek at my SK2 blacklist.] Watching both is pretty much ensuring that nothing slips through here, which is good, because I’m getting lots of attempts right now.
July 30th, 2005 at 7:11 pm