Message Board

Tracking Harvesters/Spammers

Tricks I've tried

Author: D.Martin4 (30 May 07 1:35am)

Hello, everyone. I'm new here, and thought I'd share a couple of things I've done to help get spamming IPs.

I run several blogs on my server using Movable Type for my family. I also use the Akismet plugin, which does a pretty good job of keeping comment spam off the site. I've disabled trackbacks because they seem to be the biggest spam attraction.
I then whipped up some perl that does the following:
1 - pulls junk comment IPs from mysql.
2 - Since trackbacks are turned off, parse Apache logs for any hits on mt-tb.cgi
3 - Keep IP's in an ever-growing list sorted with dups removed.
4 - Reverse IPs into in-addr-arpa format and build BIND 9 zone file

I then have BIND 9 configured to act as a DNSBL for that zone. I've also installed the mod_access_rbl plugin on Apache 2.0, which will allow it to query a DNSBL and deny access based on the response from the DNSBL.

I've done a few other things as well, but those may be too punitive for some people. My site is very small, so I have a little more freedom in what I can do and how much I can block.

The system works pretty well for me. In 2006, I blocked over 350,000 spam and trackback attempts to the blogs on our site.

If anyone would like a peek at the code I use, just ask. I'm not a professional programmer, so its not pretty code.. It does work well though.

Re: Tricks I've tried

Author: W.Keeley (13 Jun 07 1:42am)

I have a few tricks up my sleeve as well. I wrote a couple of cgi programs that deter harvesters. Embeeded on my pages are non-clickable links to cgi programs. These programs record the ip address of any visitor that accesses the cgi programs. Another cgi program (clickable) checks to see if a visitor's ip address has been recorded visiting the non clickable programs. If the visitor's ip is listed or if the ip appears in one or more blacklists used by my program, then a captcha showing my email address is displayed. If the visitor's ip address does not appear on any monitored blacklist and has not visited a nonclickable link, then a mailto: link is shown. That way, human visitors will have an easier time of sending me email.