B10[mg]

Good blogger Bok noticed a major decrease in comment spam by blocking a single IP address. Of course, I had to see if this host was also spamming the heck out of my blog, but no. The IP address was not present in my logfiles, so I assume I'm still out of his/her reach.

Nevertheless, it got me thinking that blocking certain IPs might help stopping comment spam. I log the IP address and time stamp of each spam attack in a certain logfile (format: timestamp|IP address) so a list of top 10 offenders was easily created:

$ awk -F"|" '{ a[$2]++ } END { for (i in a) print a[i]":\t"i }' spammers.db  | \
  sort -n -r | head -10
604:    81.95.146.162
120:    69.46.16.231
74:     195.225.177.3
52:     85.255.119.74
50:     209.160.40.114
42:     72.36.226.10
41:     85.255.119.130
40:     66.36.229.227
35:     72.232.37.250
33:     75.126.21.163

I've added these addresses to my pf blocklist. Let's see if it'll work.

... why am I not surprised to see the ISP that refused to do anything about botnets at number 6?

comment spam, layeredtech