fighting spam

so i came across an interesting spam issue this week over on the frames' website.

We have a really simple stats tool that works out who spends the most time on the message board (based on # of posts) - some people really do no work at all! on monday (01 Jan) I noticed that the top 7 or 8 or had spam type names (vigra@online, etc) which tweaked my interest.

so after a bit of investigation, i found that one particular url had made it into a spammer's attack vector list - getting hit multiple times in one day (over 1600 spam replies to the thread). my initial inclination was to block the IPs previously used (no joy! these spammers are no doubt using open proxies / infected machines).

next step was to implement some sort of lookup on the IPs posting - i checked a random sampling of the IPs against email blacklist and lo-and-behold they were mostly listed on email blacklists too. bingo - check IPs against blacklists before accepting the post.

so now all attempts to post to the frames' message board require the user's IP to be checked against the following BLs:

  'sbl-xbl.spamhaus.org',     //www.spamhaus.org
  'bl.spamcop.net',           //www.spamcop.net
  'no-more-funn.moensted.dk', //no-more-funn.moensted.dk
  'list.dsbl.org'             //www.dsbl.org

we've also implemented our own ip blacklist for sin binning consistent abusers of the board (cease and desists to their network admins usually does the trick though!)

here's the link to the code we're using: http://www.frozenminds.com/spamblacklist.html
here's the link to the thread that was getting spammed: http://www.theframes.ie/v4/comm/msgboard/view/42874/