The blog spam has been getting worse.

MT-Blacklist has helped a lot in that it makes it much easier to zap unacceptable comments after the fact and also blocks a huge number of them up front when they match, but it doesn't help if a new pattern is hatched. When I checked email on Saturday there were over five hundred blog spam messages, and yesterday there were over a hundred more.

I've noted that the blog spam is coming from multiple IP addresses which suggests that the same spam zombie networks used for email spam are also being used for blog spam. However, there aren't usually very many IP addresses used at once - a wave of spam will include maybe two or three new IP addresses. This means that IP blocking is a meaningful exercise here: a blocked IP address will not be able to post more spam here at least. Again, this is after the fact.

What I need is some kind of flood protection, a module which will detect multiple comments from a single IP address within a certain amount of time and then block that address if a certain limit is exceeded.

The final option is to upgrade to MovableType 3.0 because the spam protection is much better in that, but I do not understand the changes in licensing yet so I don't want to make that upgrade until I really have to.

Update Hmm... in theory, the version of Movable Type which I have installed has exactly the IP flood features that I want. So why aren't they doing anything? Maybe the threshold is set too low? More investigation required.

Posted by Dunx at August 23, 2004 10:44 AM