Today I hit the all time record of comment spam with a staggering 367 attacks in just 21 minutes. They were all coming from the same IP address but with various different comments that all had something to do with selling Christmas cards. I don’t mind the occasional comment spam attacks since none get through, but when they hit as hard as they did today I get annoyed because they take up CPU cycles and bandwidth.

I needed a way to block these pesky intruders from leeching on my server and hopefully find a way to keep them from returning.

BlogEngine.NET 1.3 to the rescue

The next version of BlogEngine.NET with the creative title of 1.3, which is due before Christmas, has some new events exposed for extension builders. One of them is called Comment.SpamAttack and gets raised every time a spammer tries to add a comment.

So I wrote a small extension that listens to that event and collects IP addresses from the clients making the spam requests. When the same IP address gets caught spamming comments 3 times, the extension clears the response and sends back a 404 HTTP header. The reason for that is to trick the spammer (which almost always is a dumb robot) to believe that the URL doesn’t exist and therefore it would stop trying and wont come back.

This extension is only a few hours old so I don’t have any statistics on its effect yet, but my spider sense tells me it will have positive effect in fighting the spam attacks right now and in the long term.

You can also create extensions that listens to the Comment.AddingComment which is raised before the comment is saved. That gives you the possibility to do your own spam filtering, because you can then cancel saving the comment and raise the Comment.SpamAttack event by calling the static Comment.OnSpamAttack() method.

I’ll test the extension thoroughly and if it behaves well, it will be included in the 1.3 release. You can also get a sneak peak at the extension by downloading the .cs file below:

BlackLister.zip (886 bytes)

Comments

Mads Kristensen

I don't know yet, but all 367 spam comments where coming from the same IP address. Apparently, not all spambots switch IP addresses for each request.

Mads Kristensen

Josh Stodola

Well, that is not really my concern. What concerns me is when that spam bot gets a new IP address. What happens to the old? Is it not potentially possible that some poor soul (a legitimate visitor) decides to come to your site but is unable becuase his current IP address happens to be one that used to belong to a spam bot?

Josh Stodola

Mads Kristensen

The legitimate visitor will still be able to post a comment since it would not be treated as a spam attack. The extension only sends the 404 HTTP header to robots that is in the process of spamming. That's the beauty of it. BlogEngine.NET knows the difference between legitimate POST requests and POST requests made by robots.

Mads Kristensen

Jesse Foster

Your response to xxx.com is perfect. Both, the code, and the subtle humor, are awesome on this blog. Jesse Foster | jf26028

Jesse Foster

Chris Blankenship

I would like to try this out as well... Do I just drop the Blacklister.cs file into the App_Code\Extensions folder?

Chris Blankenship

Nicholas DL

I have been converting the blog from the web project path-based solution to a web-application project ([i]not exactly easy since many files within BlogEngine.Net have no namespace, which I add[/i]) however one point I have noticed is that the naming of objects is not consistent (one example is SYNC_LOCK in this file versus _SyncRoot). As the project grows this could cause later problems. Otherwise, great app.

Nicholas DL

Justin Etheredge

Nice! I am going to certainly have to try this one out.

Justin Etheredge

Dan Atkinson

Having been a long-time observer of spam IP addresses, I have seen many many attacks come from the same IP address. There are plenty of occasions however, when botnets also launch a spam attack on the website, sometimes preceded by a spider (another story). I found that stopping spider crawls (based on user agent, speed, and IP range) was a fairly effective method of preventing spam, especially when tied in with a honeypot.

Dan Atkinson

wow gold

http://www.wow-powerleveling.org http://www.eing.com http://www.powerlevelingweb.com http://www.igsstar.com http://www.sf10001.cn http://www.wow-power-leveling.org http://www.srogold.com http://www.gamelee.com http://www.igsstar.com http://www.wowgoldlive.com http://www.wowgold-de.com http://www.gamelee.de http://www.gogoer.fr http://www.gamelee.fr http://www.tbcgold.fr http://www.aocgoldweb.com http://www.ffxigilvip.com http://www.wow-golds.net http://www.wow-golds.org http://www.wotlkgolds.com http://www.wotlkgold.org http://www.wotlkgold.net

wow gold

Comments are closed