Geeklog Forums

There is new spam getting through the patch for Version 1.3.7. It is porn and phone cards this time. I have had anonymous comments turned off for a long time and applied the patch from Dirk.

Here is the data from the logs:

156.110.79.14 - - [03/Jun/2004:02:17:17 -0500] "GET /comment.php?sid=20040514152149184&pid=0&type=article HTTP/1.0" 200 22863 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705)"
62.123.35.34 - - [03/Jun/2004:02:17:17 -0500] "GET /comment.php?sid=20040521205229571&pid=0&type=article HTTP/1.0" 200 22844 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705)"
156.110.79.14 - - [03/Jun/2004:02:17:18 -0500] "POST /comment.php HTTP/1.0" 200 139 "http://www.keystonesoldiers.org/comment.php?sid=20040514152149184&pid=0&type=article" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705)"
62.123.35.34 - - [03/Jun/2004:02:17:19 -0500] "POST /comment.php HTTP/1.0" 200 139 "http://www.keystonesoldiers.org/comment.php?sid=20040521205229571&pid=0&type=article" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705)"
156.110.79.14 - - [03/Jun/2004:02:17:20 -0500] "POST /article.php?story=20040514152149184 HTTP/1.0" 200 26183 "http://www.keystonesoldiers.org/comment.php?sid=20040514152149184&pid=0&type=article" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705)"
62.123.35.34 - - [03/Jun/2004:02:17:21 -0500] "POST /article.php?story=20040521205229571 HTTP/1.0" 200 21842 "http://www.keystonesoldiers.org/comment.php?sid=20040521205229571&pid=0&type=article" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705)"

This is getting really old.

So are those anonymous posts or are they using an account?

bye, Dirk

They were anonymous.

Hi, someone sugested on another topic the spam problems were language related (they search for a link named comments), i don't know if this is your case, but you could try to change comments on the lang file for something else, while the GL team solves the bug. Either that or you could install the stats plugin and the ban plugin and start banning ips.
Hope this helps you slow down spammers a litle bit.

Hmm, tried a few things (if you see some POST requests from a 217.x.x.x IP with no user agent string - that was me), but to no avail - they were all rejected, as expected.

Are you sure anonymous comments were off when that happened? Are they still spamming?

bye, Dirk

Yes the anonymous comments have been turned off for a couple weeks on that site. I double checked when this last round started. It was only 2 but they still got through.

The log entries directly before that were for an msnbot64045. It looks like they did some kind of search and found something to get them in.