More nukeSPAM blocking fun

Site Admin Joined: Jun 04, 2004 Posts: 6433

If your site is targeted for spammers, and you'd like to take some of the load off nukeSPAM or reduce server load of calls to spam blocking databases, it's interesting to note that many spammers are repeat offenders and don't bother changing IP addresses.

A recent analysis of such a site yielded over 100 IPs that had been blocked more than 5 times, with one persistent prick failing over 200 times! This group accounted for almost 40% of blocked registration attempts.

Here's the SQL I used to identify the repeat offenders (maybe we can add some analytics like this to a future version of nukeSPAM, but for now, your favorite SQL tool will do):

sql Code:

SELECT INET_NTOA( ip ) , COUNT( * ) 


FROM  `nuke_spam_log` 


GROUP BY INET_NTOA( ip ) 


HAVING COUNT( * ) >5


ORDER BY INET_NTOA( ip )

Then, I exported this to CSV, prefixed the IP with "deny from " in LibreOffice Calc, and pasted it to the end of .htaccess. You can change the minimum count to some other number, but be aware that having too many blocked IPs can affect site performance. You should also be careful not to block valid search engine IPs that have been spoofed.

Posted: Mon May 25, 2015 3:23 pm

A correction: since the repeat offender's IP address is logged, nukeSPAM will not call the spam blocking databases again if configured appropriately. It will recognize the previously blocked address and block again.

Posted: Mon May 25, 2015 4:08 pm

Thanks for this information. I didn't have the time to check this but it could be true!