UPDATE: It’s working! Thanks to everyone who made suggestions.
Also, as with any change to our filters, we’ve tried to be as careful as we can not to block innocent posts. But it’s always possible that I didn’t design or implement this quite right, and that it will inadvertently catch your innocent post. If it does, please let us know, as soon as possible. Thanks!
(Original post:).
There is a famous blog-spam-bot which we particularly hate. It sends more spam than all of the rest of the spam world, combined. And it uses a set formula which I’d like to take advantage of. The bot draws from a list of 12 names and 16 domains, and all the spam it sends uses e-mail addresses constructed along this formula. I’d like to put in a regex instruction into our wp-comments-post.php file to keep out this bot. But I’m a terrible regex writer, and I can’t get it to work.
The bot’s formula (which I’ve learned through sad experience) is as follows: The names it uses are otard, napoleon, luba, johndoe, jane_doe, huy_lo, grey_goose, gocha, bushmills, azaddin, absolut, and absinth. The domains it uses are aol, yahoo, usmail, bigfoot, mail, tech, see, come, classnet, work, arrivo, does, rocketmail, |mainl, freemail, and hotmail.
Every spam that this bot sends (and it sends out hundreds a day) is built using those names, those domains, and a set of random digits after the name and before the @ symbol. So our most recent spams show the e-mail addresses:
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
etc.
Given the bot’s predictability, I’d like to run a command in my wp-comments-post.php file that runs a regex search on all comments and doesn’t let through the ones with a combination of that name and domain.
Here’s what I tried (which didn’t work):
// $regex = (otard|napoleon|luba|johndoe|jane_doe|huy_lo|grey_goose|gocha|bushmills|azaddin|absolut|absinth)[-w_.]*(aol|yahoo|usmail|bigfoot|mail|tech|see|come|classnet|work|arrivo|does|rocketmail|mainl|freemail|hotmail);
// if (@preg_match($regex, $email))
// die( __(‘Sorry, but some of the content of this comment appears to violate our comment policies. This determination has been made using filtering software. If you believe you have received this message in error, please contact us by e-mail as soon as possible. Thank you.’) );
It’s giving me a parse error when it hits the brackets. Does anyone know why that is? (Or better yet, does anyone know what I would need to put in to the wp-comments-post.php file to run that regex?)
Muchas gracias.
test comment.
Just a guess because I don’t know php, but the regular expression isn’t enclosed in quotes, so the php script may be thinking that the parentheses are some kind of equation, and then it wouldn’t know what to do with the brackets.
Also, I think the “-” within the brackets should be a “”, and because “\w” won’t match an @, you will need an “@” before you start listing the domains.
So after adding the quotes, replace the following:
[-w_.]*
With:
[\w_.]*@
But understand that putting regular expressions like this in your script will stop one spam attack only (unless the spammer’s not paying attention).
Kaimi, try this:
$regex = (otard|napoleon|luba|johndoe|jane_doe|huy_lo|grey_goose|gocha|bushmills|azaddin|absolut|absinth)[0-9]*@(aol|yahoo|usmail|bigfoot|mail|tech|see|come|classnet|work|arrivo|does|rocketmail|mainl|freemail|hotmail);
Kaimi, try replacing the [-w_.]* part of the regex with [0-9]*@
To follow up on Derek’s suggestion, I don’t know PHP regex syntax either, but you probably want to escape the ‘.’ character as well, as that typically matches any single character:
[\w_\.]*@
If in doubt, it generally doesn’t hurt to escape everything:
[\w\_\.]*@
But really you’re just looking for digits, right? so what you really want is
[0-9]*@
well, i see I didn’t type fast enough
I’ve tested the following on my blog, and it seems to work (ignore text wrapping, it should all be one line):
$regex = “/^(otard|napoleon|luba|johndoe|jane_doe|huy_lo|grey_goose|gocha|bushmills|azaddin|absolut|absinth)[0-9]*@(aol|yahoo|usmail|bigfoot|mail|tech|see|come|classnet|work|arrivo|does|rocketmail|mainl|freemail|hotmail)/i”;
I made a comment on this earlier today including a working version, but I guess the spam filter caught it.
It’s working! If you want to see our impregnable spam barrier (hah!) in operation, you can try posting a comment using any e-mail address that would be generated by the bot’s algorithm. (Not with a comment you want to actually post). You’ll be blocked. Yay! (Example e-mails that will be blocked: [email protected] , [email protected] , [email protected] , [email protected] , [email protected] )
Thanks for the helpful comments, everyone who posted here (as well as DKL, who e-mailed me privately).
By the way, I also blocked about 2 dozen IP addresses that were being used by these spammers, last week. I blocked them at the htaccess level — why let them continue to use my bandwidth, my server resources? And now I see this lovely sight:
—
(Error logs)
[Wed Apr 13 14:36:03 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:36:03 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:36:00 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:36:00 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:35:26 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:35:26 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:35:26 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:35:26 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:35:15 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:35:14 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:34:38 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:34:38 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:34:37 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:34:37 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:34:27 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:34:26 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 14:34:26 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:34:26 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 14:34:00 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:34:00 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 14:33:59 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:33:59 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 14:33:46 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:33:46 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:33:02 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:33:02 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:32:14 2005] [error] [client 64.78.155.100] File does not exist: /home/seasons/public_html/index.rdf
[Wed Apr 13 14:31:54 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:31:54 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:31:22 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:31:22 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 14:30:49 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:30:49 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 14:30:36 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:30:36 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:24:54 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:24:54 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:24:45 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:24:45 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:24:05 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:24:05 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:23:42 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:23:42 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:23:40 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:23:40 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:22:45 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:22:45 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 14:22:44 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:22:44 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 14:22:28 2005] [error] [client 201.224.75.198] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:22:27 2005] [error] [client 201.224.75.198] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 14:22:25 2005] [error] [client 201.224.75.198] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:22:25 2005] [error] [client 201.224.75.198] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 14:22:23 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:22:23 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 14:22:02 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:22:02 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:22:01 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:22:01 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:22:01 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:22:01 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:21:57 2005] [error] [client 61.218.101.215] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:21:57 2005] [error] [client 61.218.101.215] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 14:21:52 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:21:52 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 14:18:52 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:18:52 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:18:47 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:18:47 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:18:31 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:18:30 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:18:30 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:18:30 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:18:11 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:18:11 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 14:17:47 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:17:47 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 14:17:42 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:17:42 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:17:31 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:17:31 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:17:30 2005] [error] [client 211.126.196.172] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:17:30 2005] [error] [client 211.126.196.172] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:17:26 2005] [error] [client 211.126.196.172] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:17:26 2005] [error] [client 211.126.196.172] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:17:02 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:17:02 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:16:58 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:16:58 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:16:57 2005] [error] [client 200.35.81.254] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:16:57 2005] [error] [client 200.35.81.254] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:16:47 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:16:47 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:16:47 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:16:47 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:14:25 2005] [error] [client 66.150.15.150] File does not exist: /home/seasons/public_html/index.rdf
[Wed Apr 13 14:14:07 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:14:07 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:14:07 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:14:07 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:13:50 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:13:50 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:13:45 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:13:45 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:13:44 2005] [error] [client 211.184.42.62] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:13:44 2005] [error] [client 211.184.42.62] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:12:44 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:12:44 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 14:12:43 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:12:43 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 14:12:02 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:12:02 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 14:12:02 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:12:02 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 14:11:43 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:11:43 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:11:32 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:11:32 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:11:28 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:11:28 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:11:24 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:11:24 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:10:22 2005] [error] [client 69.134.198.80] script not found or unable to stat: /home/seasons/public_html/cgi-bin/mt-tb.cgi
[Wed Apr 13 14:10:13 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:10:13 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 14:09:27 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:09:27 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 14:09:27 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:09:27 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 14:09:20 2005] [error] [client 61.218.101.215] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:09:20 2005] [error] [client 61.218.101.215] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:09:07 2005] [error] [client 61.218.101.215] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:09:07 2005] [error] [client 61.218.101.215] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:07:34 2005] [error] [client 203.199.92.158] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:07:34 2005] [error] [client 203.199.92.158] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 14:07:19 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:07:19 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:07:19 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:07:19 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:07:12 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:07:12 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:06:53 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:06:53 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:06:51 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:06:51 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:06:25 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:06:25 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 14:06:25 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:06:25 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 14:05:42 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:05:42 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 14:05:39 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:05:39 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 14:05:09 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:05:07 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:04:49 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:04:49 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:03:10 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:03:10 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:03:06 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:03:06 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:01:29 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:01:29 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 14:01:25 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:01:25 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 14:01:17 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:01:17 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:00:32 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:00:32 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:00:31 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:00:31 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 14:00:31 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:00:31 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 14:00:31 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 14:00:31 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 13:57:53 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:57:53 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 13:57:53 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:57:53 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 13:56:34 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:56:34 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:56:34 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:56:34 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:56:12 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:56:12 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:56:10 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:56:10 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:56:08 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:56:08 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:55:48 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:55:48 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:55:47 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:55:47 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:54:09 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:54:09 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:52:44 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:52:44 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 13:50:55 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:50:55 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 13:50:53 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:50:53 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 13:48:01 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:48:01 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 13:48:00 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:48:00 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 13:42:30 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:42:30 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 13:42:25 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:42:25 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 13:42:08 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:42:08 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 13:42:08 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:42:07 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 13:41:28 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:41:28 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 13:40:41 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:40:41 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 13:40:26 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:40:26 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:40:25 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:40:25 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:38:23 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:38:23 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 13:37:45 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:37:45 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 13:37:42 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:37:42 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 13:35:39 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:35:39 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 13:35:27 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:35:27 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:34:42 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:34:42 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:34:38 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:34:38 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:34:37 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:34:37 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:34:36 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:34:36 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:33:59 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:33:59 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 13:33:46 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:33:46 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 13:33:42 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:33:42 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:33:42 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:33:42 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 13:33:42 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:33:42 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:33:05 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:33:05 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 13:33:01 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:33:01 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp-comments-post.php
[Wed Apr 13 13:32:57 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:32:57 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/mt
[Wed Apr 13 13:32:56 2005] [error] [client 207.127.8.66] File does not exist: /home/seasons/public_html/mt/mt-tb.cgi
[Wed Apr 13 13:32:39 2005] [error] [client 207.127.8.66] File does not exist: /home/seasons/public_html/mt/mt-tb.cgi
[Wed Apr 13 13:32:34 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:32:34 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 13:32:20 2005] [error] [client 207.127.8.66] File does not exist: /home/seasons/public_html/mt/mt-tb.cgi
[Wed Apr 13 13:32:13 2005] [error] [client 64.78.155.100] File does not exist: /home/seasons/public_html/index.rdf
[Wed Apr 13 13:30:41 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:30:41 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 13:30:36 2005] [error] [client 61.218.101.215] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:30:36 2005] [error] [client 61.218.101.215] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:29:57 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:29:57 2005] [error] [client 212.141.90.195] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 13:29:47 2005] [error] [client 61.218.101.215] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:29:44 2005] [error] [client 61.218.101.215] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 13:29:01 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:29:01 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 13:29:01 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:29:01 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 13:26:40 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:26:40 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 13:26:40 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:26:40 2005] [error] [client 207.248.240.119] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 13:24:36 2005] [error] [client 61.218.101.215] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:24:36 2005] [error] [client 61.218.101.215] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
[Wed Apr 13 13:24:29 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:24:29 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:24:28 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:24:27 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp-commentsrss2.php
[Wed Apr 13 13:23:54 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:23:54 2005] [error] [client 148.244.150.57] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:23:54 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:23:54 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/archives
[Wed Apr 13 13:23:43 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:23:43 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:23:42 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:23:42 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:23:42 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:23:42 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:23:14 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:23:14 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 13:23:13 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:23:13 2005] [error] [client 207.248.240.118] client denied by server configuration: /home/seasons/public_html/index.php
[Wed Apr 13 13:22:30 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:22:30 2005] [error] [client 80.88.3.4] client denied by server configuration: /home/seasons/public_html/wp
[Wed Apr 13 13:20:28 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/403.shtml
[Wed Apr 13 13:20:28 2005] [error] [client 148.244.150.58] client denied by server configuration: /home/seasons/public_html/wp-comments-popup.php
For those who are counting, that’s 300 error messages (most of them double message, since they’re banned from 403.html as well, so they get blocked twice, first from the root and second from 403.html).
That’s the log between 1:20 and 2:30 this afternoon. And something like 5 of those aren’t server block messages. So just under 150 spam access attempts in barely over an hour’s time. And it’s all our friends in the Mexico City ring. (As far as I can tell, that’s the HQ of this one — some of its main IP addresses are Mexican).
(By the way, be careful with any “reply with text” of that error log message. Many of those IP addresses are also blacklisted on the software. I couldn’t post that as a comment myself, I had to post it as an edit).
Nice work, Kaimi.
You may be interested in this thread on spam fighting at the b2evolution forums. Some of the information is b2evolution specific, but some is of general interest.
of particular interest is the stuff on pinappleproxy.
VERY interesting, Bryce. I think I’ve got a new htaccess block to add in. Hopefully, it will keep these guys out for good.
Apparently, this ring is actually run by two Bulgarian twins.
See http://www.annelisabeth.com/pc/pc14.htm .
Wow, Bryce. Thank you for that link.
I dropped in the pinappleproxy block. Just to see how it would work, I disabled blacklist and regex filter for an hour.
And we got 2 spam comments, plus 5 attempts to access a non-existent mt-tb.cgi file. This, after normally running between 100-200 spam hits per hour.
This is definitely a keeper.
I’m glad it helps. M* isn’t being target by the pinapple spammer yet, but I recognized many of the names from the spam that crops up here.
COMMENT TEST.