New Message: Re: Ugly Spam Attack against Manila sites

[webmaster at userland.com]

A new message was posted:

Address: http://manila.userland.com/discuss/msgReader$2510

By: Steve Hooker (steve at cybersaps.com)

I've had a mass delete for several years. I based it on Dave Winer's myCommentSpamBuddy.root and a large table of spam keys.

I add a spam key, and every night it goes through all the sites I host (several hundered) and marks as fDeleted: comments and discussion group messages. It also properly deletes trackbacks.

Also any member which has posted these messages or comments are deleted, and so are all their messages and comments.

Each time a new member is created (I don't use authorisation methods) an email is sent to the MEs, inside is a link to delete the member and all their messages.

I gather said deleted members, just in case they are deleted in error, and if necessary I restore (nightly) and all their messages.

With the new spam key, I further block any future comments, messages and trackbacks which use this key.

I have a zero tolerance policy with spam.

The only weakness I have, regarding mass deleting, is the junk 'probe' trackback spams I receive. There are no keys! All domains, excerpts, titles are pure nonsensical type. All originating IPs too are spoofed. I've yet to spot any commonality which I can use as a pattern to block or delete. Thus, they're to be deleted through the link in the email that I provide to MEs. (I'm BCC'd on these and usually delete them first.)

Should these continue, I will provide a page for ME's to see the last few days of TBs, where they can tick check boxes and mass delete on one page. (Currently, I provide a page listing all TBs with details and a delete checkbox.)

However, I suspect these nonsensical TBs are probes, and once the spammer figures that their real TBs are blocked, they move on to more vulnerable sites.

Steve Hooker

http://www.blogfrootball.com/service

http://www.walsallschools.org/

This is a Manila site... http://manila.userland.com/.