Another blog comment spam band-aid attempt...
Category Blogging
Since I don't have enough time right now to code some solution that addresses the root problem, I have another band-aid attempt for the symptom. In the "Kill Orphaned Spam Comments" agent, there's a loop that I modified to do double-duty. Right now it just removes comments that aren't tied to any particular story. Now it also checks for a common string that's being used in all the entries. Here's the code change:
Do While Not(doc Is Nothing)
If doc.GetItemValue("Form")(0) = "StoryResponse" Then
If doc.HasItem("$REF") = False Then
Set deldoc = doc
End If
End If
'Kill off some blog spam...
If Instr(1, doc.Body(0), "TheStringGoesHere", 5) > 0 Then
Set deldoc = doc
End If
Call s.UpdateProcessedDoc(doc)
Set doc = col.GetNextDocument(doc)
If Not(deldoc Is Nothing) Then Call deldoc.Remove(True)
Loop
I think if you're getting hit with this, you can figure out the .com address string that shows up in all the entries. I'm not going to highlight it here because I don't want any search hits on it. If you want to know the string I used in place of "TheStringGoesHere", just email me...
Update: A couple just came in without any URLs. It may be a mistake, but it's still using the common set of two word starting phrases for the posts. I've stretched out the agent to cover those strings too. Again, email me for the actual code...
Since I don't have enough time right now to code some solution that addresses the root problem, I have another band-aid attempt for the symptom. In the "Kill Orphaned Spam Comments" agent, there's a loop that I modified to do double-duty. Right now it just removes comments that aren't tied to any particular story. Now it also checks for a common string that's being used in all the entries. Here's the code change:
Do While Not(doc Is Nothing)
If doc.GetItemValue("Form")(0) = "StoryResponse" Then
If doc.HasItem("$REF") = False Then
Set deldoc = doc
End If
End If
'Kill off some blog spam...
If Instr(1, doc.Body(0), "TheStringGoesHere", 5) > 0 Then
Set deldoc = doc
End If
Call s.UpdateProcessedDoc(doc)
Set doc = col.GetNextDocument(doc)
If Not(deldoc Is Nothing) Then Call deldoc.Remove(True)
Loop
I think if you're getting hit with this, you can figure out the .com address string that shows up in all the entries. I'm not going to highlight it here because I don't want any search hits on it. If you want to know the string I used in place of "TheStringGoesHere", just email me...
Update: A couple just came in without any URLs. It may be a mistake, but it's still using the common set of two word starting phrases for the posts. I've stretched out the agent to cover those strings too. Again, email me for the actual code...
| Permalink |
Comments
Posted by Richard Schwartz At 19:19:43 On 14/05/2006 | - Website - |
Seriously... I have no doubt that you're a far better developer than I am (witness the OpenNTF mail template)...
Posted by Duffbert At 16:12:52 On 12/05/2006 | - Website - |
Posted by Duffbert At 18:48:04 On 12/05/2006 | - Website - |
And Rich... No, BlogSphere was not blocking things for me. The only way I know of that sends the "Blocked" email is if you match the IP address being comment-blocked (I wrote that piece some time back). Since all my blog spam was coming from various IP addresses (zombie bot network?), I couldn't use the IP comment blocking.
Now, having said that... There may be some new feature in the upgraded BlogSphere that I'm still ignorant of...
Posted by Duffbert At 12:29:15 On 13/05/2006 | - Website - |
@If(HTTP_Referer=""|txtParentUNID="";"0";"1")
The thought is that if the spammers are using an automated mechanism that doesn't tie to an actual story page hit, then the HTTP_Referer will be blank and the comment will never be saved...
Let's give it a try... This one should stay put.
Posted by Duffbert At 18:46:42 On 12/05/2006 | - Website - |
Posted by Duffbert At 19:40:31 On 11/05/2006 | - Website - |
Posted by Richard Schwartz At 21:33:02 On 11/05/2006 | - Website - |
http://www.openntf.org/Projects/pmt.nsf/66d9103768cc2fed85256c59006b5433/c04e11c34ad6e0e98625713100629820!OpenDocument
Posted by Vince Schuurman At 11:10:23 On 12/05/2006 | - Website - |