3

A couple of my sites are getting slammed by a hyperagressive distributed spambot. It's just pure link spam. It all comes from one user name, but from a variety of IPs.

Akismet is catching the spam, so my sites aren't defaced. But it's affecting performance.

What is best practice, if any, for mitigating this?

Edit There are about 400 of these in 24 hours. They're coming from a rotating bunch of IP addresses. There are between five and ten hits from each address.

  • 60.173.9.*, 60.173.10.* and 60.173.11.*
  • 112.123.168.*

Both of these address ranges are assigned, according to apnic.net, to ISPs in China.

(I'm guessing malware-infested cybercafes, but who knows?)

Again, is there a best practice to deal with this junk? Or just let akismet do it?

Improve this question
4
  • When you say same username, you mean the "Name" field for the comment? And are the IPs always changing, or cycling through a fixed pool of them?
    – TheDeadMedic
    Apr 30, 2014 at 12:32
  • Is the name something sufficiently unique that normal visitor wouldn't use? Blacklist it if so. Not sure how that would interact with Akismet from performance point of view since its network requests might be what is chomping resources.
    – Rarst
    Apr 30, 2014 at 14:04
  • Please see edits.
    – O. Jones
    May 1, 2014 at 12:43
  • Just block those IP addresses. Everything that involves starting WP is too slow.
    – fuxia ♦
    May 3, 2015 at 1:01

3 Answers 3

Reset to default
1

One surprisingly useful solution to foil most spam-bots is to use a honeypot. Put an extra entry field into your comment forms, and then hide it with css. Normal users won't fill it in because they won't ever even see it. Based on that, you can safely assume that anytime an entry is made with that field filled, that it's a bot and you can just discard/mark it as spam.

Improve this answer
0
  1. Remove the website URL field
  2. Remove any comment form allowed tags
  3. Configure discussion settings so all comments must be approved by admin
  4. Disable anyone can register setting
  5. Add a captcha to your comment form as a last resort

I think they are looking for forms which include the words email, website and comments so if you remove all those words you should reduce spam.

Improve this answer
-1

The Simple Security Firewall has 100% catch rate on automated spambots without analysing the contents of the spam or any IP addresses etc. It doesn't need to.

Plugin: https://wordpress.org/plugins/wp-simple-firewall/

Enable the Comments Filter feature, and then turn on the spambot anti-spam. Within that section, you can set it to outright reject the spam and redirect back to the home page. In this way, processing of the spam stops immediately and thereby reduces your server load

By using IP-address based detection for this is useless, and increases your server load due to ever-increasing IP lookups on the database.

Try out the spambot filter on that plugin.

Improve this answer
3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.