Pete's QBASIC Site

Posted: **Thu May 05, 2005 7:19 am**

I have been having exactly the same spammers trying to fill the guestbook on my site with this stuff. As far as I can tell, the people are using random proxies (most of the IPs don't resolve, but those that do contain 'proxy*'. One resolved to Hong Kong, one resolve to New Zealand, etc.

I've temporarily fixed the solution on my site by updating my guestbook script with these bits of code:

Code: Select all

	if(checkForBullshit($frmName) || checkForBullshit($frmEMail) || checkForBullshit($frmComments))
	{
		// add this person's IP address to the banned IP list.
		if($fd = fopen("spammerips.txt", "a"))
		{
			$textout = $_SERVER['REMOTE_ADDR'] . "\n";
			fwrite($fd, $textout);
			fclose($fd);
		}
		
		header("Location: http://www.dontadvertiseonmysiteyouscumsuckingpseudocorporatemorons.com/");
		exit(0);
	}


// ...

	function checkForBullshit($in)
	{
		if(	stristr($in, "poker") ||
			stristr($in, "holdem") ||
			stristr($in, "casino") ||
			stristr($in, "andrewsaluk") ||
			stristr($in, "gambling") ||
			stristr($in, "gamble") ||
			stristr($in, "p0ker")
			)
			return true;
		
		return false;
	}

Maybe you could make a similar modification. It's very primitive, but will most likely confuse the lowlife scum. If it -is- a bot doing this (I can see that it might be possible), they will be redirected to some other URL, assuming the code is developed enough.

If the script catches more people trying to spam it, then it's just a matter of adding the banned IPs to the .htaccess (I didn't want to let the script write directly to the .htaccess file for security).

Posted: **Mon May 09, 2005 4:38 pm**

Additional note: since implementing this code a few days ago, I have already caught 3 IP's trying to post the spam on my site:

211.185.59.122
81.12.12.34
207.228.102.55

It seems to be working well. None of them have bothered trying to disfigure the text to get around the filter either. Only one attempt is done per IP, which is leading me further to believe that it is indeed a bot doing this.

Posted: **Mon May 09, 2005 6:05 pm**

It's probably a bot...

Ther has been a few more posting.. but I've deleted them as soon as I've seen them...

Usually less than three hours after they've been made..

It's not that much of a problem anymore..

Pete's QBASIC Site

Spammer and the site database