WordPress Comment Spam from Amsterdam? IP Address 94.102.60.152
November 12th, 2008Today I received four similar spam comments in my WordPress blog. All four had email addresses that appeared to be randomly generated, and the comments were a single line of randomly generated letters and numbers, like j2miob2e5gylwz9w. But the interesting thing is: that they are all from Amsterdam.
Here’s the IP addresses:
94.102.60.150
94.102.60.151
94.102.60.152
94.102.60.153
See, they’re from Amsterdam: http://ws.arin.net/cgi-bin/whois.pl?queryinput=94.102.60.152
So I’ve decided to block 94.102.60, since I don’t expect many clients from Amsterdam.
You can block IP addresses from commenting on your WordPress blog, by clicking on Settings, Discussion, and scrolling down to the bottom box labeled Comment Blacklist and entering the IP address in the box.
Now, it’s also possible this is automated - and if that’s the case, then I might need to install some Captcha on my blog like I currently have on my contact form - so that only humans can write comments - but I’ll wait to see if I get more of these.
Looks other folks are having the same spam issue as reported in the WordPress forum. And some of these folks believe it’s malevolent - that our blogs are being collected for some future spam attack. Here’s another blogger who’s writing about this issue. And yet another one here.
If you’re seeing this…please leave me a comment!
UPDATE: 11/15/08 NOW SEEING THESE CAUGHT BY AKISMET
I’m now seeing these spam comments being captured by Akismet - and I’m not sure whether this is related to them being on the blacklist, or not. The IP addresses match, so I figure it’s unlikely that the blacklist is missing them and they’re being caught by Akismet at exactly the same moment in time - but I’m not 100% sure how Akismet works with the comments blacklist. I found this article in WordPress on combating spam, but wasn’t sure which is activated first, the blacklist or Akismet. Is Akismet catching them on it’s own? Or is the fact that I added them to the blacklist helping Akismet catch them? The article on combating spam seems to indicate that Akismet does indeed use the blacklist (at least the words, no mention of the ISP one) to learn about spam.
Maybe all of us adding it to our blacklist helped teach Akismet? Wouldn’t that be cool?
--------------
J. Olkoski
Aldebaran Web Design, Seattle
Jill Olkoski has a BS in Engineering, a BS in Computer Science and an MA in Clinical Psychology. She delights in using her advanced technical and psychological skills to help small business owners develop cost-effective and successful websites.
November 12th, 2008 at 8:45 pm
I have received spam comments today on my WP blog and they are still coming-so over 30 from the same 4 ip’s:
94.102.60.150
94.102.60.151
94.102.60.152
94.102.60.153
Every 30 minutes i check back and there are more.Thanks for the info. on how to block.
November 12th, 2008 at 9:17 pm
Thank you!
November 12th, 2008 at 9:20 pm
I had the same spam recently, though just from 152 and 153. And this was the first commenter I ever had to blacklist! I wasn’t sure if I should blacklist the full IPs, or 94.102.60.
November 12th, 2008 at 9:23 pm
I’ve been experiencing this same issue all day today. I was so frustrated because Akismet wasn’t catching it. Thanks for the tip on how to prevent it!
November 12th, 2008 at 9:24 pm
Thanks for this information. I got the same spam emails today. It did seem strange, but I just deleted them. I’ll go back in and block that address.
November 12th, 2008 at 9:32 pm
Ditto on the thanks; I’ve shared your info via Twitter: http://twitter.com/ariherzog/status/1003280478
November 12th, 2008 at 9:35 pm
Wow, I’ve never been twittered before…thanks very much Ari and Scott!
To Gretchen - be sure to block all of them, not just one.
November 12th, 2008 at 9:37 pm
Tara,
Yes it is strange that Akismet isn’t catching these - although perhaps somehow it will “learn” once we all label them as spam. Not quite sure how Akismet determines stuff is spam. Rocket science!
November 12th, 2008 at 11:22 pm
Same here. I blocked the IP with a wild card. Six spams so far.
November 12th, 2008 at 11:50 pm
yeah, chiming in with the thanks - also having this problem today, dropped by via Ari’s Twitter.
November 13th, 2008 at 12:03 am
Good to know I’m not the only one. A lot of other people are seeing the same thing. If you use Twitter, please get the word out … I did http://twitter.com/harrytheASICguy/status/1003334133 . This is the fastest way to reach lots of people that otherwise may be harmed by this. Two questions for anyone who can answer:
1) Will blocking 94.102.60 block all the subdomains?
2) Will this work in the .htaccess file as well, i.e.
deny 94.102.60
harry
November 13th, 2008 at 12:51 am
I’m seeing it too. I’m going to block the 94.X.X.X block at firewall/server level. Screw this, I’ve gotten like 30 in the last 3 hours.
November 13th, 2008 at 2:28 am
I got linked to you via twitter - thanks for posting!! It’s amazing how many of us are being affected… I imagine we’ll see an Akismet update shortly so we can unblock these IP addresses and future code-only messages like this are dealt with automatically. It’s definitely automated (perhaps it’s so that the email address is validated, which will automatically give that address permission to post a comment in future under some people’s settings). I don’t plan on installing Captcha just because of one clever hacker in Amsterdam
November 13th, 2008 at 7:11 am
I got a couple of those. I always leave my site set so that a new poster has to be approved…Akismet is never perfect, and you never know who (or what) might stop by. It is annoying…
Thanks for the tip on the blocking … but I might get readers from Amsterdam, being an author…I’d hate to block an IP range and find out that it was only in use because it had been hacked…
David
November 13th, 2008 at 9:13 am
I’ve been getting these for the last few days also. It’s just a few, but it’s annoying that it isn’t being caught by Akismet.
November 13th, 2008 at 2:29 pm
I got four or five of them yesterday and wondered why Akismet wasn’t catching them. I haven’t made any changes or blocked anything, but I haven’t gotten any more today…so, maybe Akismet is catching them now?
November 13th, 2008 at 3:58 pm
Hi Stephen,
I suppose the answer to that is in your Akismet section…it keeps track of what it catches…are you seeing them in there?
November 13th, 2008 at 4:35 pm
I just received for the 1st time ever a couple of these SPAM comments on my WordPress blog this week. I could not figure out what they were because a comment wasn’t showing up on my blog entries, so I just deleted the email notice and forgot about it. So thank you for the tip on how to block them.
November 13th, 2008 at 4:37 pm
Hi Katie,
It’s amazing how this spam is hitting everyone. Nice to hear from you!
November 13th, 2008 at 4:41 pm
Hi Jill,
I started noticing these “attacks” about a week ago and they have steadily increased in frequency to the point that I had to have my site rebooted due to something weird happening after an especially heavy spam hit. I’ve now blocked all the offending IP’s, so hopefully I’ve seen the last of these pests. I wasn’t aware of how wide spread this was until today, when I decided to do a search. Thanks for your helpful article!
November 13th, 2008 at 4:48 pm
Hi Scott,
It certainly appears wide spread, that’s for sure. Glad you found this useful. It’s the fun thing about blogging, you get to vent and help other folks out at the same time.
November 15th, 2008 at 9:55 am
Folks,
Please see my UPDATE at the top. I’m now seeing these being caught by Akismet!
November 17th, 2008 at 3:37 am
I have been coping the same thing for the past few days, i was hoping it would just stop but from the looks of this thread its not going to.. will be blocking ip’s tonight.
November 17th, 2008 at 7:35 pm
Another UPDATE: I’m getting more spam from RIPE in Amsterdam:
http://aldebaranwebdesign.com/blog/more-amsterdam-spam-212955438-from-ripe/
November 18th, 2008 at 8:08 am
I also have gotten spam from those IP’s and others. One thing I noticed in my version of WordPress is that blacklisting them makes the comments get automatically marked as ‘spam’, but they still are stored in my WordPress database. I started to notice that the size of my DB was growing a lot and had to implement a script to an query to clear them on regularly. Is there something I’m missing, because it seems stupid to me that the wordpress program would have a “feature” where comments are made invisible to the owner of the site and yet are kept in the database to take up space forever.
November 18th, 2008 at 3:42 pm
Comment removed by moderator because it violated Discussion Rules.
November 18th, 2008 at 8:49 pm
Hi Chris,
Thanks for the comment!
November 19th, 2008 at 9:01 am
I also experienced like this. I didn’t know how to blacklist. Thanks for this post. Very informative!
November 21st, 2008 at 6:08 pm
Did we get the right culprit?
I can see why they’d be upset if the wrong person was labeled, blacklisted and akismeted.
November 22nd, 2008 at 10:16 am
Hi DG,
Well, all I know, is that the IP addresses listed above, that I blacklisted, are now correctly being captured by Akismet, which means they aren’t showing up a normal comments, which is just what I wanted to happen. The comment by Tseung about “RIPE” was really meant for another posting of mine. In fact, I’m not sure why he posted it here, so maybe I’ll remove it.
December 13th, 2009 at 4:25 am
The same happened on my blog as well. This time the culprit was a ukrainian IP. Akismet is doing a great job in filtering the junk, just don’t get why it is letting them through in the first place.
February 18th, 2011 at 3:20 am
I have the same problem, different IP, but also from Netherlands and I think that from Amsterdam too.