views:

153

answers:

2

My website's comment function is being constantly bombarded with spam posts from these two IP addresses:

  • 94.102.63.11
  • 83.233.30.42

I am currently blocking them at the text level since they all have:

weebly.com

in them, and I would think that if I block them by IP address then I might also block authentic users.

  1. Is it true that blocking IP addresses may also block authentic users with the same IP address, e.g. with a dialup provider?

  2. How can I find out who is running these spamming services?

  3. How can I and does it help to report these IP addresses to some central agency responsible for preventing spam on the Internet?

+7  A: 

It's easier for the spammers to switch address than it is for you to block them. It's likely that some spam will come from pwned computers.

Look what other sites are doing to manage spam.

Captcha
Moderate first posts
Let users report spam posts
Let valued users delete spam posts

gnibbler
+1  A: 

1) Technically, Yes, but... The odds that you would block a valid, bone fide, user are slim.
In some cases the IP belongs to a particular company (not a telco company, I mean), and therefore only agents from this company would be expected to come this way (or spammers using some relay/proxy at this company...)
In other cases, as seems to be the case here, the IP belongs to a telco company, i.e. an Internet Service Provider of sorts. In these cases one runs the chance of blocking a legitimate user if such user e happens to be in a geographic location where the ISP may supply this IP to them. This said, even by blocking the whole class C (i.e. all IPs starting by the first 3 octets of the address), the odds of ever having a valid user coming under this IP are small, in particular if the ISP/IP are from a country when you do not have many users.

2) By querying whois registies such as RIPE for Europe, ARIN for North America or APNIC for Asia-Pacific, one can find the registrant for the IP. In many cases this links to a TelCo/ISP type of company, however even in those cases it provides an idea of the origin.

3) In case of repeated/severe abuse it may be worth notifying (by mail or even phone), the contact associated with the IP. However given the pervasive nature of spam, many companies have found that building better barriers for their own mail system is preferable.
There is no "top" authority of the Internet which would have the ability to police spamming activity, however there are a few organizations which maintain lists of known spam-related domains and ips. It is possible to contribute suspected IPs as well as to subscribe to the blacklists.

mjv