Well, it’s the end of the first day of the new month, meaning I’ve got a new start on the stats. Now I can see how the referral spam is working. It is supposed to use the MT-Blacklist to filter out spam as it arrives (there’s no getting rid of it once it’s in, not yet), but there’s a snag: I just upgraded to MT-Blacklist 2, which does not publish a blacklist. And there was no way to enter new strings into the existing blacklist file. Fortunately, someone posted a script which would allow MT-Blacklist 2 to export a blacklist. However, there’s a snag.

MT-Blacklist 2 is supposed to import your old blacklist and incorporate it into its own, but mine clearly did not do that; there are 400 or 500 entries fewer in the new list than in the old one, obviously all of my custom entries. And since the referral spam is a mix of old and new spammers, I need all the data from both lists. And MT-Blacklist’s import function is badly broken (don’t start it, it will never end). Worse, the new MT-B seems to lack the ability to add new strings more than one at a time–which means that re-entering the strings from the old list would be a very laborious task.

Feeling that most of the spam I’ll get will be from new addresses, I decided to archive the old list and use a newly-generated list. And so far, the results are a mix of good and bad.

The good: it does seem that the referral spam is being blocked. After one full day, only 8 of the top 25 referrers are spammers, and most of them are brand-new ones that slipped in only a few spam before I caught them. So the list looks like it may be a lot cleaner than before. Additionally, the total tallies from last month’s referrals was encouraging: 17 of the top 25 were spammers, and the spammers in the top 25 unleashed a total of 1,637 spam. That is opposed to May’s figures, where fully 24 of the top 25 were spammers, who unleashed 10,000 spam hits. On top of that, June’s figures include unblocked spam from the first five days, 867 spams from that time span alone. Meaning that there was less referral spam in the last 25 days than there was in the first 5. So clearly the AwStats patch is doing its job.

The bad: the patch is not doing a perfect job. One gay porn spammer, for instance, has been leaving one spam hit regularly every four hours or so–and they’re somehow getting past the filter, despite being on the blacklist. Which means that there is a way around it. And if there’s a way around it, then eventually it is likely that all spammers will find their way around it. This is the part I was talking about earlier when I said that it was a constant battle of putting up defenses and the spammers working to get around those defenses.

So we’ll have to wait and see how long this solution works. At least I’ve got pretty airtight control over the comment and trackback spam. (Knock on wood)