So I started to see quite a few comment spam slip through the blacklists and get into moderation. Not too many, between 4 and 6 a day, but much more than usual. I wondered if it was due to some spammer figuring out a way past the blocking software, so I checked the numbers, and found that instead it was simply due to brute force. I quickly punched out the chart above, tracking numbers for the past 18 days (since I last purged my spam lists). On the chart, the black line is the total spam (including trackback spam); the blue line shows the number blocked by MT Blacklist, and the red line shows the ones blocked by SpamLookup. SpamLookup tends to block mostly trackback spam, about 95% of what it gets, whereas MT Blacklist gets the comment spam.

You can see that for the first week, it was going pretty much as it has been since I checked the numbers last August, just depositing a few hundred spam per day. Then there was a sudden spike on the 18th, and a more steady attack pattern after the 23rd. Considering that only 4-6 spam get through to moderation among floods of almost 2000 a day, that’s not bad–a block rate of up to 99.7%. And, of course, not a single one gets through moderation.

This made me think back to the days before mass comment spam. I installed MT Blacklist in December 2003, a little more than two years ago, because one spammer posted 50 comment spams on my site. Back then, 50 in one day was massive, the first time that sort of thing ever happened. And just four months previous to that, I got my first comment spam ever, a single comment, just a month after I started daily blogging. Now, just a few years later, 300 comment spams and 100 trackback spams per day is low traffic. Thank god that the vast majority of it gets filtered out in the background…