referrer spam

One of my low-traffic sites was hit with significant trackback spam. We found out when we were notified by our hosting provider of a significant bandwidth overage for the month.

The spam module was doing a great job of keeping the spam out, but due to the flood of trackback requests during a sustained period, we experienced a massive increase in traffic.

I have now disabled trackbacks on that site (ti's the only site I had set up to allow trackbacks) and have enabled the spam module's "Trackback Black Hole" module so that all trackback requests are dropped immediately.

I've seen a significant increase in referrer spam lately. Starting a few months back, I saw the referrer 'alti.asu.edu' rise to the top of my "Top Referrers in the past N days" logs - along with apparent automated account sign-ups by 'nareman' and comment spam with 'people' in the title.

Banning IP addresses was pointless - a waste of time, because the IP addresses used varied widely over time, and the access patterns seemed to ensure that the spammer wouldn't trigger any kind of flood control - the IP addresses shifted often enough that the IP addresses wouldn't rise to the top of the 'Top Visitors' log. It was like playing Whack-a-mole -- by the time the IP address was on the radar screen, it was too late, the bot was using a different IP address.