On 2/25/06, Nuno Lopes <[EMAIL PROTECTED]> wrote: > > Maybe throttling? > > You know - if one IP: > > 1. sends a lot of comments in one day and > > 2. IP is not in a white list and > > 3. these comments are identical and > > 4. there is a short period between comment posts > > these comments are grouped together with some flag and become hidden > > until somebody from php-notes ML either approves or deletes them. > > We already have a system to limit the number of notes per IP per hour. > The problem is that they come from different IPs... >
Well, if there is no IP then you can can combine point 1 with 3 and leave that rule alone. I.e. 1&3: if there is a lot of identical comments (md5) sent in one day. An additional check is point 4. there is a short period between comments. In any case if you can calculate md5 - you can make a query for a day or too to get identical spam messages (group them together) - and delete spam comments all at once. Of course the concept can be even more sophisticated - for example flag messages containing foul words or according to calculated "distance" between good and bad message criteria. -- --t.
