Guestbook spam

I keep getting these entries in my guestbook from moderndedicate.com

I use the latest adv. guestbook version!

Any ideas how to get rid of them??!? The host does'nt even seem to exist..

[root@linux 2005-10-28-05:00:44]# ping ezz-box227-162.moderndedicate.com
ping: unknown host ezz-box227-162.moderndedicate.com

And I get these in my Apache log:
ezz-box227-162.moderndedicate.com - - [28/Oct/2005:02:59:17 +0200] "POST /guestbook/addentry.php HTTP/1.1" 200 1007 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

Tried to block the domain with a deny directive in httpd.conf but somehow they still manage to sign my GB.

Yes I see what you mean. Have a look at http://proxy2.de/forum/viewtopic.php?p=10108&highlight=#10108

The apache log should always log the ip and not the hostname. Very weird. I did manage to get moderndedicate.com resolves to 65.254.51.100. If you wanted to you could try reporting the spam to one of the suport staff listed on http://www.moderndedicate.com/en/

moderndedicate.com looks to be a ghost, not really a working site.
Probably to cover spam activity.

The owner seems to be a russian:

Tchibrikov Konstantin Yurievich
Kotowskogo str., 5v, apt. 52
Smolensk 214027 RU
Tel. +7.0812637562

Email: tchibrikov@mail.com (no anwers from it)

If you search into Google "moderndedicate.com guestbook" you'll find that "a bastard" is spamming more than 800 Advanced Guestbooks...!

I'm not able to stop it with short leghth of message limitations, IP banning and so on...

I found the IP of the spamming host in my Apache access log..

65.125.227.162 - - [07/Nov/2005:20:53:04 +0100] "POST /guestbook/addentry.php HTTP/1.1" 200 1007 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

And it resolves to ezz-box227-162.moderndedicate.com

Name: ezz-box227-162.moderndedicate.com
Address: 65.125.227.162

This idiot has been spamming my guestbook for months (and like 1000 other guestbooks too). I've contacted tech support at moderndedicate.com and he was like "Yeah, I'll take care of that", but the spam keeps coming, so it wouldn't surprise me if they're in on it...
Anyway, now by checking the web server logs I've finally managed to get my hands on the ip number. Hopefully it'll stop now.

Edit: Oops, beaten like a red-headed stepchild.

Yeah it stopped.. I put it in my Apache configuration as a Deny directive..

[Mon Nov 07 22:27:45 2005] [error] [client 65.125.227.162] client denied by server configuration: /home/httpd/html/guestbook/addentry.php
[Mon Nov 07 22:28:18 2005] [error] [client 65.125.227.162] client denied by server configuration: /home/httpd/html/search
[Tue Nov 08 00:03:23 2005] [error] [client 65.125.227.162] client denied by server configuration: /home/httpd/html/guestbook/addentry.php
[Tue Nov 08 00:03:55 2005] [error] [client 65.125.227.162] client denied by server configuration: /home/httpd/html/search
[Tue Nov 08 01:38:23 2005] [error] [client 65.125.227.162] client denied by server configuration: /home/httpd/html/guestbook/addentry.php
[Tue Nov 08 01:38:56 2005] [error] [client 65.125.227.162] client denied by server configuration: /home/httpd/html/search

Well you could either add it to the IP ban list of the guestbook or block it totaly by using your .htaccess file.

After 24 hours "0" spam, so it works !

Thanx Suid and all of you!

bob