Technical Blog

The amount of spam on the P2P Money blog has fallen, but the majority of spam now originates from the USA.  Looking at the spam, there is one IP address that has been sending multiple spam messages.  It is therefore apparent that the spammer has a fixed IP address and probably running a server, and therefore blocking it is the best course of action.  The spammer will then receive a time-out when attempting to access this site again.

It is unfortunate that countries aren't doing more to tackle spam as these spammers aren't adding any value to society and are just wasting resources of legitimate companies and individuals.

After blocking all Chinese IP addresses there has been a marked reduction in spam.  I've put together the top 5 countries originating spam on the P2P Money website.

1. China
2. Russia Federation
3. United States of America
4. Ukraine
5. Indonesia

I've now blocked all Russian and Ukrainian IP addresses.  Unfortunately P2P is also big in the United States, and the website does have readers based in America, so I won't implement a generic block at this stage.

Webmasters should never underestimate the power of Google. Looking at the webstats that Google Analytics provides for my web site, over 40% of the traffic originates from a Google search. It is therefore important to make sure your site has registered with Google (and the other search engines) and that you have an up-to-date XML sitemap in your robots.txt file.

User-agent: *
Sitemap: http://www.p2pmoney.co.uk/sitemap.xml

It is also important to keep up-to-date with how your site appears within various web searches.  This will show you what people are searching for and where your site appears within the results.  For example the search compare business loan rates the P2P Money website appears at number 2, ahead of Money Facts, RBS, Barclays, Natwest, GoCompare and Compare the Market !

I'm sure everyone know how annoying it is to receive spam.  While this is now illegal in some counties, it doesn't stop people sending it.  The best cure is not to get onto any spammers list.  One source for email addresses is websites.  There are bots that are designed to harvest email addresses from pages on the internet.  These will then be sold to scammers, and your address will forever be on this list.  There are no opt-outs from scammers !

The best prevention is to not expose your email address.  This can be done with a contact for, but sometimes it looks better to potential customers to have a contact address.  There are lots of suggestions to prevent your address from being harvested, such as using CSS, replacing the @ character with @ or using an image, but if you want to have a mailto: link on your email address you'll need to include the full address.  However there is one thing that bots can't do yet and that is to process JavaScript.  So provided the email address isn't in easily recognised then this will be your best approach.

<script type="text/javascript">writeEmail('fred.bloggs');</script>

The function writeEmail() can then be used to perform a document.write() to write the full HTML, so it is correctly rendered for the user.

With any blog or forum you'll get spam, and certainly the P2P money blog and the P2P money forum are not any different.  I've always advocated a "light touch" approach to moderation, and with the blog and forum I'm still sticking to this.  However I make sure that any comments on the b2evolution blog are moderated.  On the phpBB forum the first few posts are also moderated.

Spammers on the blog will have their unpublished comments deleted, and more importantly the spammer will be banned, not just from the P2P money blog, but from all other b2evolution blogs.  Spammers on the forum will have their posts and account deleted, and their email address and / or IP address blacklisted.

All of these features will mean that no spam should be visible, but it does require some work on the moderation front.  More recently the b2evolution blog has been hit by large amounts of spam posts.  To reduce the moderation required, I've looked into what can be done to prevent this from happening in the first place.

By looking at the IP address of the spammers, the majority are - sadly - from China.  As the P2P money website is dedicated to peer-to-peer lending in the UK, there would be little genuine traffic from China, so the simplest solution is to block all Chinese IP addresses.  There are several sites on the internet that can list all Chinese IP addresses, but one good one is here.

Another useful tactic I found was to block all HTTP POSTs that don't originate from your own site, or those without a HTTP user agent.  For an Apache web server here is the additional instructions that need to be added to the .htaccess file.

# Block posts that don't originate from site, or if the user agent is not specified.
#
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://blog.p2pmoney.co.uk [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) http://%{REMOTE_ADDR}/ [R=302,L]
</IfModule>

While a GET can occur from any web site, a POST should only originate from your own site, in this case http://blog.p2pmoney.co.uk.  What this will actually do is redirect the POST back to the remote address that sent it through a HTTP 1.0 302 redirect.  This will then generate unwanted traffic on the site - if one exists - of the spammer, as well as preventing the spam in the first place.