This morning I noticed that this website was very slow to load, which is very unusual as it sits on a pretty powerful dedicated machine. When I was finally able to SSH into the server what I found surprised me.
This machine was essentially under attack in that bots were trying to submit comments to the site in the 100’s along with that their was a huge number of instances of TrackBack request coming in.
The IP’s were from a couple of machines so I simply added those machines to my firewall IP denial list. Within 30 seconds of doing that a new set of IP’s started hitting the machine.
So I played this game for about 30 minutes and to no relief as soon as I blocked a IP another would pop up. It looks like the comment spam and trackback spam bots are evolving and somewhat out of control.
I would normally be sleeping when this attack happened so I am going to have to go back and look at the log files to determine how long this has been happening.
Sounds like you need something like Denyhosts.
http://en.wikipedia.org/wiki/DenyHosts
It’s for ssh attacks, but maybe it is configurable to block the problems you are seeing.
-Greg