We Canadians are always overshadowed by the 10 larger in population US. If at all possible I like to highlight our accomplishments, or in this case, sophisticated comment spamming from Canada. Bad, Canada.
Comment spammers on my site usually use a single IP to first read the post, determine if they can submit spam, then submit the spam comment. This shows up in my Akismet spam comments. They are simple to identify and ban.
Dual IP comment spammers are tricky. They use one IP to read the post and use a different IP, usually not theirs, to POST the comment spam. Akismet displays the second spammer, the fake one. If you simply trust Akismet and ban the second IP the spammer will be back for a repeat performance. To track these down you need to see their entries in your raw access log. here is an example:
70.55.185.204 [22/Jan/2017:15:11:02 GET /wp/2012/03/18/map-of-toronto-crime-stats/ HTTP/1.0 200 33744
64.145.94.226 [22/Jan/2017:15:11:05 POST /wp/wp-comments-post.php HTTP/1.0 302 –
The actual spammer is from 70.55.185.204, Bell Canada, but the POST was done using the fake 64.145.94.226, BANDCON/IPVanish. If you simply ban BANDCON/IPVanish, Bell Canada will be back for more fun later.
70.55.185.204 hullpq .dsl.bell.ca dual ip poster to fake 64.145.94.226
73.166.93.171 .tx.comcast.net dual ip poster to fake 173.75.249.145
73.222.225.82 .ca.comcast.net dual ip poster to fake 50.71.193.129
74.58.139.170 .mc.videotron.ca dual ip poster to fake 104.174.74.208
83.252.56.158 .comhem.se dual ip poster to fake 92.37.75.111
104.174.214.56 Time Warner dual ip poster to fake 47.147.134.135
