CUNY Academic Commons

Thanks Boone.

I got an email about another comment last night at 9pm

A new comment on the post "Hello world!" is waiting for your approval
https://conftemplate.cunyac.reclaimhosting.dev/2018/10/18/hello-world/

Author: 111bedapp (IP address: 156.245.246.168, 156.245.246.168)
Email: admin@111bedapp.info
URL: https://111bedapp.info
Comment:
This app has completely replaced my usual downtime entertainment. The graphics are crisp and the game variety keeps things fresh every single day. I appreciate how they handle fair play transparency and how quick the support team is when I need a quick question answered. It truly feels like a community built around trust and fun. Explore more at <a href='https://111bedapp.info' rel="nofollow ugc">111bedapp</a>.

Approve it: https://conftemplate.cunyac.reclaimhosting.dev/wp-admin/comment.php?action=approve&c=28#wpbody-content
Trash it: https://conftemplate.cunyac.reclaimhosting.dev/wp-admin/comment.php?action=trash&c=28#wpbody-content
Spam it: https://conftemplate.cunyac.reclaimhosting.dev/wp-admin/comment.php?action=spam&c=28#wpbody-content
Currently 2 comments are waiting for approval. Please visit the moderation panel:
https://conftemplate.cunyac.reclaimhosting.dev/wp-admin/edit-comments.php?comment_status=moderated#wpbody-content

Laurie, I've disabled comments for the "Hello World" post on the conftemplate.cunyac.reclaimhosting.dev site. I previously disabled comments on that site, but didn't disable comments for each existing post. This should now be done.

somehow received another one over night

Conference Name <cuny-academic-commons@gc.cuny.edu>

4:01 AM (7 hours ago)

to me
--- Replying to this email will not send a message directly to the recipient or group ---

A new comment on the post "Hello world!" is waiting for your approval
https://conftemplate.cunyac.reclaimhosting.dev/2018/10/18/hello-world/

Author: shwecasino (IP address: 69.165.75.187, 69.165.75.187)
Email: admin@shwecasino.org
URL: https://shwecasino.org
Comment:
Shwecasino, been hearin' the buzz. Decided to check it out and not too bad. Interface is clean, and games are fun. Might be my new spot! <a href='https://shwecasino.org' rel="nofollow ugc">shwecasino</a>

Approve it: https://conftemplate.cunyac.reclaimhosting.dev/wp-admin/comment.php?action=approve&c=30#wpbody-content
Trash it: https://conftemplate.cunyac.reclaimhosting.dev/wp-admin/comment.php?action=trash&c=30#wpbody-content
Spam it: https://conftemplate.cunyac.reclaimhosting.dev/wp-admin/comment.php?action=spam&c=30#wpbody-content
Currently 1 comment is waiting for approval. Please visit the moderation panel:
https://conftemplate.cunyac.reclaimhosting.dev/wp-admin/edit-comments.php?comment_status=moderated#wpbody-content

Hmm, that's interesting that you are still receiving spam from the CDEV site, Laurie. Comments for the 'Hello World' post on the conftemplate.cunyac.reclaimhosting.dev are turned off, so I'm not sure how the spam is coming through.

I did check the server logs on CDEV (host cunyacdev-1.us.reclaim.cloud) against the spam comment's IP address and could not find entries from that specific IP address, though I did find spam from the 69.165.* IP range on the newsrefresh.cunyac.reclaimhosting.dev site.

Boone, does Reclaim use multiple servers for CDEV? If so, and you know the other hostnames, can you check to see if you are able to find the comment attempt from 69.165.75.187?

I had a look at the config for CDEV. There are two environments, cunyacdev-1.us.reclaim.cloud and cunyacdev-2.wc.reclaim.cloud. I went ahead and looked in the logs for cunyacdev-2.wc.reclaim.cloud and found the following:

litespeed@node15318-cunyacdev-2 /var/log/litespeed $ grep -nR 69\.165\.75\.187 .
./access.log:35624:"69.165.75.187 - - [[18/Sep/2026:08:40:02 +0000]] "GET /index.php?rest_route=/wp/v2/posts&per_page=100&_fields=id%2Ccomment_status&page=1 HTTP/2" 200 105 "https://testsitecc.cunyac.reclaimhosting.dev" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1" "testsitecc.cunyac.reclaimhosting.dev"" 
./access.log:35625:"69.165.75.187 - - [[18/Sep/2026:08:40:02 +0000]] "POST /wp-comments-post.php HTTP/2" 403 986 "https://testsitecc.cunyac.reclaimhosting.dev" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1" "testsitecc.cunyac.reclaimhosting.dev"" 
./access.log.2026_09_14:10690:"69.165.75.187 - - [[11/Sep/2026:08:01:06 +0000]] "GET /index.php?rest_route=/wp/v2/posts&per_page=100&_fields=id%2Ccomment_status&page=1 HTTP/2" 200 34 "https://conftemplate.cunyac.reclaimhosting.dev" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36" "conftemplate.cunyac.reclaimhosting.dev"" 
./access.log.2026_09_14:10692:"69.165.75.187 - - [[11/Sep/2026:08:01:06 +0000]] "POST /wp-comments-post.php HTTP/2" 302 0 "https://conftemplate.cunyac.reclaimhosting.dev" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36" "conftemplate.cunyac.reclaimhosting.dev"" 
./access.log.2026_09_10:25623:"69.165.75.187 - - [[07/Sep/2026:05:35:37 +0000]] "GET /index.php?rest_route=/wp/v2/posts&per_page=100&_fields=id%2Ccomment_status&page=1 HTTP/2" 200 3602 "https://newsrefresh.cunyac.reclaimhosting.dev" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "newsrefresh.cunyac.reclaimhosting.dev"" 
./access.log.2026_09_10:25624:"69.165.75.187 - - [[07/Sep/2026:05:35:37 +0000]] "POST /wp-comments-post.php HTTP/2" 302 0 "https://newsrefresh.cunyac.reclaimhosting.dev" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "newsrefresh.cunyac.reclaimhosting.dev"" 

So I guess this means that there is a second instance that at least sometimes is being accessed from the web. I don't recall how Reclaim originally set this up - using true load-balancing, or using cunyacdev-2 only as a failover. It may not really be worth investigating this further at this time. For the time being, I did the following to disable comments on the cunyacdev-2 and conftemplate as follows:

SITE_URL="https://conftemplate.commons.gc.cuny.edu" 

wp option update default_comment_status closed --url="$SITE_URL" 
wp option update default_ping_status closed --url="$SITE_URL" 

for POST_TYPE in $(wp post-type list \
  --public=1 \
  --field=name \
  --url="$SITE_URL"); do

  wp post list \
    --post_type="$POST_TYPE" \
    --post_status=any \
    --format=ids \
    --url="$SITE_URL" |
  xargs -r wp post update \
    --comment_status=closed \
    --ping_status=closed \
    --url="$SITE_URL" 
done