Archived post from my old blog (2007–2016), restored from the Wayback Machine. It is published as written at the time; tools and versions are likely out of date.

CommentSpam is one of the major flaws of wordpress as a platform
Too bad you cannot do much about it since a bot-generated POST is basically valid

After trying various useless solutions I resolved for going the hard way:
I retrieve all the POSTS to wp-comments.php from the Apache logs, get the originating IP, append it to the /etc/hosts.deny file
I said this is the hard way

The script is a one-liner and goes like this:
cat /var/log/apache2/hostname-access_log | grep “POST /wp-comments-post.php” | cut -d’ ‘ -f1 | sed ‘s/^/ALL: /’ | sort | uniq > deny

After this you just need to append the deny file to /etc/hosts.deny possibly checking for duplicates
You can do it by using something like:
sort /etc/hosts.deny | uniq –count