Ajax star rating system getting spammed

[salewit]

This is a tough one and I'm wondering if anyone has any ideas about it.

I've been using this Ajax star rating system for about a year. It works great, but I'm getting maybe 20-30 spam votes per day on random items we carry. I could tell they're not users voting for it, because there will be like 30 of them all of the sudden with the same IP and the same rating on a series of items. Also the IP's trace back to other countries (FRance, Russia, etc), and I know most of the users are US based.

I actually changed the code to add a status flag where I need to go in manually like once a week and clear out the bad ones, then release the flag on the known good ones.

Any ideas? Is there something evil going on here? There are only 4 fields in the database: Item#, IP, Star Rating, and Status.

There are many comments on the site where I got this script, but nobody else seems to be having this dilemma.

[edited by: DrDoc at 7:42 am (utc) on May 13, 2009]
[edit reason] No URIs, please. See TOS and Forum Charter. [/edit]

[DrDoc]

How do you control who is allowed to rate? Have you coupled the rating with any security features?

[salewit]

It's a commercial site like Netflix. We can't require customers to create an account to rate a DVD title they may have. I've been to dozen of sites where you can rate things without an account. I just don't understand the appeal of spamming these. What's the motive?

Sorry about the URI. I didn't know.

[DrDoc]

Since you are already logging the IP, add a timestamp field. Have the PHP script verify that there has been at least X time passed since the last rating by that IP.

[salewit]

That's not a bad idea actually! Thank you very much!

[whoisgregg]

I would also check the user agents of those particular visitors. If they are using wget or curl to automate the requests, they may have failed to spoof a legitimate user agent.

[DrDoc]

As a side note, I have FF set up to spoof itself as wget ;)