Well, mt-blacklist lasted a good month or so. I’m now getting hit by a clever guy who figured out that by varying the capitalization of his URLs, he can get past the simple filters. Course, I can complicate the regexp some, but it’s still fragile. Second order solution is the distributed spam database, which works pretty well as these things go.