This is a custom blog. Posts here, while simple, don't work the same way that they do anywhere else. And this is a tiny site: plausible.org's front page gets no more than a few dozen hits a day, almost all from crawlers and the like (some of the sub-sites, like Nasal get a little more traffic). Nonetheless, someone somewhere cared enough to take the time to reverse engineer my comment mechanism and write an automated spam bot for it. I'm touched, really.
For the last few months, I've just been deleting these by hand as they show up in the database. But that's getting tiresome, and within the past few weeks someone has figured out how to vary the post ID number in the comments so they don't all appear under one thread. So for now, I've disabled comments. I'll put them back up later when I hook in a captcha mechanism. This one seems to look good at first glance. Certainly it's easy to integrate, and the captcha images look pretty.