Winds of Change.NET: Dealing With Comment Spammer Infestations

Dealing With Comment Spammer Infestations

by Armed Liberal at October 12, 2003 12:12 AM

(Oct. 14th Update: MT-Blacklist has arrived!)

...our comments are being porn-spammed (at Armed Liberal as well, and I'll be emailing some other blogs to see if they've been hit as well). We're cleaning it up as fast as we can, but we've been hit by a series of spams from a Russian porn site. The last one appears to have left several hundred comments, and additional mutations are possible. So far we've seen "Lolita," Preteen," and "Underage". Teresa Nielsen Hayden has more info. on the spammers, Scriptygoddess has a slew of admin. options for you, and Burningbird has a fairly simple way to make it harder for spammers next time (Hat Tip: David Janes).

JK: It's an organized effort... was highly ranked at Blogdex.net a couple days ago, but I think they've put in filters. We may do the same soon, and meanwhile I've disabled all comments. We've also got a Swedish neo-nazi group that hangs out here and occasionally posts long rants. If you want to see an example, do a search for "Conspiracy and Truth Week" because I delete it everywhere else.

Re: the comment spams... why does this matter? And what can be done?

This matters because if pornospams et. al. are left unchecked, they will significantly impair the entire weblogging community - not just by killing comments as a normal blog feature, but by triggering automated filtering software at some workplaces once they notice all the porno links. What do we need to prevent that? Software, and support.

Software: Yoz Grahame's Cheerleader has a very intelligent set of suggestions, in "7 Tips for a spam-free blog". The article addresses tools vendors as well, which I especially appreciate. It also references Mark Pilgrim's outstanding overview of Club vs. LoJack solutions, which is finally available again after going down yesterday. If you're looking for serious long-term thinking about how our tools need to evolve and what we need to do, Mark's piece can't be beat. Though Shelley has a good one, with some worthy cautions about trust networks and smart feature requests.

Roald and Macdonald have an Open Letter to Google which is very much on point. We all have a mutual interest in stopping this, and working together from both ends just makes sense.

I'll add another thought. Not only do we need MT-Blacklist, we also need a clean-up utility. One that looks in the comments for the "URL" field, and when it finds a match with our ban list (or even a specific entered value for v1.0), it collects that comment and presents us with a "Power Edit" list that allows us to delete comments in batches of 25-100 at a time. When we're done, one site rebuild would allow us to have a completely clean blog.

Support: In addition, hosting providers have to get smarter. Tens or hundreds of weblogs rebuilding hundreds of entries will have the same effect on their servers as a denial-of-service attack. Comment spam should therefore be treated like one. For starters, hundreds of incoming data posts from the same IP ought to raise a red flag and cause diversion or access denial.

Mwanwhile, our provider at Bloghosts.com has already moved to firewall out the following netblocks from their servers: 209.120.176.0/24 and 62.42.228.0/24. This will help for now, but over the long term they may want to consider an add-on service. It would include installation of MT-Blacklist, configured to draw from a central blacklist hosted and updated by bloghosts.com themselves, plus renamed CGI submission scripts in their MT installations to make blogs they host a lower-profile target. The Cadillac option could even include an upgraded Host-specific MT package with a full-fledged spamtrap configuration.

That would be a substantial draw for many bloggers, I think, who would gladly pay additional fees for services that take this problem off their hands.

This much I do know - we'll need these measures sooner rather than later. Preteen, Lolita and the spawn were just the beginning. There's no reason these attacks couldn't be scaled to add hundreds of comments to each weblog, and no reason why they wouldn't be. Brace yourselves, because you ain't seen nothing yet.

Persons wishing to contact the author of this article for reprints etc. should put a request in the Comments section, or send an email to "joe", over here @windsofchange.net.