Hmm, I think blocking the comments entirely is probably not ideal. The problem (same as with IP based email blocking) is false-positives...
A possible solution: You could add a flag to the comments table to not show the comment, however the email notification would still be sent and it would still be shown in the comments list (wp-edit.showcomments.php new in CVS as of yesterday).
What do you think?
comment spamming (26 posts)
-
Anonymous
Posted 9 years ago #
-
Chris J. Davis
Posted 9 years ago #
Sorry must have misunderstood my solution. The index page queries the client IP before any content at all is loaded, then your blog is seen only after the IP has passed the check. This is a more... how do you say, extreme aproach, but if the page loads content there is always a chance for the bot to circumvent your security measures.
Anyway I will look into your idea, I see some real possibilities in it.
Thanks as always Alex. Nice talking to you again, been awhile since the b2 forums. -
Hi Chris, I was glad to see you here as well. I'm looking forward to seeing what you come up with.
I did misunderstand what you are proposing. I was thinking you checked the IP address when saving comments, not loading any page.
I think some kind of content filtering system combined with a IP filtering system that flags questionable comments and hides them from being displayed until they are 'approved' is probably the way I want to go.
This is the same attitude I have towards SPAM in e-mail, I know some people that auto-delete it. Personal preference I guess. :) -
Posted 9 years ago #
Yeah I will concede to you on that one. I hacked this together prety quickly just to get some defenses in place, but I can see where down the line this would not be the most advantageous way to do things. I hope to look at this over the weekend and try to come up with something a little more flexible.
The way wordpress is progressing makes me feel all warm and fuzzy, good to see you using your knowledge for good!
Chris -
Posted 9 years ago #
Well I have completed my stop-gap measures, by adding a block IP function to Alex's recent comment hack. Now along with edit and delete is a block IP link that adds the ip of the spammer to your banip table.
When I get home I will package everything up and release it for those who are so inclined. This is not the most elegant or flexible aproach, but it get's the job done, and that is what counts for me right now.
Thanks to Alex for his really groovy comment hack, I so did not want to write something like that today.
Well anyway, for those who would like to give it a whirl, you can pick it up at chrisjdavis.org/docs after 8:00pm est. Again this is only temporary I am sure the admins are hard at work writing something that will make my silly little hack blush and giggle like a little girl.
But until then we have a measure of protection. -
erogers
Posted 9 years ago #
How would you account for ISPs where all users appear with the same IP address? For example, all users at my workplace would show up with the same IP address. I've already encountered a couple of blogs where I was unable to comment because someone else in my organization got our IP address banned.
-
Posted 9 years ago #
Never said this was a perfect solution, just that it was a stop-gap for me until something else is written or suggested. I was offering it to the general public as a courtesy, nothing more.
Honestly in answer to your question, I have a high enough readership that losing someone from an IP range that is known to spam isn't that troubling to me. I had already gone through this before writing it, and I came to the conclusion that for me it wasn't an issue. It might be for you, which is a valid concern; if so this is not the correct solution for you, no hard feelings.
If you still wish to use this, you could always add an email contact to the spammer message, allowing actual people to contact you and be removed from the blacklist, that would be rather simple. You can go here: http://hiveware.com/enkoder_form.php to find a very well bred email incoder that will thwart 99% of the bots out there.
Again as I said before this is not an end all solution, just a stop-gap. Don't use it unless your needs are met by it. I am not going to submit this to WP or any nonesense like that. Alex and I have already had some dialogue concerning this issue and what he and the devs wish is much more flexible and powerful than what I have hacked together. I might look into implementing something like what Alex and I discussed, but not now. Too many other projects breathing down my neck as it is.
Thanks for your concern and input erogers, and I hope you find a comfortable solution to your own spam problems if this hack doesn't suit your needs.
I hate comment spam. -
huphtur
Posted 9 years ago #
-
I think a combination of content and IP filters that will flag a comment as "needing review" if it meets a spam threshold is the way to go. If a comment is flagged as "needing review", it will not show up on the site until it is approved by someone who has that authority. It could, of course, be deleted (and reported) instead.
-
Posted 9 years ago #
Another way it can be done is by having a list of commonly-used URLs by the spammers. This way, anyone who posts from those domains will automatically be blocked. There's a list of all kinds of anti-spam hacks for moveable type here: http://www.scriptygoddess.com/archives/004325.php It would be really great if someone could code some of these for b2/wordpress!
-
OperaManiac
Posted 9 years ago #
LJ has this option where u can switch on comment review to prevent spamming comments. this way you can read the comments and make them visible on the site...
-
Posted 9 years ago #
Where is the comment review solution? That seems simplest allow you to accept/reject all comments.
-
Comment review (comment moderation) is currently under development. Actually, I'm the one writing this. The wp developers took a review recently and suggested some improvements. I didn't find the time to implement them all this weekend, but I guess this should happen during this week. As soon as the solution gets the OK from the wp developer crew I'll release it as hack for 0.72, and I suppose it will go in to the next release version of WP as well.
-
Simon Hampel
Posted 9 years ago #
Another thing you could check for an automated "suspicious comment" filter - is to check for the number of links added to the comment.
Most comment spammers seem to be trying to take advantage of the google weighting of blogs by increasing the number of links to their sites, thereby making their results appear higher in the google hit list.
Anyone with more than two links in a comment is highly likely to be spam in my opinion. -
There has been LOTS of discussion recently in the bloggosphere about suitable methods to recognize and automatically suppress spam postings: sorts of blacklisting something, filtering manually or automatically, using bayesian algorithms, restrict comment posting more or less, use CAPTCHA methods to keep out bots, and so on.
Your suggestion is another method, and I didn't see it before. It will work as you described, classifying comments with more than two links per comment as spam. This will stop one class of spam, the one having tons of links in one comment.
But... I think this won't be a longer-term solution. As soon as spammers realize they can only post two links per comment, they'll do so. Instead of posting one comment with 20 links, they'll post 10 comments with 2 links inside. You could decrease the limit to 1 link, so they'll post only one. You could permit link posting, but that would be a high impact on usability for legitimate users (and an increase in work for you, as you had to manually approve all submitted comments having links inside).
And if you let through all comments without links in their body, you'll see an increase in another method some spammers already use. It's a decent way of spamming, not as offending as the "bulk url list" comments you mentioned before. It's a method I'd describe as "smart spamming". Those spammers put their URL in the URL field, while posting a comment that seems to be ontopic on the first sight. A nice example for this can be seen here. You won't catch that at all by just counting the number of links in the comment - there is no link.
So, we need another method. Turning of the URL field would be an decrease of usability of blogs - and we don't want that. Moderating all comments with an submitted URL would be an increase in work for the administrator - something we would like to cut down to a minimum, of course...
Personally, I strongly believe that the URLs themselves are the key. Whatever other options bloggers might try to suppress unwanted (spam) comments, spammers will find a way to get around the restrictions more or less easily. There is only one thing that really can't be changed without making the spam useless for the spammers: the URL. They have to give at least one link, else google won't push their page rank - and that's what this damn spam phenomenon is all about, right? Cloaking the main URL somehow (for example, giving the link to a redirecting page) won't do the trick for them, because it most probably will have an impact on page rank as well (and thus be negative for the spammers). There isn't much they can do to get by this way of filtering, I think.
If the URL is the only key to rely on, blacklisting spam URLs is the answer. It's easy to implement, not too hard to keep up-to-date (in fact I'm thinking of a standalone tool that helps on managing blacklists and that help to strengthen out a "web of trust") and safe. If you want to be sure that no spam comment makes it through to your blog you also might consider to enable comment moderation - but even without general comment moderation you'll catch most of the spam without having to raise a finger. In my eyes these two solutions are the most effective methods to keep your blog free of spams.
Or to speak with the words of Club vs. Lojack solutions: URL blacklisting, amongst the other solutions that have been proposed so far, is the club solution that is the nearest to a Lojack solution of all other clubs.
Maybe I missed an important point. If so, I'll happily stand corrected :)
Bye, Mike -
Mike:
That may indeed be the point.
I got into a discussion via email with someone about this--I wanna say it was Matt Haughey, but it's bloody late for me, and I've been playing NHL 2004 for about four hours now--that the end result was going to end up driving a common platform for registered users to comment across logware systems.
The ideal marker seems to be an email address [and a verified one at that] registered in some distributed database. Known spammers could be booted from the system and their IP's suspsiciously considered.
Of course, it requires one whackload of infrastructure to make it work, but ... anyway.
I'm probably too tired to be any kind of ... what's the word ... lucid. Yeah. ;) -
Posted 8 years ago #
Why not just see how long it takes to write a reply? Compare the time that the comment page is requested to the time that the comment is submitted. Since the spam is automated, the time between requesting the page and submitting the comment is very small (in fact, some of my webserver entries show zero time between the two). Surely persistant spammers will implement a wait() into their posts, but at least it can filter a few. Also, why not log the IPs of the dumbasses who try to spam c=1&p=1 and ban them from posts? Just a suggestion...
-
bio
Posted 8 years ago #
In reference to the last post by Anon. Spammers spoof IP's. I would get, on average, around 230 spams per day... well... attempted spams... and while the IP address would change from comment to comment, you'd see groups of those comments were often exactly alike (and posted a second or so apart). The only difference was the ip address. This makes it pretty obvious it's the same moron doing it.
Blocking url's is about the only way to pull this off. Block that and you block the spammers goal... to propogate the url.
There is a side note to this... you might want to also block blogs that don't clean off their spam. A new trick that seems to be all the rage is to flood someone's site with spam, then make comments elsewhere that point to the infected site. It's all done to raise google rank, and its anoying as hell.
Anyway.. those are my two cents. -
clay
Posted 8 years ago #
The #1 step in stopping this crap is for people to STOP publishing there referrer logs- and then moderating comments.
Adding a simple php spider trap adds yet another level of blocking.
I barely get ANY spam at all through my site at this point.
I highly recommend webmastersworld.com for anyone that wants to learn how to stop email harvesters and spam dirtbags -
Inkyhack
Posted 8 years ago #
Ok, I'm a PHP idiot. I have no idea how to write code or filter for IP addresses. Can someone please put some of this into English with nice step-by-step instructions so I can get that damned Poker site from spamming my board with advertisements?
-
morigen
Posted 8 years ago #
I was SUPER surprised to learn that there is no option "Only registered users may comment". There ought to be one, and that would solve most problems.
-
superberri4
Posted 8 years ago #
I have comments that appear on a post that are in the PAST in relevance to the post. Eg: Post is on December 31st and the comment (by 'online poker') is December 23. Really wierd.
-
That's because you have the spam all ready in your database. Upgrade to WP v1.2.2 to prevent it, and see the following tutorial for removing it: http://www.tamba2.org.uk/wordpress/spam/#imm
-
rossz
Posted 8 years ago #
Here's a thought. Hash the comment (just body), check it against a database. If it the hash already exists, treat it suspiciously. This would reject the "me too" type posts, but no great loss there.
Topic Closed
This topic has been closed to new replies.
