Ideas for fighting spambots

Filed under:  Google about "Akismet" |  Google about "Drupal"
Akismet module for Drupal

Well, the Akismet module has been released and announced today and I'm just getting some food for testing thanks to a spammer who decided to bomb this site for a while. If you (spammer) read this I would like to thank you again for that... not only because Akismet worked like a charm, but also because you have made me think...

Ok, I decided I'll finally enhance the moderator panel to convert it into a form so it will be possible to operate on several items at a time (to remove spam or simply to correct false positives sending information back to akismet). I can actually do it by a simple code snippet now, but probably akismet module users would love to see this, besides getting advantge of the current cron functionality that may remove detected spam automatically, so... expect that soon. ;-)

But that's not all... what if I add an option to generate a delay (or a ban) when spam is detected, before sending the response to the spammer? Well, they may not need to wait, so... what if I add this delay (or ban) to all requests to posts made by known spammers? I'm not thinking about permanent actions, just a measure to prevent from getting attacked by spambots. For permanent actions, there are other options such as .htaccess bans, Drupal access rules, the troll module and so on...

If you have ideas on that direction, please share them here... or is it ok as it is?


Another idea...

Yeah, there's at least one more idea...

I'm not thinking about reinventing the wheel by doing on the server what the Akismet Service actually does perfectly, but something else to make the akismet module somehow more efficient. It's about something to minimize resource consumption when you're under a spambot attack, which is something Akismet cannot protect us against...


Cool idea - let them wait = slow down = lower server load

Yes!

that's it...

as soon as you detect spam, you can do a sleep(10) to delay response...

that will slow down the signing process and reduce your own server load significantly :-)

best, christoph


Something on this direction is present in v1.1.0

Something on this direction is present in v1.1.0 :-)


Some more thoughts...

I have posted some thoughts to the akismet spam-stopper mailing list about the experience I'm getting with the Akismet module here in this site (I should say that I had close to 0 spam before releasing this module, lol)...

It is just that I'm wondering if there would be something else to do... maybe it would be possible to join efforts to report spam activies to the corresponding ISP and/or e-mail providers (it seems no one is doing this? ), resources spammer seem to be reusing again and again...

In addition to that, I'm refining the anti-spambot code that is already present in the module. I would like to remind that it is just to prevent Denial of Service situations that might be caused by certain spambots. So the experience I'm getting here is helping me make this routines a little bit better... :-)


follow ups from the spam-stopper mailing list

The key would be to develop an automated system to report the relevant information to the appropriate abuse channel at the ISP. I would think that the best place to start is to work with ISPs who are known to be strongly anti-Spam to develop the infrastructure and protocols and then try to get it adopted as a standard more or less. Akismet could then feed the information to the ISPs when spam was caught, but it would also allow other filters and systems to submit to them as well.

The key would be to aggregate the complaints until they reached some threshold that the ISP felt was worth dealing with then submitting. So you'd want to work out with an ISP that once the aggregator got 500 or 5000 or 5,000,000 spams from the abused accounts they would then stop the abuse.

Jason

MessageID: 000371


Reporting comment spammers to Google, Yahoo!, etc.

Probably the major goal of comment spammers is to increase their site ranks in search engines, etc. So... all that is needed is a coordinated effort to remove their sites from search engine databases.

I would like to post here the links to report abuse to Google and Yahoo!

http://www.google.com/contact/spamreport.html http://help.yahoo.com/help/us/ysearch/deletions/deletions-07.html

I even thought to add something to the Akismet module for Drupal to help site administrators fill in those forms. However, it would be really great if Akismet itself could provide more information or even coordinate such abuse reports.

The idea would be make the job of those who deal with abuse reports easier.

Anyone with experience reporting comment spam to Google, Yahoo! or others?

markus

MessageID: 000372


Six Apart Guide to Comment Spam

Just wanted to point to Six Apart Guide to Comment Spam. It is related to Movable Type, but it has very interesting thoughts in it that can be applied to other environments.