There has been an interesting decrease in attempted comment spam on my website over the last two weeks. This may have to do with the recent attack on the Mega-D botnet, which was effectively destroyed by security researchers. The possibility of taking out botnets has been debated for a while, but so far only as a theoretical idea. The results of this attack speak for itself, and I hope that this will be done more in the future.
Comment spam has been a part of running my website almost from day one. Until about a month ago, I used reCAPTCHA, which is a very clever implementation of a CAPTCHA that at the same time helps digitize scanned books.
It started with a few spam comments that got through, and developed into waves. I would get bursts of about a dozen comments in quick succession once or twice a day. I had turned comment moderation on at that point, but it was still annoying. Then the waves intensified to the point where I got several hundred spam comments per day. Something needed to be done.
I had looked at Mollom before, but didn’t want to hand over control over my comments to a third party. At first, it also didn’t work too well, letting about half the spam through. But it improved over time, and it’s rock-solid now, to the point where I have turned off comment moderation again. Most of my users never see a CAPTCHA and don’t have to wait for me to moderate their comments.
There are other spam block modules for Drupal, but Mollom is much better integrated than the others. It does pay to have Dries Buytaert, the founder of Drupal, also behind Mollom. The integrated comment moderation queue and the clever report interface are simply excellent. The only thing the report charts is missing are false negatives.
What has also helped is another module named Comment Closer. It simply deactivates comments on nodes that are older than a given threshold. I don’t generally like closing comments on older nodes, because I don’t see my articles as being so tied to the current moment that they will lose relevance very quickly. But experience also shows that I get hardly any comments on nodes that are a week or two old, so I’m not losing much. And reducing the number of targets for the spam bots has cut down the spam attempts by about 2/3.
It’s still shocking to see the force behind these spam attacks, but I’m also glad that there are tools that are keeping up and making it virtually impossible for that crap to be posted.
1 note