What Happened to Mollom? I'm getting SPAMMED as if it was not there...
AmmoBob - July 5, 2009 - 04:26
| Project: | Mollom |
| Version: | 6.x-1.9 |
| Component: | Code |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed |
Jump to:
Description
Every since Ver 1.8, it appears Mollom has taken a nose dive. I had problems with version 1.8 logging in from a page with a comment and got Spammed so bad, I had to shut down comments. Now I have 1.9 and although I have not had the log in problems, I find I have more spam getting through then ever before. I even changed my settings to force captua on comments and contacts, but today alone I had close to 30 spam posts.. At this point, I'm wondering if Mollom is even working.
If the maintainers of this module need more info, I will collect it, but right now I'm really wondering if anyone else has seen a significant decrease in Mollom's capability to block spam.
#1
Should agree with you. Free version of Mollom seems to be very unstable. One day it blocks spam other day it does not.
Perhaps some info on service downtimes should tell if that's the case.
#2
I have noticed something similar on my end. I have been testing the module on a sandbox site and it seemed to be working fine early last week, but today it seem like I can't trigger their "text analysis" engine to return an unsure code. Perhaps, as a work around, you can flip your settings to CAPTCHA only until we hear back about this issue.
#3
oh, one other thing, I can't help but wonder if my upgrade from Drupal 6.10 to Drupal 6.13 over the weekend has anything to do with this. Did you recently upgrade too?
#4
I tried changing the settings, but I'm still getting spammed... And this started before I upgraded, so I didn't think there was any connection there... I'm just about ready to turn off comments until I can figure something out, because Mollom does not seem to be working at all.
#5
I just realized that I am using a public/private key combination that does not match my domain name. I had a subdomain setup for my test site (sandbox.brianstevenson.com) and it's using the www.brianstevenson.com keys. It was working fine before, but maybe they flipped on some kind of switch to disallow non-matching domains. I'll get my keys fixed and see if that makes a difference on my end.
#6
Ok, I removed / uninstalled Mollom and tried some of the other SPAM modules here and was not too impressed with some of the other stuff. So after about 5 hours of trying and reconfiguring about few other modules, I reloaded v 1.9 and set it up for text analysis and capture.
So far it seems to be working like it used to when I first tried.... I'm not sure what was going on before because it was allowing SPAM with a ton of links, but for now so far, so good. It has blocked about 10 - 15 attempts this evening.
#7
Well, There back... The spammers attacked today with a fury. Mollom stopped about 50% or so, leaving me to delete over 30 spammer comments that made it through. I used the "Mark As Abuse" functions so the data was reported to Mollom. I have also started banning the IP address of the offender after I check it on Project Honey Pot
What I found interesting was some of the comments were stopped, but than later attempts to post the exact same comment from the same IP made it through. It's almost like it is working sometimes and not other times.
Anyone have any suggestions? I don't want to stop visitors from posting, but this is getting crazy.
#8
I've also found that Mollon hasn't been working. I've wound up with a lot of spam comments recently. It doesn't seem to matter if I select text analysis with captcha backup or just plain captcha. I've also set Mollon to deny all comments in the case that the service is down.
#9
Well today I had another 30 or so spam comments and I'm tired of dealing with them. I'm deleting mollom until the program starts working again and I guess I'll block anonymous comments until I find something that works. By the way, does any know if the Mollom version you pay for is working any better?
#10
At #9, out of interest, it isn't lots of Russian spam is it?
I am using the standard Captcha module with reCaptcha and I have a lot of Russian and Ukraine spam getting through the captcha with no failures being displayed in the log.
#11
There is a lot from Russia and the Ukraine, but I also have a lot from China and some from Europe (Spain & Germany the most)
#12
I had the same problem this month. I've recently installed Hashcash on top of it, as outlined at http://aaronwinborn.com/blogs/aaron/fighting-spam-drupal-mollom-and-hash... and the combo has been successful thus far.
#13
I have the same problem with Mollom during the last days. I changed the method to captcha only and it seems to be a solution for now.
#14
Same here, been seriously going downhill the last month or so, having to delete dozens of spam comments getting through every day. Unfortunately on the D5 version there doesn't seem to be a "captcha only" option, so I guess I'll try the approach outlined by aaron in #12.
#15
In the interest of helping out others faced with "manual deletion" of spammer comments, which is WAY to cumbersome in drupal itself, i offer my two scripts. You would need to substitute the YOUR_XXX strings before use (and make sure that these scripts are only readable by appropriate users since they contain the user name and password used for DB access).
First, "killspammer" which takes a user ID (number) and completely removes them from the system in one step. I use this several times a day, every day, on the morons who attempts SEO spam on our site. USE AT YOUR OWN RISK!!! This changes the contents of many drupal internal tables. Read before using and if you do not understand what it is doing, DO NOT USE THIS.
#!/bin/sh
if [ $# -eq 0 ] ; then
echo "usage: $0 UID"
exit 1
fi
userid=$1
cat << EOF | mysql YOUR_DB_USER -pYOUR_DB_PASSWORD -h YOUR_DB_HOST YOUR_DB_NAME
delete from accesslog where uid=$userid;
delete from authmap where uid=$userid;
delete from comments where uid=$userid;
delete from node_comment_statistics where last_comment_uid=$userid;
delete from history where uid=$userid;
delete from node where uid=$userid;
delete from node_revisions where uid=$userid;
delete from profile_values where uid=$userid;
delete from poll_votes where uid=$userid;
delete from sessions where uid=$userid;
delete from users where uid=$userid;
delete from users_roles where uid=$userid;
delete from watchdog where uid=$userid;
EOF
Next up, the slightly less drastic "silencespammer" (which also takes a user ID as its argument). This one just removes their comments, but leaves the user in place. I thought this would be useful, but I rarely if ever user it. This also changes the contents of internal drupal tables. If you do not understand how this works, DO NOT USE IT.
#!/bin/sh
if [ $# -eq 0 ] ; then
echo "usage: $0 UID"
exit 1
fi
userid=$1
cat << EOF | mysql -u YOUR_DB_USER -pYOUR_DB_PASSWORD -h YOUR_DB_HOST YOUR_DB_NAME
delete from comments where uid=$userid;
delete from node_comment_statistics where last_comment_uid=$userid;
EOF
#16
It has been pointed out to me privately the the "Delete User" module accomplishes the same thing. I prefer the shell script mostly because it is so much faster to access. I simply have a command line open on my webhost most of the time, and whenever I come across spam in the "recent forum posts" link, i get the userid, head to the terminal window and nuke the user.
YMMV.
#17
Since there's been no response from the maintainers, I wanted to provide an additional piece of information.
I know that this issue is against the latest 6.x version of the Mollom module. I am presently using Drupal 5.19 and the latest release of Mollom for 5.x. During the entire timeframe of this issue, I have been receiving ever-increasing numbers of attempted spam on a daily basis. Mollom has been working correctly for the entire time, and not a single spam has gotten through.
I realize there are differences between the 5.x and 6.x versions. Hopefully this will help with determining what may be happening with the 6.x version.
As a side note, I am definitely interested in making sure that Mollom is working for 6.x as I am working on upgrading the site I am using it on. For such a small site, Mollom is reporting between 70-200 blocked attempts each day. I certainly don't want to have to start manually dealing with all of those attempts.
#18
I too have found that Mollom's (1.9 on a 6.13 site) effectiveness has dropped dramatically in the last few weeks. I am getting spam that passes the text analysis (and some of this stuff should clearly be caught, unless I was running a pr0n site), and I am getting correct CAPTCHA, leading me to believe that it is human-entered spam. Worse is that much of it is coming thru TOR gateways. I have contacted some of these complaining, and they righteously tell me to take a hike, claiming anonymous access to the internet is more important than stopping spam. I think some of you might not agree, if you were getting 100/day, like me.
Worse, Mollom started today blocking perfectly good comments from registered users. I read the comments in the logs - they were perfectly fine (especially since at the same time, all sorts of caustic stuff was getting categorized as HAM by Mollom - wtf). Even after successfully entering a CAPTHA, these "good" comments were identified as SPAM and flushed. I am now digging them out of the database log and hand entering them. Am I ever happy about that.
#19
I'm now deleting about 50 - 100 just about everyday and I'm seeing the same patterns. The "good" comments are being marked as spam, but comments with nothing but links get passed through. In addition, I also think there has been an increase in human spammers, but this is nuts. I have comments set for approval so I can quickly scan the BS and delete it right away and I have also been blocking all the IPs from the Ukrain, China, Russia and few others, but I'm just about ready to turn comments off since this is getting to be a real pain. I've also tried reporting the abuse to the the IP address host, but received the same response.... We can't track every
So what else can we do? This is getting very frustrating...
P.S. Has anyone tried going back to a previous release? Or is this a problem with the Mollom servers analysis method?
#20
As of yesterday, I have turned off anonymous comments (which where set to moderation required, but I started getting 50/hr, again, either defeating Mollom's text analysis - and it was very obvious spam of the foulest variety - or having a correct CAPTCHA). And since I verify email addresses for authenticated users (have had only one case of spam from an auth user in over a year), I turned Mollom off, since it was ineffective at stopping real spam, and was not allowing "nice" real comments by auth users by marking them as spam, even after a correct Captcha. But I did get a very nice email from Dries yesterday, asking me to start paying for Mollom, since it was working so well. No, really, I kid you not. The timing was perfect.
Now I do appreciate everyone's efforts, and especially Dries' work on Mollom, so don't get me wrong. It's just I have become a little obscessed with SPAM lately, as it has been consuming both my time and my site's resources. I am thinking of doing it at the OS level (I run Drupal on FreeBSD7) using PF and a blacklist like project HoneyPot. But implementing that will take some testing before I deploy t to a production site. And again, I can't even DOS the spammer's machines (like I have been tempted to do in the past using apachebench using 10000 concurrent users over a 100MB internet connection), since the cowards are coming thru TOR.
#21
Thanks @aaron for tip #12. Mollom + Hashcash combo worked fine for me. If before that I'd still get around a dozen false positives from mollom a day (even with captcha only enabled). Now it's 0 for a week.
But have to agree with many, mollom became not so reliable as before.
I also spotted an odd thing (or maybe not so odd actualy): it works much better for sites with higher comment activity.
#22
I removed mollom completely today. There just does not seem to be any progress or support for this module and I really do not have the time to spend deleting hundreds of spam comments. I'm in search of other methods for now...
By the way, I never did see any response to the question I posed before... Does any know if the Mollom version you pay for is working any better? I was just wondering, based on gorlov #20 above's comment...
#23
We've been doing a lot of testing, debugging and analysis lately in order to figure out what is going on. We're also implementing a couple of ideas, and already, I've made changes to the Mollom module to enable better debugging (and help from the community). Sorry for the silence, but we've been heads down in making improvements that we hope to roll our shortly. I should also write a status update, it seems.
@gorlov, have you reported those spam messages to Mollom? It's been 5 days ago so we can't see these messages in our logs anymore, but next time it happens, send me your public Mollom key and I'll try to do some debugging.
Last but not least, keep in mind that Mollom isn't always properly working with CCK node types. This is a known issue and quite hard to get right.
#24
Dries...
I appreciate the update and hope you guys can get Mollom working like before...
Thanks,
#25
I've been watching the board since the new version was released and was wondering how it's working. I've only seen one issue, and it was not related to this thread, so any feedback on how the new module is working would be appreciated.
#26
I've just installed 6.x-1.10 and with Mollom in developer mode, I submit a comment with the word 'spam' in it and it passes straight through without Mollom seeming to even be aware of it.
#27
Dries, Yes, I had been diligently reporting each and every piece of spam back to Mollom (in an effort to make the community work). However, I have had the Mollom module turned off since then. I had just been getting too much spam through (a good percentage correctly entering the captcha, as seen in the logs, and even distressing, quite a number of perfectly good comments getting identified as SPAM for no apparent reason).
I was not using Mollom on CCK fields, just the standard comments to basic nodes (blog and forum posts).
To date, I have kept anonymous postings off, and have required users to register (using the standard "have to reply to an email" before activating the account), and have had no problems with SPAM since, although it has been a little more inconvenient for anonymous users.
However, for the past few weeks, I have been getting a huge number of SPAM'er creating accounts (that of course sit dormant). I stopped most of that very successfully with the Drupal module "SPAMBOT", which works very well at eliminating all these dormant spammer accounts, using the www.stopforumspam.com community, where similarly to MOLLOM, the community identifies the username, email addr and IP addr of comment spammers. The module very effectively does not let these people register. The only issue is that a few good user names (the simple ones, like "george", "jan", etc are identified as spammers. I have suggested allowing just the check of email addr and/or IP addr instead of name AND email addr. In any case, the module and service are well worth a look, at least as a complementary service to Mollom.
Why do I care about dormant accounts? Well, having a few thousand of them makes three times the number of dormant users in URL alias's, so that database starts getting big.
So Dries, again, a very big "thank you" for all of your efforts, and no traces of ingratitude or complaining. These spammers are concertedly working on circumventing all possible countermeasures against them. Staying ahead of them is hard, and may eventually be impossible. Perhaps augmenting Mollom with pieces of code from SPAMBOT, with some more flexibility to be able to "tune" the triggers for identifying SPAM might be a next step.
#28
I loaded 6.10 about a week and half ago and so far it's working great. It's stopping about 10 - 20 spam attempts per day. I'm glade to the see the module back up to speed. Thanks to Dries and everyone for getting this back on track..... Great Work!
#29
Marking this fixed as things should be fixed with the new releases of Drupal core and Mollom module.
#30
Automatically closed -- issue fixed for 2 weeks with no activity.