Hidden Spam In Comments

Thanks for the tip.

What you experienced is known as "search engine spamming" or "bulletin board spamming". Google's PageRank algorithm is very dependant on the number (and quality) of links pointing to a site. What this person was doing was increasing the number of links pointing to his filth sites. Once he posted his comment and Google indexed your site, Google would list your site as a backlink to his site and would increase his PageRank.

Lower than scum if you ask me ...

Thanks for the tip. I got 'em too, today.

Just wondering if we could filter for CSS. I can't imagine any situation in which I would want display:hidden or display:none included in a comment.

-- Pushbutton Test Experience -->>

the comment spam problem is well known in the movabletype community. it doesn't matter if you don't allow CSS or HTML, the spammers are cunning. in the MT example, a user's name has a URL link, and this is often used, in addition to posting links in the body of the text.

you may be aware of their proposed solution:
http://www.typekey.com/

this allows for centralised comment-registration. funny enough, drupal has this built in.

other solutions MT users have done are:

- a tool which filters spam and posts a centralized blacklist of IP addys:
mt-blacklist

- a comment manager tool, allowing for bulk managing of comments on a site (can you imagine doing that with drupal.org? eek.)

would simplest option in drupal be requiring registration? or is that open to another kind of abuse?

----------------------
the illusion of progress
http://nearlythere.com/

I'm considering building a module that uses Spamassassin rules to filter incoming content. Below are some of my notes on the topic. Note that this assumes that the reader is familiar with how Spamassassin works:

Create a Drupal module that uses spamassassin to filter content.

Create a rule to apply to each role to determine whether filter applies.

Specify which node types/comments get filtered. Possibly have a per-node config that allows poster to turn off comment spam filter.

Specify a spam score above which content post gets filtered.

Options for filtering actions include message being:
1. denied
2. denied quietly (appear to be accepted)
3. queued for moderation
4. queued for moderation quietly

Spamassassin will need to be modified to only apply body tests, as all
header tests will be unapplicable. Consider the performance
options/payoffs between using spamassassin as a separate process vs.
using the spamd client/server configuration.

Rule sets will need to be customized for each community. Consider
developing an interface that allows moderators to adjust scores for
rules on a per-message-acceptance basis using a "This is not spam"
button in addition to an "Approve" button. e.g. if a blackjack gaming
community posts 25 posts all containing the word 'Casino' and the CASINO spam rule by default adds 2.8 points to the overall spam score, each message that gets accepted reduces the spam score for rule CASINO by some predetermined value (like 0.1). After moderators have accepted all 25 posts in this way, the revised spam score for rule CASINO will be 0.3 (most likely below spam threshold).

Alternatively, if a post gets published that is obvious spam (to the human eye), the moderator can specify so. This action will increase the points for each matching spam rule that applied to the post. This is not very accurate, as it may be only one rule that was insufficient, or a new rule needs to be created. Perhaps that level of detail should be offered (TBD).

Now that I've written all of this out, I'll probably x-post it as a new forum topic :)

Update: Please defer commentary on this post to the new topic discussion in the Module Development forum section:
http://drupal.org/node/view/7446

I always check all comments for any suspicious URLs, since the majority of comment spam I've seen consists of random or innocuous text with a URL to some offending site.

I just added a default input filter which disallows {a} so anonymous users can't post any links. Only registered users can select the full filtered HTML format.

--
Mike Cohen, http://www.mcdevzone.com/