Drupal, Spam and the art of Google

The other day I was hit hard on one posting with a spamrun. Not uncommon unfortunately, lost of Viagra pushers and real Rolex shifters post comments at many blog sites. While looking in to it, I saw that moments for the spamrun a real human was visiting that same node with a weird referrer URL. (S)he was Googling for "powered by drupal" "post new comment".

On the result of that query you will find a posting of mine around position 6. So thats how they find sites for dumping their nonsense comments, just FGI! Not that smart, I would use the same way of finding a Drupal site where I could post a comment, google for it.

But Google is smarter then the scum of the earth. You want to see? Go to Google looking for "powered by Drupal" and "post new comment". You will see lots of Drupal sites. Now go to the pager at the bottom and click "next page" or click a random page number. And again. And again. Do it a couple of times and you will hit a page like this

We're sorry...
... but your query looks similar to automated requests from a computer virus or spyware application. To protect our users, we can't process your request right now.
We'll restore your access as quickly as possible, so try again soon. In the meantime, if you suspect that your computer or network has been infected, you might want to run a virus checker or spyware remover to make sure that your systems are free of viruses and other spurious software.
We apologize for the inconvenience, and hope we'll see you again on Google.

See? If you look for something that can be used, you are being served. If you look too much and most likely want to misuse that data, you are blocked. Cool, Google is protecting the blogosphere and Drupal in particularity!

Now dont try to Google to much for words to find out how to get blocked, because in the end you will. I once was at a customer location where a couple of hundred users where behind one NATted IP address. There has been a roque client that did automated searches on Google. The result was that all those hundreds of real users where blocked and needed to fill in a CAPTCHA to continue using "the startpage of the internet".

Anti-Spam content attracts too

Interesting observation and nice to see Google trying to play a role in the anti-spam crusade. I've also noticed that anytime I've posted an article giving hints how to combat spam comments...I get a huge increase of bots pointed my direction. I suppose these people like to have some challenges...too bad they don't live by the motto of "do no harm".

By BryanSD (not verified) at Sun, 11/02/2007 - 4:29pm | reply

true and thanks

true, postings about spam seem to attract spam (stupid me for posting this Smiling )

and thanks for putting me on the frontpage of cmsreport (permalink)

--
groets, bert boerland

By bertboerland at Sun, 11/02/2007 - 10:37pm | reply

Interesting, I didn't know a

Interesting, I didn't know a "spam" content will attract spam too.

Aston

(update by bb: I deleted his spam URL --- realy Smiling

By online (not verified) at Fri, 10/08/2007 - 11:12am | reply

I'm trialing this...

http://www.modsecurity.org/

Its a free extension on Apache and its meant to stop rogue posting bots by blocking connection attempts if certain criteria are met (eg, contains the word viagra, a post contains a body rather than just headers or there is SQL in the URL.

By Nicholas Thompson (not verified) at Sun, 11/02/2007 - 8:24pm | reply

Wishful Thinking

I wish that were true Ber - Only last night was a performing a totally innocent and legit search and came across that same message when I got to around page 6 (in Google).

I opened-up IE and got page 1 through to 5, no probs - Page 6 gave me this message again.

So I tried again but went straight to page 7, no probs.

I don't know what the problem is but what used to happen when those messages were presented, is that you were basically "frozen" out of Google for 2 hours. This seems to be a bug with Google IMO.

One of the first things I did before launching my D rupal powered site, was to change footprint words like, "comment" and such - I also changed a few error messages too as that's another way to find you.

PS... this is weird: On your submission form here, the "Your name" field was pre-filled with this:

"kritsch-AVRO-lid"

I don't know whether it's your site or my cookies being polluted but just thought I'd mention it.

By TheWhippinpost (not verified) at Sun, 11/02/2007 - 10:45pm | reply

feedback

"I wish that were true Ber"... hmm, you are at the wrong site, my name is bert, not ber.

"So I tried again but went straight to page 7, no probs.". point is it is slowing you down,. and if you keep looking closing you down.

"One of the first things I did before launching my D rupal powered site, was to change footprint words like, "comment" and such - I also changed a few error messages too as that's another way to find you." true, but obscurity. just patch and you will be fine

"kritsch-AVRO-lid" > anonymous coward on this site Smiling

--
groets, bert boerland

By bertboerland at Mon, 12/02/2007 - 1:25pm | reply

Antispam

hi Bert,
well solution approximately spammers: the script check comment post --> if words "Viagra" or "Pokker" in the post --> script block ip or browser from spammer.

or install antispamm module for drupal : kerneltrap.org/jeremy/drupal/spam/

By Freeware Eugen (not verified) at Sat, 26/05/2007 - 2:28am | reply

No one can ever kill spam!

By kritsch-AVRO-lid (not verified) at Thu, 03/04/2008 - 3:58pm | reply

The boys waited –Lord of the Rings

The boy often asked the girl that why you become indifference for me! But the girl always said that “I do not know” and this words let the boy’s heart more pain, he much more did not know how to do will be aroused the girl’s attentions, he did not know how to do could let the girl no longer apartness.

By Lord Of The Rings Money (not verified) at Wed, 02/07/2008 - 9:20am | reply

Spam is an unfortunate

Spam is an unfortunate outcome of a free Internet. I'd rather have spam than restrictions!

By wow gold (not verified) at Fri, 01/08/2008 - 8:07pm | reply

Thomas

Amazing post! There are various anti spams available to avoid the spams. But I use www.search-and-destroy.com which is a anti spyware application. It is helpful to clear virus problem.

By Thomas (not verified) at Wed, 08/10/2008 - 9:02am | reply