Minimizing website spam comments

[IBMJunkman]

Recently had a thread about abuse of my sites Comment page (www.ibmjunkman.com). Bots were posting SEO and other business improvements offers. If they had actually looked at the site they would realize there is no business to improve.

My programmer and I installed a home grown Captcha challenge. 8 images with a random question asking to pick one. That helped. Then decided to randomize the image sequence and the question. Messages dropped to zero.

Then started to get messages again. Subject line was in broken English. Generally the same Subject. Message itself was in various foreign languages and fonts. I decided they were what I call human bots. Human to get past the Captcha then just entering the same garbage using Google Translate to change the message language. I decided to add IP to the message I get.

Yesterday I got 6 messages. All in different languages. But from the same IP. Apparently from the UAE. I thought it would have been China or India. I have decided to implement IP blocking code. Added a new table to my database containing IP addresses. When I get a trash message I will add the IP to my table.

The comment page will first check the IP and if in the table will do something. Have not decided what. I am thinking of just returning them to the Home page. No chance to solve the Captcha or leave a message.

This is a hobby/vanity site. No business transacted. I am retired so nothing much else to do. 😊

Am I tilting at windmills? Should I just kill the Comment page? I have gotten a few comments that were legit. At this time I am just interested in seeing where the trash is coming from.

What say the hive mind?

 

[mindless1]

The captcha might be too easy, looks much simpler than what they've evolved to be on the internet today - though I do hate the ones so difficult that it takes a few tries to solve them.

Having to keep adding IPs seems laborious but if that's how you want to do it, then you could block wherever you want to, deny any pages loading, or go back to homepage, or let them try to post the message then that doesn't complete from bad IPs, or be sneaker still and run some code every few minutes that deletes messages from those IPs so the spammer thinks the messages completed.

 

[lxskllr]

Seems like a fun project(keeping spammers out). I agree your captcha looks easy, especially with ai tools. No ideas for you, but it's an interesting challenge with few consequences for failure.

edit:
Checkout this post for what ai can recognize...

Page 1161 - What first world problem did you have today?

Page 1161 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.

forums.anandtech.com

 

[Quintessa]

Tbh, your layered defense is already smarter than 90% of comment systems out there.

Couple of my thoughts:
- Yeah, you're likely dealing with click farms or low-cost manual labor that pass basic Captchas. Google Translate-style variation is a common tactic to bypass spam filters.
- IP blocking helps, but keep in mind that IPs from VPNs or mobile carriers (esp. in places like UAE or India) can be shared, so you may block some legit traffic too, though for a non-commercial site, it's probably worth the trade-off.
- Instead of just sending them to the homepage, consider returning HTTP 403 Forbidden, this reduces server load and gives a clearer message that "you're not welcome."

So no, don't kill the comment page, just harden it for fun and learning. Lol
Bonus: Consider putting a honeypot field too, bots usually fill hidden fields humans won't.
Easy and effective.