Spam attacks

Star6key · Post by **Star6key** » Fri Aug 18, 2017 10:19

I've just reported another spam post (3rd in a few days). They were all about in vitro fertilisation.
Is this forum getting targeted again?

prl · Post by **prl** » Fri Aug 18, 2017 10:55

The IVF stuff in the posts just seems to be a front. The links don't appear to be to any sort of IVF info (though I haven't been curious, or foolish, enough to follow them).

The spammer using that particular front seems unusually persistent. Most spammers on the forum are hit-and-run: one or two posts and then they're off to plague their next target.

There's not much that can be done without having human intervention in the signup and doing an email-back check to make sure that the spammer has at least thought about things enough to get a throw-away email address for such occasions.

MrQuade · Post by **MrQuade** » Fri Aug 18, 2017 12:01

Star6key wrote: ↑
Fri Aug 18, 2017 10:19
I've just reported another spam post (3rd in a few days). They were all about in vitro fertilisation.
Is this forum getting targeted again?

Ha! Only three?

I have seen absolutely dozens in the last couple of weeks that the mods have been diligently cleaning up, presumable before anyone else sees them.

prl · Post by **prl** » Fri Aug 18, 2017 12:30

MrQuade wrote: ↑
Fri Aug 18, 2017 12:01

Star6key wrote: ↑
Fri Aug 18, 2017 10:19
I've just reported another spam post (3rd in a few days). They were all about in vitro fertilisation.
Is this forum getting targeted again?
Ha! Only three?

I have seen absolutely dozens in the last couple of weeks that the mods have been diligently cleaning up, presumable before anyone else sees them.

I've cleared up about 8-10 myself, just of the supposed IVF spammer.

Gully · Post by **Gully** » Fri Aug 18, 2017 21:57

prl wrote: ↑
Fri Aug 18, 2017 12:30
I've cleared up about 8-10 myself, just of the supposed IVF spammer.

And I have lost count of those I have done and not even bothered to remember the topic!

gibster · Post by **gibster** » Fri Aug 18, 2017 23:09

I know Captcha is a pain, but can't something like that be activated in the forums to eliminate automated posting?

Star6key · Post by **Star6key** » Sat Aug 19, 2017 00:57

gibster wrote: ↑
Fri Aug 18, 2017 23:09
I know Captcha is a pain, but can't something like that be activated in the forums to eliminate automated posting?

I agree with this, but only for new accounts.

IanSav · Post by **IanSav** » Sat Aug 19, 2017 10:55

Hi,

By new accounts perhaps any accounts that haven't got 10 accepted posts under their belt should have to deal with captcha. Mind you many of the SPAM posts here look like they are manually entered.

Regards,
Ian.

prl · Post by **prl** » Sat Aug 19, 2017 11:49

IanSav wrote: ↑
Sat Aug 19, 2017 10:55
... Mind you many of the SPAM posts here look like they are manually entered.
...

I tend to agree, though Mr IVF, whoever he is, seems to be using auto-generated usernames.

Captcha on registration may help if most of the spammers are doing some sort of robo-registration. Once you've registered, I'm not sure that Captcha adds much value, even for the first few posts.

Perhaps a bar on posting links for the first few posts may help. That's not uncommon on forums.

prl · Post by **prl** » Wed Aug 23, 2017 10:06

It may be worth keeping an eye on nibor00. Looks like a spam tryout.

Gully · Post by **Gully** » Wed Aug 23, 2017 13:21

prl wrote: ↑
Wed Aug 23, 2017 10:06
It may be worth keeping an eye on nibor00. Looks like a spam tryout.

My thoughts exactly.

peteru · Post by **peteru** » Wed Aug 23, 2017 22:08

Gone and the IP range of the HK based ISP has been blacklisted too.

IanB · Post by **IanB** » Thu Aug 24, 2017 09:41

I don't know how the mods feel about extra work, but making new users first few posts (even possible only 1 or 2) need moderator approval might just be a solution. (this appears to be the phpbb default behaviour, Jai appears to have set this limit to zero, or it has been inherited from older versions of the config)

In the long run it's probably not that much extra work. Now, someone like me reports the post, all the mods get a notice, first one actions the post and user concerned, the others take a missed event path. And the unread post index gets an empty reference just to clog the works. For genuine new users there is currently no effort, thus the unknown trade off.

prl · Post by **prl** » Thu Aug 24, 2017 09:59

peteru wrote: ↑
Wed Aug 23, 2017 22:08
Gone and the IP range of the HK based ISP has been blacklisted too.

If that was a source of the "IVF" spam, it hasn't been successful. I just wiped up after another one.

prl · Post by **prl** » Wed Sep 13, 2017 20:50

Just cleaned up the vile droppings of another lot of Russian language spam (or at least Cyrillic alphabet).

If it's not possible to make it harder for spambots to get accounts, could we have a single-press ban and delete posts?

IanSav · Post by **IanSav** » Wed Sep 13, 2017 21:20

Hi,

The word must be getting out that this forum is an easy target. If action isn't taken soon this forum is likely to be totally overrun with SPAM.

Regards,
Ian.

Star6key · Post by **Star6key** » Thu Sep 14, 2017 01:39

prl wrote: ↑
Wed Sep 13, 2017 20:50

If it's not possible to make it harder for spambots to get accounts, could we have a single-press ban and delete posts?

At the very least.

Paul_oz53 · Post by **Paul_oz53** » Thu Sep 14, 2017 02:42

Star6key wrote: ↑
Thu Sep 14, 2017 01:39

prl wrote: ↑
Wed Sep 13, 2017 20:50

If it's not possible to make it harder for spambots to get accounts, could we have a single-press ban and delete posts?
At the very least.

+1 - And thanks to the mods who clean up the crap!

netmask · Post by **netmask** » Thu Sep 14, 2017 08:52

On the Popcorn forum you can't even read the posts unless you register and then you have to wait a week before you can post. A bit inconvenient for the casual user who may just want a bit of info but I can't recall ever seeing spam on that site.

prl · Post by **prl** » Thu Sep 14, 2017 09:34

I don't think that registration should be necessary to just read the Beyonwiz forum.

netmask · Post by **netmask** » Thu Sep 14, 2017 12:11

prl wrote: ↑
Thu Sep 14, 2017 09:34
I don't think that registration should be necessary to just read the Beyonwiz forum.

I agree it's a bit extreme methinks - it seems to be a never ending battle. Videohelp.com got swamped last night/today. Maybe it's the season?

IanSav · Post by **IanSav** » Thu Sep 14, 2017 12:25

Hi,

It would be handy if new users could have their post rate limited to a single post until that post is answered by an existing user. This would work as long as our regular users don't feed the troll.

Similarly new users should be constrained to a single area of the forum. This would save the wide spread splatter across the forum.

Regards,
Ian.

Star6key · Post by **Star6key** » Thu Sep 14, 2017 14:55

IanSav wrote: ↑
Thu Sep 14, 2017 12:25
Hi,

It would be handy if new users could have their post rate limited to a single post until that post is answered by an existing user. This would work as long as our regular users don't feed the troll.

Similarly new users should be constrained to a single area of the forum. This would save the wide spread splatter across the forum.

Regards,
Ian.

The problem with that, is that it wouldn't stop 'hit & run' spammers. Post once, then register with another userid.

prl · Post by **prl** » Thu Sep 14, 2017 15:38

Star6key wrote: ↑
Thu Sep 14, 2017 14:55
...
The problem with that, is that it wouldn't stop 'hit & run' spammers. Post once, then register with another userid.

Provided the repeat rate of the spam attacks is the same, it's a lot easier to clean up a single spam post than the 20+ that got posted in the last lot I cleaned up.

IanSav · Post by **IanSav** » Thu Sep 14, 2017 18:27

Hi Prl,

This will work if the IP address is captured along with the user name. Multiple new users from the same IP address or domain could/should be considered suspect.

The idea will be to make it inconvenient and/or difficult to create the SPAM. If our forum is hard to SPAM you would imagine that the SPAMmers will look for easier targets.

Regards,
Ian.

Gully · Post by **Gully** » Fri Sep 15, 2017 19:38

IanSav wrote: ↑
Thu Sep 14, 2017 18:27
This will work if the IP address is captured along with the user name. Multiple new users from the same IP address or domain could/should be considered suspect.

We usually ban the IP as well but even that can have a limited impact as you can see.

Star6key · Post by **Star6key** » Sat Sep 16, 2017 11:11

Soooo... did anybody "Buy counterfeit money , fake/real passports, ID cards, Driver's licenses"

There really needs to be some action taken about these posters.

prl · Post by **prl** » Sat Sep 16, 2017 12:22

Star6key wrote: ↑
Sat Sep 16, 2017 11:11
...
There really needs to be some action taken about these posters.

What sort of action?

Gully · Post by **Gully** » Sat Sep 16, 2017 12:22

Star6key wrote: ↑
Sat Sep 16, 2017 11:11
There really needs to be some action taken about these posters.

Don't forget we are all fellow users like you so we do take action as soon as we can.

prl · Post by **prl** » Sat Sep 16, 2017 12:45

If Jai and the forum admins want to tale a look at them, there are a number of phpBB extensions for helping to deal with spam in https://www.phpbb.com/customise/db/exte ... ti-spam-41.

Sortables Captcha seems like a reasonable protection against registration by spambots (but not against actual human spammers). Ban Hammer would satisfy my wish for a "ban and delete posts" single action against a bulk spammer that manages to get through anyway.

Gully · Post by **Gully** » Sat Sep 16, 2017 13:46

prl wrote: ↑
Sat Sep 16, 2017 12:45
If Jai and the forum admins want to tale a look at them, there are a number of phpBB extensions for helping to deal with spam in https://www.phpbb.com/customise/db/exte ... ti-spam-41.

Sortables Captcha seems like a reasonable protection against registration by spambots (but not against actual human spammers). Ban Hammer would satisfy my wish for a "ban and delete posts" single action against a bulk spammer that manages to get through anyway.

Sound good. Anything to add limits and speed dealing with them as each post or topic and spammer takes a number of steps to deal with them.

Star6key · Post by **Star6key** » Sat Sep 16, 2017 17:11

Sorry, I didn't mean that someone should remove the posts asap, I meant (obviously not very well) that we seriously need to look into stopping this spam.
The captcha seems a good idea (for new users), and can then be bypassed after a set period, maybe a week or so.

prl · Post by **prl** » Sat Sep 16, 2017 17:12

Star6key wrote: ↑
Sat Sep 16, 2017 17:11
...
The captcha seems a good idea (for new users), and can then be bypassed after a set period, maybe a week or so.

I think it's only for registration. Once you've registered, it should just be normal login.

IanB · Post by **IanB** » Sat Sep 16, 2017 17:24

Captcha does not work against human infiltrators.

As I suggested a while back, setting the moderated post count for new users to a small value like 1 will almost completely eradicate the problem.

But are the mods up moderating all the 1st post of every new user?

prl · Post by **prl** » Sat Sep 16, 2017 17:38

IanB wrote: ↑
Sat Sep 16, 2017 17:24
...
But are the mods up moderating all the 1st post of every new user?

That sounds like it could be more work than cleaning up after spammers.

IanB · Post by **IanB** » Mon Sep 18, 2017 08:59

prl wrote: ↑
Sat Sep 16, 2017 17:38

IanB wrote: ↑
Sat Sep 16, 2017 17:24
...
But are the mods up for moderating all the 1st post of every new user?
That sounds like it could be more work than cleaning up after spammers.

Well that is the question! How many genuine new users will need their first post approved versus doing a clean up of 40 odd JeremyScolf posts.

It seems genuine new users are about one every few days and chances are you would have read and also possibly answered that genuine first post of a genuine new user.

Additionally possibly restrict first posts to a newby's forum and draft more moderators to only the newby's forum.

prl · Post by **prl** » Mon Sep 18, 2017 10:07

IanB wrote: ↑
Mon Sep 18, 2017 08:59
...
Well that is the question! How many genuine new users will need their first post approved versus doing a clean up of 40 odd JeremyScolf posts.

It seems genuine new users are about one every few days and chances are you would have read and also possibly answered that genuine first post of a genuine new user.

Additionally possibly restrict first posts to a newby's forum and draft more moderators to only the newby's forum.

One of the suggested addons I posted about was a single action ban-and-delete-all-posts function. With that, it doesn't matter how many there are.

Anyway, "JeremyScolf" "only" had 22 posts, not 40

Weirdest link from "JeremyScolf" was to a midwife with a German domain name (hebbame-lucie-stein). I'm sure German midwives learnt about via spam are the go-to medical assistance for Australian women.

I'm pretty sure that one was a spambot. The posts seemed too close together in time for it to have been otherwise, even though "JeremyScolf's" "Occupation" was given as "Human".

netmask · Post by **netmask** » Mon Sep 18, 2017 12:39

I know it is getting a bit silly to suggest this BUT maybe when a new user registers in the process a code could be texted to the registrant like the way banks do? It's a reasonable assumption that anyone with a PVR would probably have a mobile phone (or several

)

prl · Post by **prl** » Mon Sep 18, 2017 13:51

I'd be happy to see the combination of Captcha in the registration and one-stop ban-and-delete-posts tried out to see whether that helps get it a bit more under control. They have the advantage of being already existing addons for phpBB. I suspect that the forum may have made it into an "easy pickings" URL list for spammers.

peteru · Post by **peteru** » Mon Sep 18, 2017 14:17

netmask wrote: ↑
Mon Sep 18, 2017 12:39
I know it is getting a bit silly to suggest this BUT maybe when a new user registers in the process a code could be texted to the registrant like the way banks do? It's a reasonable assumption that anyone with a PVR would probably have a mobile phone (or several )

Totally unreasonable and a huge privacy issue. Don't even go there!

prl · Post by **prl** » Tue Sep 19, 2017 09:47

Back to boring old fake ids and qualifications today, but only four of them

Star6key · Post by **Star6key** » Tue Sep 19, 2017 10:54

prl wrote: ↑
Tue Sep 19, 2017 09:47
Back to boring old fake ids and qualifications today, but only four of them

These guys just aren't trying hard enough.

prl · Post by **prl** » Sun Oct 15, 2017 16:54

Weirdest spam for some time: linking off to the home page of an apparently real university in a principally Kurdish district of Iraq.

Gully · Post by **Gully** » Sun Oct 15, 2017 19:17

prl wrote: ↑
Sun Oct 15, 2017 16:54
Weirdest spam for some time: linking off to the home page of an apparently real university in a principally Kurdish district of Iraq.

Happy to have missed that.

Maybe they knew I was at work!

Star6key · Post by **Star6key** » Sat Oct 21, 2017 10:53

Since all of these phishing posts want you to click on a link, is it possible to prevent site links in posts for new members?
This would allow new genuine members to still be able to post.

prl · Post by **prl** » Sat Oct 21, 2017 14:05

That and several other things that might help discourage spammers have been suggested in this topic, but the forum admins don't seem to want to take them up.

prl · Post by **prl** » Sat Oct 21, 2017 14:56

A couple of recent spams were advertising forged documents, including supposedly undetectable forged bank notes.

I'd have hoped that the forum admins would be keen to stop spam like that appearing at all, since they appear to be promoting serious criminal activity.

Star6key · Post by **Star6key** » Sat Oct 21, 2017 15:00

prl wrote: ↑
Sat Oct 21, 2017 14:05
That and several other things that might help discourage spammers have been suggested in this topic, but the forum admins don't seem to want to take them up.

Well that's just sad.
Maybe I'll click on the "Hemorroida Interna" link post, and see if I can 'get me sum a dem hemmroids'.

prl · Post by **prl** » Sat Oct 21, 2017 15:04

Funnily enough, the most recent one I deleted seemed to be promoting haemarrhoid cures, since that's exactly where they're a pain.

About the Forum

Join us