Forum spam management?

[levi]

Thankfully, while we might have a few astroturfers on board advocating any of the alternative devices to the Pandora and Pyra we cover here, they're not a significant problem and their influence is minimal because they can't hold a coherent conversation or back up their assertions. The problem this thread is addressing IME is straightforward unrequested commercial email for dodgy product aka spam.

 

[Letalis Sonus]

The problem this thread is addressing IME is straightforward unrequested commercial email for dodgy product aka spam.

I'm not talking about selective opinion control, I do mean random advertisement spam. There are enough shady people out there paying for high-grade ad zombies spreading random spam in unrelated forums. You'll see, those spammers will keep evolving until you'll have a tough time identifying them, some will wait several days after posting harmless and valid posts until they get the actual spam going.

 

[levi]

Ah, okay, I wikipaedia'ed Internet Water Army and came up with astroturfing. Yes, we've seen spammers setting up relatively genuine looking accounts without any payload, but it seems that so far it's not worth their time to actually learn what this forum is about, so they're easy to spot too.

Sure, we'll have to evolve the approach as spammers change their attacks, Right now, intelligent url filtering in the subject line will catch all the spam I've seen that presumably has not been picked up by the mods the time I see it.

 

[Wally]

I've discovered banning spammers on their "birthday".
Perfect Birthday present if you ask me!

Edit: They also seem to post / join around the same time daily. Anywhere between 5PM - 9PM AEDT.

 

[levi]

5-9PM AEDT translates to 4-8AM UTC. That would be within office hours anywhere from Pakistan/Central Russia to the Indonesia if my maths is at all valid. Certainly, China would be within scope.

 

[Letalis Sonus]

Certainly, China would be within scope.

Banning the whole IP range of China was actually one of the more drastic counter measures we did, but of course there are many from other countries as well. A lot came from Malaysia, Indonesia and similar nearby countries, others were obviously using hijacked servers, like those from US gaming server providers - the latter were fairly easy to spot and kept feeding the IP range ban list, there's no harm in banning IP ranges that are solely used for hosting servers.

 

[ClockworkCoder]

Banning close to 1.5bn people... Ouch.

Better would be making it moderator approved, or invitation only.

 

[notaz]

Could it be solved the same way pandorawiki currently is, just ask for a password which can be found on this very forum? Alternatively something like "type in the 2 words seen in the logo of this site", like a non-conventional captcha.

Or is this all about spammers abusing guest posting (not sure if it's still enabled)?

 

[Wally]

That's brilliant Notaz!, as part of registration as spammers wouldn't be able to join at all, unless they were human, all 0 post accounts would need to be purged after this is done so we don't have any slip through the loops. We could just ask people what are the two words in the logo, no need to have anything else


I guess I better explain what this is all about, it's not about guest posting as that was disabled sometime ago.

We're getting a lot of spammers come through and adding URLS to their profile as means of promoting a website via SEO which abuse our crawler bots, slow down the forums etc. They also tend to post random threads which are about weight loss or some snail face wash. You can often track it @ https://pyra-handheld.com/boards/recent-activity/ (Unless a moderator has sniped the spammer). For those reading this please do not make an effort of reporting the spammer as they come unless they post as it's pointless and I'd hate to see you waste your time on such a thing.

You can also see on the Birthdays List that there's mostly spammers, once again please do not report these..

This is taking up far too much of the mods time (well whoever is active and left) to try and ensure that spammers aren't getting what they want. I'm a bit fed up with it, hence constant complaining heh.

I understand ED is busy, but i've always thought that someone else should be in charge of maintaining the forum whilst he is busy doing something else, that person I thought ED could trust would be you notaz.

 

[levi]

The ones I've seen certainly aren't guest postings - I've mainly seen stuff in the dev section.

Edit: Ninja'ed by Wally!

Edit2: What's this birthday's list business? I just see a list of users sorted by post count, and a little box showing whose birthday it is today.. Unless they create an account with the day's date as their birthday, you mean?

 

[Wally]

Yes that's correct. You can see how many spammers are registered as a "Birthday boy or girl" today

 

[levi]

Ah okay, I can only see one there that hasn't been banned already I assume. The rest seem to be low post count but actual users. The one spammer I can see also uses the sort of internet lorem ipsum gibberish made by always guessing the next word based on textual pages discovered on the internet in their about profile.

 

[Wally]

There's about 20 odd in that list.. They're not all obvious though

 

[Letalis Sonus]

as spammers wouldn't be able to join at all, unless they were human,

Don't be surprised when it won't work as well as expected, this type of counter measurement is pretty popular and those ad zombies are prepared to take care of a lot of them.

I'm not even sure whether the more sophisticated ones are really not human.

 

[levi]

I've always assumed they were human, just very short on the time they can spend on each site, and probably badly paid.

 

[notaz]

I understand ED is busy, but i've always thought that someone else should be in charge of maintaining the forum whilst he is busy doing something else, that person I thought ED could trust would be you notaz.

Well I wouldn't mind as long as it's limited to technical things, kind of an extension of what I do for pandora. What I don't want is to be expected to solve human related issues like resolving personal conflicts, banning/unbanning, assigning/demoting mods and so on.

 

[EvilDragon]

@EvilDragon the spam seems to be getting worse.

Could you try some of the options mentioned on this page? https://xenforo.com/community/resources/block-spam-completely-with-no-addons.4065/

Particularly the URL blocking one. Tired of banning SEO spammers..

That has already been done months ago.
And I triple-checked that these settings have been applied.
[doublepost=1488589527,1488589261][/doublepost]

Could it be solved the same way pandorawiki currently is, just ask for a password which can be found on this very forum? Alternatively something like "type in the 2 words seen in the logo of this site", like a non-conventional captcha.

Sadly, it's not that easy.
Most of such spam posts are not made by spambots anymore but by humans. So anything that's easy enough for a normal user to register is easy enough for them as well.

The system blocks things pretty well - we have about 20 users per day that are being blocked during registration because they are have spammed on other boards already (it checks for IP, email address and username), so only a few get through.

 

[levi]

I do think that it's not worth their time to figure out anything complex, based on the ones I've seen that dive straight into the sales spiel without even trying to configure it for the forum it's going in. If we can make it so that it takes a little time to register and post, there might be a happy medium between something that's too slow for anyone real to bother with, and too quick for spammers to use. But finding that medium is perhaps not the best way we could be spending our time, and erring on the side of too long would be detrimental to the community while we fiddled.

Still, something to prove they've actually read the forum before posting might only discourage the sort of user we don't really need. It couldn't really be something pyra or pandora related if we do actually want users of other devices, but I think notaz's suggestion might be worth trying.

 

[notaz]

Sadly, it's not that easy.
Most of such spam posts are not made by spambots anymore but by humans. So anything that's easy enough for a normal user to register is easy enough for them as well.

I'd say it's still worth a try, it may use the language barrier to our advantage. Many people in Asia don't speak English, and those who do should be able to find a better job (you don't need to speak English to solve most captchas, and can be trained to solve the harder ones). Perhaps even add the question as an image so it can't be auto-translated or copy-pasted to a translation tool.

 

[Lafazar]

That's a good idea. Another possible strategy is adding a slight delay (hours or even days) before a newly registered user can post or create threads. That might lower the frequency of spam as well.