Forum spam

Prince of Persia related subjects that do not have their own boards.
Falcury
Calif
Calif
Posts: 565
Joined: June 25th, 2009, 10:01 pm

Re: Forum spam

Post by Falcury »

Falcury wrote: November 13th, 2017, 11:58 pm Maybe there are still other things that we could try.
This extension looks promising:
https://www.phpbb.com/customise/db/exte ... orum_spam/

From the description of the extension:
Extension will query the stop forum spam database on registration and posting (for guests only) and deny the post and or registration to go through if found.
  • Will log an entry in the ACP if so set.
  • Extension sends usernames, emails and IP addresses to a third party server. Via HTTP when adding and via HTTPS when querying (email is hashed upon querying).
  • Works with the Contact Admin Extension to disallow those trying to use the Contact Admin extension to submit.
  • Ability to report a users post to Stop Forum Spam database with API key from within viewing a topic (admins and mods only). Can't report mods or admins.
Might be worth a try.
I installed and enabled that extension.
Hopefully it helps.
I'll be absent until January 11, so I won't be able to delete spam accounts during the coming month.
David
The Prince of Persia
The Prince of Persia
Posts: 2846
Joined: December 11th, 2008, 9:48 pm
Location: Hungary

Re: Forum spam

Post by David »

David wrote: October 21st, 2017, 11:17 am EDIT: By the way, it seems that the user profile page does not show whether the user is banned.
The PoPUW forum had a separate "rank" for this, called "I have been permanently banned". :)
I found a little difference that shows if a user is banned: profiles of banned users don't show the "send PM" link.
Compare our newest banned user with someone who is not banned.
This can also be seen next to posts: It's the "Contact" that disappears for banned users.
David
The Prince of Persia
The Prince of Persia
Posts: 2846
Joined: December 11th, 2008, 9:48 pm
Location: Hungary

Re: Forum spam

Post by David »

Falcury wrote: December 9th, 2017, 12:23 pm I installed and enabled that extension.
Hopefully it helps.
Unfortunately we still got the usual "PC Games" spam from India, and some other as well.

The extension has an option to report users or posts to a central database:
https://www.phpbb.com/customise/db/extension/phpbb_3.1_stop_forum_spam/ wrote: Ability to report a users post to Stop Forum Spam database with API key from within viewing a topic (admins and mods only). Can't report mods or admins.
It should look like this, but I don't see that button on posts.
Why?
Does it appear only for admins and not for mods?
Falcury
Calif
Calif
Posts: 565
Joined: June 25th, 2009, 10:01 pm

Re: Forum spam

Post by Falcury »

David wrote: December 31st, 2017, 8:39 pm Unfortunately we still got the usual "PC Games" spam from India, and some other as well.
The extension has a threshold setting:
Stop Forum Spam threshold:
The extension will check against a threshold (e.g., the number of times a user name, email or IP address is found within the stop forum database). You can input any number between 1 and 99. The lower the number the greater the possibility of a false positive.
I lowered this setting from 5 to 2. Hopefully that helps a bit.
I could lower it further down to 1, if they still come through.
There is a risk of false positives, so I also enabled the option for adding an entry to the administrator log, whenever the extension blocks someone trying to create an account. (And I am curious how many (if any) spammers the extension actually stops!)
David wrote: December 31st, 2017, 8:39 pmThe extension has an option to report users or posts to a central database:
https://www.phpbb.com/customise/db/extension/phpbb_3.1_stop_forum_spam/ wrote: Ability to report a users post to Stop Forum Spam database with API key from within viewing a topic (admins and mods only). Can't report mods or admins.
It should look like this, but I don't see that button on posts.
Why?
Does it appear only for admins and not for mods?
I think the button did not appear, because I had not yet entered an API key for Stop Forum Spam.
I just did that, and the buttons now appear on posts.
User avatar
Norbert
The Prince of Persia
The Prince of Persia
Posts: 5743
Joined: April 9th, 2009, 10:58 pm

Re: Forum spam

Post by Norbert »

Falcury wrote: January 12th, 2018, 12:44 pmI just did that, and the buttons now appear on posts.
Hm, I don't see any new buttons, and I'm logged in and did a hard reload of the page (Ctrl+Shift+r using Firefox).
Still just the ! and " buttons. Maybe it's a rights issue; only admins/mods can see it?
Falcury
Calif
Calif
Posts: 565
Joined: June 25th, 2009, 10:01 pm

Re: Forum spam

Post by Falcury »

Norbert wrote: January 12th, 2018, 10:17 pm Hm, I don't see any new buttons, and I'm logged in and did a hard reload of the page (Ctrl+Shift+r using Firefox).
Still just the ! and " buttons. Maybe it's a rights issue; only admins/mods can see it?
Yeah, it looks like the buttons only appear for moderators/admins.
Makes sense, because the makers really want to stop people from adding non-spammers to the database:
Stop Forum Spam wrote:Note - By signing up for an API key, you agree not to be malicious by adding people you just don't like etc. This will get you banned, your servers banned and the possiblity of being listed in the database yourself.
I can give you moderator status, of course, if you want.
User avatar
Norbert
The Prince of Persia
The Prince of Persia
Posts: 5743
Joined: April 9th, 2009, 10:58 pm

Re: Forum spam

Post by Norbert »

Falcury wrote: January 13th, 2018, 1:25 amYeah, it looks like the buttons only appear for moderators/admins.
Right.
Falcury wrote: January 13th, 2018, 1:25 amI can give you moderator status, of course, if you want.
No need.
David
The Prince of Persia
The Prince of Persia
Posts: 2846
Joined: December 11th, 2008, 9:48 pm
Location: Hungary

Re: Forum spam

Post by David »

Falcury wrote: January 12th, 2018, 12:44 pm The extension will check against a threshold (e.g., the number of times a user name, email or IP address is found within the stop forum database)
Unfortunately, these spammers seem to use a different username and IP address every time... (I don't know about the email.)
It would probably be more useful if spam filtering worked by the contents of the post, as for e-mails.
User avatar
Norbert
The Prince of Persia
The Prince of Persia
Posts: 5743
Joined: April 9th, 2009, 10:58 pm

Re: Forum spam

Post by Norbert »

David wrote: January 13th, 2018, 10:15 pmUnfortunately, these spammers seem to use a different username and IP address every time...
Lately, the username seems to always have the <letters><yyyy> format though. We could alter the forum's PHP code to block these? Although I still think that the users not being removed completely might be the main cause of the spammer's continued presence. From the bot's perspective, the non-deleted profiles' signatures do still spread the spammer's game's name (example, example). I probably wrote this before, but, back in the day, when I ran into spam, consistently deleting the spammers' profiles and banning their IP's did make the spam stop.
David
The Prince of Persia
The Prince of Persia
Posts: 2846
Joined: December 11th, 2008, 9:48 pm
Location: Hungary

Re: Forum spam

Post by David »

Norbert wrote: February 1st, 2018, 12:46 am Lately, the username seems to always have the <letters><yyyy> format though. We could alter the forum's PHP code to block these?
Careful with that, we have some legitimate members with such names, like RaymanForever2007, acd2001, Nick2017, goldeng2015.
And of course, mk1995.

EDIT: Another approach would be to block a registration if its IP resolves to <something>.alliancebroadband.in, as they all seem to be coming from there.
I have already tried that in the past, but the forum didn't support it: viewtopic.php?p=22094#p22094
Norbert wrote: February 1st, 2018, 12:46 am From the bot's perspective, the non-deleted profiles' signatures do still spread the spammer's game's name (example, example). I probably wrote this before, but, back in the day, when I ran into spam, consistently deleting the spammers' profiles and banning their IP's did make the spam stop.
I think Falcury deleted most of the spammer accounts, your two examples are probably the only remaining ones.

EDIT: Actually, there are a few more suspicious usernames (the first 7 or so rows here), but most have no posts and no signature.
It seems that some of them haven't even logged in yet.
They might be "sleeper agents" who wait for some indeterminate amount of time before spamming.
David
The Prince of Persia
The Prince of Persia
Posts: 2846
Joined: December 11th, 2008, 9:48 pm
Location: Hungary

Re: Forum spam

Post by David »

Norbert wrote: February 1st, 2018, 12:46 am From the bot's perspective, the non-deleted profiles' signatures do still spread the spammer's game's name (example, example).
It looks like Falcury has just deleted those.
Falcury
Calif
Calif
Posts: 565
Joined: June 25th, 2009, 10:01 pm

Re: Forum spam

Post by Falcury »

David wrote: February 3rd, 2018, 12:08 pm EDIT: Actually, there are a few more suspicious usernames (the first 7 or so rows here), but most have no posts and no signature.
It seems that some of them haven't even logged in yet.
They might be "sleeper agents" who wait for some indeterminate amount of time before spamming.
Should I delete those as well?
David
The Prince of Persia
The Prince of Persia
Posts: 2846
Joined: December 11th, 2008, 9:48 pm
Location: Hungary

Re: Forum spam

Post by David »

Falcury wrote: February 4th, 2018, 12:18 am Should I delete those as well?
I'm not sure about that.
Btw, now there are only four of them: memberlist.php?username=*19*&sk=c&sd=d

One of them just posted a spam.
(Somehow their "Last active" date is empty. How is that even possible?)

Another of them was already banned (by you in September), although they have no posts or signature.
Maybe you deleted their post without also deleting the user?

There are also a few spammer accounts that didn't make any posts, instead their spam is in their signature or profile:
* The three accounts linked here: viewtopic.php?p=22107#p22107 -- this, this, this.
* Also: this, this, this, this, this, this, this, this, this, this, this, this.
* this, this, this, this, this, this, this, this, this, this. (These even have avatars.)
* this, this, this, this, this. (Some have a spam site as their "Website".)

Then there are the latest posts in this topic: viewtopic.php?f=92&t=582
Falcury
Calif
Calif
Posts: 565
Joined: June 25th, 2009, 10:01 pm

Re: Forum spam

Post by Falcury »

OK, I deleted all of the accounts you linked to directly in your last post.
David wrote: February 4th, 2018, 11:21 am Then there are the latest posts in this topic: viewtopic.php?f=92&t=582
I removed the last poster. These two posters (link, link) had spam signatures, which I deleted. I also deactivated the accounts.
David wrote: February 4th, 2018, 11:21 am Btw, now there are only four of them: memberlist.php?username=*19*&sk=c&sd=d
I deleted some the most suspicious ones (some of them were spelling variations of the same name), and forced reactivation on some of the newest ones. (If those remain inactive, I'll delete them in a month or so. Seeing as these also originate from a suspicious IP range, they're almost certainly spam accounts...)
David
The Prince of Persia
The Prince of Persia
Posts: 2846
Joined: December 11th, 2008, 9:48 pm
Location: Hungary

Re: Forum spam

Post by David »

I wanted to post that we had no spam for almost two months, and then we got one. You can find it in the trash.

We also have some new users who have spam on their profile: here, here.
Post Reply