Ban the spammers...

[nitro2k01]

I've occasionally said it before and I'm saying it again. Ban the spammers. It's not unusual to see the same spammer come back and posr 3-4 more times. You're obviously aware of these people since you've deleted or (I would guess) moved their posts to a secret subforum. And yet you don't ban them.
Set up 1-2 of the active moderators that you trust that and give them ban rights. It's not a really big deal obviously, but it's one of those things that it would be so easy to do right.

[Squidlekins]

Thank you sir. I share your sentiment.

[Black Six]

Set up 1-2 of the active moderators that you trust that and give them ban rights.

If it were only that simple. Only Administrators can ban members - we can't give individuals the ability to ban people and nothing else. At this point in time the staff has not deemed it necessary to promote any more admins. The accounts do get banned eventually, but sometimes it can take a week or so. I know it's a pain (more for me than you, since I have to go around deleting posts and topics) but we all have to deal with it while the staff works on a way to prevent them from registering.

[hailrazer]

That's odd. I moderate on several sites and as Mod I can ban people from posting. Not IP ban only admin can do that. But I can suspend their posting privileges indefinitely.

[bicostp]

We're working on getting a better captcha systemup and running, so they won't even be able to get in in the first place.

Seems like most spambots do a 5-10 post drive-by and never come back. We have a 'trash can' forum we move all the spam threads into, for later account deletion. (The forum's hidden so Google doesn't index it, and because it's just a bunch of ads for knockoff Viagra and handbags. Why do they think we want handbags anyway, that's my question...) It's kind of pointless to ban them, since we're deleting all their posts anyway and they usually don't come back. (Plus it clutters up the banlist.) Sometimes I'll ban a repeat domain name (things like spamchongsoft.web), but usually they seem to mostly sign up with [random string]@gmail accounts.

[nitro2k01]

Set up 1-2 of the active moderators that you trust that and give them ban rights.

If it were only that simple. Only Administrators can ban members - we can't give individuals the ability to ban people and nothing else. At this point in time the staff has not deemed it necessary to promote any more admins.

I'm gonna go out on a limb and says it should be possible to do if you set up a custom user group. But don't take my word for it, I'll set up a phpBB instance on my own to investigate it.

The accounts do get banned eventually, but sometimes it can take a week or so. I know it's a pain (more for me than you, since I have to go around deleting posts and topics) but we all have to deal with it while the staff works on a way to prevent them from registering.

We're working on getting a better captcha systemup and running, so they won't even be able to get in in the first place.

Let me share some advice from my experience as an administrator on the site 8bitcollective.
1) CAPTCHA's suck. The good spam programs can handle even moderately hard CAPTCHA's without problem. What I did instead was to add a small piece of Javascript to the registration form, that I had had a year on my blog comments with great success:

Code: Select all

<script type="text/javascript">
cuicnd="wri";lc=[5, 'nput type="hidd', "\" value=\"malcolm\" ", 'en" name="antibott'];

eval('doc'+'ument')
[cuicnd+"te"]
("<i"+lc[1]+lc[3]+(--lc[0])+lc[2]+' />')
;z=document.getElementById('requsername');
z.name='_'+lc[lc[0]-3].substring(0,3)+z.id;
</script>

What the hell is that? It's a piece of very obfuscated Javascript code that adds a hidden form element as well as rename one of the fields. (Of course there has two be a corresponding check on the server side for this to work) So far it has proven very effective in singling out bots, because the one thing that really separates bots from browsers is the lack of ability to run Javascript code. If you're interested I can look into making a phpBB3 plugin that does the same thing.
That piece of code has proven very effective against all but human spammers... Which brings me to the second nugget of wisdom:
We've had a number of, what I assume are, manual spammers who have been spamming about chinese MP3 players and iPod software. The solution to that was to ban a larger IP subnet. Granted, this take a little more effort, but has a payoff once you've banned enough subnets. Let's say two spammers have posted from IP's 1.2.3.4 and 1.2.3.5. Then it might be worth considering banning 1.2.3.* or even 1.2.*.*. What you need to at that point however is to investigate whether there are any users from the larger subnet. (1.2.*.*) I don't know if phpBB allows you to search for users and posts with IP masks like that. I'm too lazy to write a PHP helper script, so I've been doing it manually at the MySQL prompt, something like:

Code: Select all

SELECT username, registration_ip FROM users WHERE registration_ip LIKE '1.2.%';

The number of users, and the number of users who are spammers in that list, gives a good estimation on whether it's ok to ban that subnet. (% is a wildcard for the LIKE operator in SQL) Then the same for '1.2.3.%'. And of course do this for both the user and post list.
After doing this consistently for 6 months or so we don't get spam from the iPod guys any more.

Another thing that might work is to have an auto-ban or autowarn for specific terms like "wow gold" or "replica handbags" which probably won't come up very often anyway.

Why do they think we want handbags anyway, that's my question...

What's that? Let me get my magnifying glass...

Why do they think we want handbags anyway, that's my question...

That's better.
They don't. (Generally speaking) They want to gain PageRank by getting links from highly ranked pages. That way, they're hoping that their page will be in the top when someone googles for "replica handbags". So far they're apparently successful, when I google for just that, I see sites that I've seen linked from BH by spammers.
That's why they sometimes try to conceal their links, to avoid being caught. For example, the WoW gold spammer that I've been reporting for a while posts some mumbo-jumbo, followed by spam links in a small type. I also remember another spammer who came here and posted a Wikipedia article about some chemical element, with 1-2 links in the middle of the text. There were even a couple of people who didn't even understand that it was a spam and just said "interesting...".

[J.D]

Set up 1-2 of the active moderators that you trust that and give them ban rights.

If it were only that simple. Only Administrators can ban members - we can't give individuals the ability to ban people and nothing else. At this point in time the staff has not deemed it necessary to promote any more admins.

I'm gonna go out on a limb and says it should be possible to do if you set up a custom user group. But don't take my word for it, I'll set up a phpBB instance on my own to investigate it.

Yeah, that.

Last edited by nitro2k01 tomorrow, 1:48 pm; edited 1 time in total

WTF?

[nitro2k01]

Last edited by nitro2k01 tomorrow, 1:48 pm; edited 1 time in total

WTF?

Every once in a while someone comes along and falls for it.

[Mario]

We're working on getting a better captcha systemup and running, so they won't even be able to get in in the first place.

Seems like most spambots do a 5-10 post drive-by and never come back. We have a 'trash can' forum we move all the spam threads into, for later account deletion. (The forum's hidden so Google doesn't index it, and because it's just a bunch of ads for knockoff Viagra and handbags. Why do they think we want handbags anyway, that's my question...) It's kind of pointless to ban them, since we're deleting all their posts anyway and they usually don't come back. (Plus it clutters up the banlist.) Sometimes I'll ban a repeat domain name (things like spamchongsoft.web), but usually they seem to mostly sign up with [random string]@gmail accounts.

For a captcha, try what we did!
http://forums.modretro.com/ucp.php?mode=register" onclick="window.open(this.href);return false;

Bacon!

[samjc3]

We're working on getting a better captcha systemup and running, so they won't even be able to get in in the first place.

Seems like most spambots do a 5-10 post drive-by and never come back. We have a 'trash can' forum we move all the spam threads into, for later account deletion. (The forum's hidden so Google doesn't index it, and because it's just a bunch of ads for knockoff Viagra and handbags. Why do they think we want handbags anyway, that's my question...) It's kind of pointless to ban them, since we're deleting all their posts anyway and they usually don't come back. (Plus it clutters up the banlist.) Sometimes I'll ban a repeat domain name (things like spamchongsoft.web), but usually they seem to mostly sign up with [random string]@gmail accounts.

For a captcha, try what we did!
http://forums.modretro.com/ucp.php?mode=register" onclick="window.open(this.href);return false;

Bacon!

hey, thats actually a great idea. and, come to think of it, ive never seen a spambot on MR.

[Hobbes]

They still make it, but only the really smart ones

[Mario]

They still make it, but only the really smart ones

And then they are promptly deleted.

[Tchay]

We're working on getting a better captcha systemup and running, so they won't even be able to get in in the first place.

Seems like most spambots do a 5-10 post drive-by and never come back. We have a 'trash can' forum we move all the spam threads into, for later account deletion. (The forum's hidden so Google doesn't index it, and because it's just a bunch of ads for knockoff Viagra and handbags. Why do they think we want handbags anyway, that's my question...) It's kind of pointless to ban them, since we're deleting all their posts anyway and they usually don't come back. (Plus it clutters up the banlist.) Sometimes I'll ban a repeat domain name (things like spamchongsoft.web), but usually they seem to mostly sign up with [random string]@gmail accounts.

For a captcha, try what we did!
http://forums.modretro.com/ucp.php?mode=register" onclick="window.open(this.href);return false;

Bacon!

Yeah! I just got on that site and thought that was a great idea.

@Hobbes, you still here eh?

[nevermind1534]

On Your PC Forums, we have a plugin that blocks known spammers from registering (it's blocked a sh*tload of them). I don't think they have a PHPBB3 plugin, though.

[MasterPrime]

agreed. like that bicostp guy. he's always spamming useful information.