[Solved] Spam - straight to delete instead of quarantine?

[TheGurkha]

With the large increase of spam, I suggest that where it is obviosauly spam, we just delete it. where there is some question over it being spam or real, we move it to the quarantine forum and contact the poster. But for stuff that is definitely spam, let's just ban the spammer and hit the x button in the post to delete it.

There is so much new spam in the quarantine forum that listing the new posts only shows a screenful of spam posts - the real posts are getting swamped.

[acknak]

... There is so much new spam in the quarantine forum that listing the new posts only shows a screenful of spam posts - the real posts are getting swamped.

I thought that only mods/admins could see the quarantine forum--is that right?

As long as we move the problem posts somewhere instead of just deleting them, it doesn't matter to me where they go--just so I have a way to resurrect them if when I make a mistake.

[acknak]

Ok, I looked again: the description of the Q forum says only mods and admins can see it.

However, it is a nuisance for those of us who can see it, so I think you're right: it's time to just move the obvious spam to the "Deleted" bin and skip the quarantine step.

I'm going to start doing that unless someone has an objection.

I'm wondering how bad this is going to get

The only next step I can see is shutting off new members, or requiring new members to go through moderation before posting.

[thomasjk]

Just delete. Today has been especially bad for obvious spam. The MODS need to look at the new user process. I participate on some boards where links are not allowed unless you have made a minimum number of posts.

[Hagar Delest]

Seeing the spam overflooding, I fully agree too.
I've deleted the posts of big spammers (someone with 43 posts!).

I've called for another admin on the incubator private mailing list to replace Terry. Someone (imacat) has replied positively and I had to force ASF staff to give some information so that she can apply for infra team membership (a pre-requisite).

I had looked at a new user status that prevents links but there was something problematic IIRC. Will check again.

NB: Quarantine should be accessible to Volunteers IMHO, the purpose was to allow Volunteers to review the removal of topics. And sometimes there was mistakes: I've personally moved 2 topics back in their original section, I think it was a wrong selection when moving for example from Beginners to somewhere else. Pavlov reflex I guess and Quarantine may have been selected by automatism! So I think that the description is slightly wrong.

[acknak]

...NB: Quarantine should be accessible to Volunteers IMHO, the purpose was to allow Volunteers to review the removal of topics. ...

+1

Much more spam this morning: ~120 posts

[acknak]

BTW, this isn't really a private topic. Should be in the open site issues forum I think.

[Hagar Delest]

+1. Moved to the Forum administration section.

[kingfisher]

There must be ways to stop this happening. I've never seen it at other forums except, of course, oooforum. Banning user names is singularly ineffective, for obvious reasons. Ban the IP addresses and be done with it.

[acknak]

Banning by IP doesn't work either: they all use different IPs, even the ones that are using related user IDs.

Yesterday was horrible--nearly constant spam postings all morning, up until the forum crashed with "too many connections". Today, it seems to be back to more manageable levels.

[floris v]

I believe we already discussed disabling links for new members - I just wonder if that's enabled in this version phpbb or that somebody has to code that. They must have lots of mail addresses too? Yesterday was terrible - I almost offered to apply for moderatorship to help out.

[Hagar Delest]

I confirm that IP changes too much, I've checked with users having a similar username (they are from Philippines or Bangladesh, hired to post links for streaming site I guess). I've checked the admin panel and haven't found the option to forbid the live links...

We have been lucky with the too many connections problem, I asked the infra team on the private ML and they restarted the servers within few minutes.
It confirms the most online users statistics BTW (index page), we had 2105 users online. I've made a screenshot, will post it for the next monthly status. I've reset the figures.

[kingfisher]

Another device I have heard of is making the first few posts (or perhaps posts on the first few days after registration) subject to moderation.

[RGB]

+1 to delete. Today we get more than 300 spams!

[acknak]

Yes, these floods are almost too much to handle--it took me almost an hour to clean out all the junk this morning, and they're still coming in.

It's hard to even be sure what's been deleted, there are so many posts & pages to scan through.

We're going to have to cut off registration soon, unless we come up with some way to prevent them.

[thomasjk]

We need some definitive action to deal with the amount of spam hitting this forum. It is now as bad as the old forum. I feel sorry for the moderators having to handle all this manually. I logged in to 333 new posts and most were spam. It appears to me that these folks are running scripts once registered to bombard the site with useless posts.

[floris v]

Maybe a limit on the number of posts per time unit - not more than one per ten minutes for a new member, but that probably is another option that isn't available in phpbb.

[coruscant]

Just install Anti-Spam ACP by EXreaction - I've used it before and it pretty much kills spam dead.
http://www.phpbb.com/customise/db/mod/anti_spam_acp/

[Hagar Delest]

The problem is that we need someone to install the mod...

[Hagar Delest]

As a first counter measure, I've set the flood limit to 120 seconds. This is the time an user has to wait before creating a new message.
I've disabled this limit for volunteers.

[floris v]

I noticed that some of the spam messages had an incredibly high post count - how is that possible?

[Hagar Delest]

The flood limit was set to 10 seconds so any user could make a new post (or new topic) every 10 seconds. As long as there is no moderator online, there is nothing to prevent this.

[floris v]

Sorry, I meant view count.

[Hagar Delest]

Hmm, hadn't noticed that. And I've removed quite all of them. I checked the remaining ones in Quarantine and Deleted topics and their view count is rather low (less than 10).

[floris v]

Edit: That was a stirling job!

There was one spam message with over 900 views - I talked with RPG, who also noticed it. We had one spam message in the Dutch forum today, the first in months or better.

[Hagar Delest]

Edit: That was a stirling job!

In the admin panel, we can remove all the posts from an user at once. So it's not that long. But the problem is to make sure there is no false positive when there is only 1 post (I've found one 2 days ago).

Edit: The 120 s flood limit seems to work: I just removed messages from a spammer, they have been posted every 2 min. But not dissuasive enough (I hoped they would abandon instead of waiting). At least it will slow down the spam a little.

[FJCC]

I suggest raising the flood limit to several minutes, say 5 or 10 minutes, at least for a trial period. Perhaps a message could be prominently posted that this policy has been instituted as an anti-spam measure and the moderators regret the inconvenience.

[thomasjk]

I just logged in and there were 149 new posts almost all spam. The flood limit does not seem to be working. I suspect they are using a script that has an adjustable time delay. I think its time to put a hold on new registrations.

[floris v]

Edit: That was a stirling job!

In the admin panel, we can remove all the posts from an user at once. So it's not that long. But the problem is to make sure there is no false positive when there is only 1 post (I've found one 2 days ago).

There were also a lot of spammers with only a few posts.

I just logged in and there were 149 new posts almost all spam. The flood limit does not seem to be working.

I don't see the spam as spam but as a variant of a DOS attack. No serious advertiser would want to do this much harm to the place where he advertises.

[kingfisher]

The second post on this thread on the phpbb forums offers a solution which seems not to require a special mod. I am against stopping new registrations.

EDIT: On looking elsewhere on that forum, it seems that provision for moderating posts for new members is part of the software. See, for example, this thread.