[Solved] Spam - straight to delete instead of quarantine?

by **/a3** » Sun Apr 22, 2012 10:23 am

Just to expand on the topic of post moderation:
On phpBB.com they use post moderation, so that users in the Newly Registered Users group have to be approved. This can be done in the User-based forum permissions (I believe) in the ACP.

Only problem is that users seem to get confused over whether they have posted or not. But in the current circumstances it's not a bad idea, could be disabled later anyway. Maybe enable temporarily, and then make a decision later? Anyway, just my suggestion anyway.

EDIT: should also mention that I've seen references to "post bombers before". [1] [2] [3]

by **squenson** » Sun Apr 22, 2012 11:22 am

What about temporarily allowing some volunteers to quarantine the spam messages?

by **/a3** » Sun Apr 22, 2012 11:31 am

squenson wrote:What about temporarily allowing some volunteers to quarantine the spam messages?

Or at least ban users? That's probably most important since at least they can't keep posting. Currently the forums are just filled with junk and it makes it harder to use them. If spammers are banned earlier then at least that won't be as much of a problem. All bans are logged AFAIK.

PS. not sure if this helps the moderators at all but I have a list of the suckers to ban. 47 of them. :shock:

by **kingfisher** » Sun Apr 22, 2012 1:45 pm

One of /a3's links led me to a how to thread. Note this paragraph:

Newly Registered Users Group - phpBB 3.0.6 also sees the introduction of the "Newly Registered Users" group. This feature, which may be enabled via the User Registration Settings page of the ACP, allows the administrator to define a minimum post count; if a user is below this limit they will be a member of the Newly Registered Users group. Permissions may be set on this group much like any other group -- an example use is to place the Newly Registered Users group on the moderation queue for all forums. The user is automatically removed from the group when they reach the defined post amount. Be aware that this feature is not retroactive -- users who registered prior to a board's upgrade to phpBB 3.0.5 will not be placed in the Newly Registered Users group, regardless of their post count.

Some of the recent spammers may reach a low minimum fairly quickly because of the rapidity of posting. Genuine users can, presumably, be transferred from the NRU group to ordinary members once their bona fides has been established.

Just btw, I am having trouble at this moment loading forum pages.

P.S. If the infra team or anyone else needs to see the extent and effect of spamming, load the various boards in an RSS reader.

by **acknak** » Sun Apr 22, 2012 2:54 pm

Banning is not effective. These guys seem to have an unlimited supply of everything they need to register new accounts: IPs & email addresses.

I have been trying to watch the IPs, and where they repeat (different IDs using the same IP), I ban the IP as well. It's not helping (much).

We have to have a way to stop spammers (people--humans) from registering.

Hungarian forum · by **r4zoli** » Sun Apr 22, 2012 4:06 pm

When we started Hu forum we get a massive spam load from one inner region of China, where not so much Hungarians living.
I used the IP banning using asteriskes in form " 123.456.***.*** " (these numbers only for example, not connected to any real spammers in Hu forum).
If the spammers came from one country, then ban them using this method, for a short time, until no other methods we found.
May be it is hurt not so much users.

by **thomasjk** » Sun Apr 22, 2012 4:30 pm

Can we temporarily stop the registration process?

by **JohnSUN-Pensioner** » Sun Apr 22, 2012 7:12 pm

Today's avalanche of spam is strongly shaken my Christian principles. I guess I'm a bad Christian. But I do not want to substitute the other cheek to these people. I (we) do not have a real opportunity to take revenge on those barbarians. However, I think the problem is not people going to various tricks and treachery in order to paralyze the work of our forum. The problem is people and sites that pay for these acts of sabotage. The addresses of these sites are known. Who knows how easily and quickly organize effective DDoS-attack? Or there are legal methods to influence the owners of these resources?

by **thomasjk** » Sun Apr 22, 2012 7:16 pm

As I suggested earlier the mods need to turn off the registration until this can be controlled. We might impact a few new users but right now these forums are not useable anyway.

by **acknak** » Sun Apr 22, 2012 9:36 pm

I have disabled registrations temporarily while cleaning up the spam.

I'll try to get the "new user" feature set up, but I'm not that comfortable with making configuration changes and I don't want to make changes that just make things worse (as in wide-open, completely closed or bricked).

by **Hagar Delest** » Sun Apr 22, 2012 9:41 pm

I'm reluctant to the moderation of new users, if no moderator online, indeed, they will be confused about the message being posted or not.
I've not seen any option in the new users group that would prevent them from posting an url. But I may have missed it. Or we disable the whole BBCode feature for them. Perhaps something to test at first.

Well, let's do some cleaning now.
I agree we should think about promoting some new moderators.

NB: thanks for the profiles, it will spare some time!

by **acknak** » Sun Apr 22, 2012 10:19 pm

Ok, I think that's all the spam gone.

Registration is still disabled--what should we do now?

by **acknak** » Sun Apr 22, 2012 10:22 pm

JohnSUN-Pensioner wrote:... I do not want to substitute the other cheek to these people. ...

It help me a lot to remember that the people doing the spamming are not the ones at fault here; as you said, it's the people who are paying them to post.

The odd thing is that I believe that the search engines are already ignoring such links, so it does nothing but annoy and interfere with legitimate forums.

by **Hagar Delest** » Sun Apr 22, 2012 10:48 pm

I've taken some immediate action (sorry, unilateral but something had to be done to allow new users quickly):
- I've reactivated the registration (by mail for the moment, not by mod)
- I've activated the Newly registered and I'm restricting their permissions, preventing any BBCode
- I've set the limit to 10 posts to get to the Registered status (not sure if it's automatic or not yet)

Perhaps we should see how it works as a test. I think that the spammers do use BBCode for their links. If disabling it is enough, perhaps these basic counter measures will have some effect.

Next step would be the moderation of posts from the Newly registered users.

by **acknak** » Sun Apr 22, 2012 11:06 pm

Hagar Delest wrote:I've taken some immediate action (sorry, unilateral but something had to be done to allow new users quickly):
...
Next step would be the moderation of posts from the Newly registered users.

Sounds good.

My understanding is that the "new users" group means that the first posts go to moderation. Once a moderator approves, then the post goes to become public and only then counts toward the minimum count. That means you can't cheat the limit by posting ten quick posts after registering.

If that's right, then there's no need for more than one moderator-approved post. I'm fairly sure that none of the spammers could (or would bother to) construct a viable post for this board. The only simple hack (I see) for that process would be to copy/paste a previous legitimate question. One way to check would be a quick google search for some chunk of the post, to see that it isn't a direct copy from somewhere else. I guess the process could be hacked by a very short query that would be difficult to verify as unique, but there are enough other clues (user ids/emails/IPs) that I think we could be quite accurate with only one post.

edit this topic's initial post · by **Villeroy** » Sun Apr 22, 2012 11:14 pm

The only simple hack (I see) for that process would be to copy/paste a previous legitimate question. One way to check would be a quick google search for some chunk of the post, to see that it isn't a direct copy from somewhere else.

I have seen this recently on oooforum.org.

by **Hagar Delest** » Sun Apr 22, 2012 11:17 pm

I don't think the newly registered posts go to the moderation queue automatically. There is an option in that group permission (in the forum's permissions) and it's off by default.
So if the spammer does want hyperlinks, it may abandon the process seeing that it's not parsed. But if he doesn't care, then we have to moderate those new posts.

by **acknak** » Sun Apr 22, 2012 11:27 pm

Hagar Delest wrote:I don't think the newly registered posts go to the moderation queue automatically. There is an option in that group permission (in the forum's permissions) and it's off by default.
So if the spammer does want hyperlinks, it may abandon the process seeing that it's not parsed. But if he doesn't care, then we have to moderate those new posts.

Here's what I was looking at:
http://www.phpbb.com/community/viewtopi ... #p11298505

If the "New member post limit" is >0,
and "Newly Registered Users group to default" is set to "yes",
and the "Newly Registered Users group" is set to require moderation for all forums (I'm not sure where this gets set),
then it should work to require at least one "valid" post before anything goes public.

I guess the spammers could then flood the moderation queue; I don't know if they get paid for such posts.

by **/a3** » Sun Apr 22, 2012 11:45 pm

acknak wrote:I guess the spammers could then flood the moderation queue; I don't know if they get paid for such posts.

Not sure of that actually. Normally spammers post for "SEO purposes" (posting links makes them look more popular to search engines) but yesterday's spam was by far the largest I have ever seen.

I can confirm that enabling post approval for Newly Registered Users will only affect users with less than the set amount of posts. Post moderation for everybody would be far too large a task.

The reason why I think it should perhaps be a temporary measure, at least until the spam bombs stop, is because these forums seem to get a lot of new users. Also, it seems to confuse people sometimes, since they don't know when their post will appear.

by **FJCC** » Sun Apr 22, 2012 11:56 pm

First, thanks to the moderators for all the work they did fighting spam.
I think that the changes put in place are appropriate and also that they are the sort of changes to the forum operation that should be mentioned on the dev mailing list. The huge number of spam messages, when visible, certainly affected the reputation of the forum (and AFS) and the creation of a New Users group is a significant change. Should I try to write something up or would one of the moderators be a more appropriate author?

by **acknak** » Mon Apr 23, 2012 12:04 am

The problem is that this kind of spamming is not even effective SEO--although I don't know that for sure. This approach (posting spam links in forums) has been poisoning search results for a long time, and I have seen reports that the search engines have implemented filters to ignore it. Maybe, in time, the people paying for this junk will realize that they're getting nothing of benefit and stop paying for it.

PS: I've seen one new spam come in. Maybe it was a previous registration.

PPS: Nope. Registered: 22 Apr 2012 16:28 memberlist.php?mode=viewprofile&u=53830

Appears in the "Newly registered users" group but still posted a spam.

I can't explain it.

by **Hagar Delest** » Mon Apr 23, 2012 12:09 am

Time to go to bed for me so no courage to write anything just now. No problem for me if you write something.
For the record, the appointment of a new admin to replace Terry is under progress on the ooo-private mailing list. I think it will take some time before the new admin can take actions. Especially the installation of phpBB mods against spam.

NB: SEO is not that frequent now. Most of the spam is about streaming (sport, series, ...). Perhaps they should open again MegaUpload for the sake of forums!!!

I've seen that new spam. Has registered after the new measures (but no moderation for that group yet). What I feared is indeed that there is no way to prevent the parsing of HTML. If we can avoid the others who uses the url tags by BBCode, that would help however.

by **/a3** » Mon Apr 23, 2012 12:18 am

acknak wrote:PPS: Nope. Registered: 22 Apr 2012 16:28 memberlist.php?mode=viewprofile&u=53830

Appears in the "Newly registered users" group but still posted a spam.

I can't explain it.

The newly registered users group won't do anything until the permissions are set. Anyway, some of it is explained on this: Knowledge Base - How to use the post count to limit forum access.

So if the moderator approval is to be set: go to Forum Permissions for Newly Registered Users and then hit the Advanced tab. Set "Can post without approval" to NEVER (not NO, since the YES of Registered Users overrides the NO Newly Registered Users). Once users leave this group they will be able to post without approval.

by **Hagar Delest** » Mon Apr 23, 2012 12:30 am

I've not activated the moderation of new posts yet. It's the last thing I want to do for the moment. I hope that spammers won't post more than 10 posts when they see that the url tags are not parsed.
So it doesn't prevent spam, it's just a limit (hopefully).
I agree that if they post more than 10 posts or if they post a simple link (like the user linked above), then it is parsed automatically and the counter measure is ineffective.
If it doesn't work, then I fear that the moderation of the first post will be the only solution.

by **acknak** » Mon Apr 23, 2012 12:34 am

My guess is that spammers are paid by the post; I doubt that anything else matters. If that's the case, then it won't matter what we do to prevent the post going public, they are going to continue making posts as long as it's allowed.

by **thomasjk** » Mon Apr 23, 2012 1:11 am

Thank you, Hagar and Acknak for all your efforts to clean out the spammers. Unfortunately, I believe that moderation of the the first post and any stronger measures available should be implemented as quickly as possible. I know some legitimate new users will be impacted but the forum was unusable with the recent spam floods.

by **kingfisher** » Mon Apr 23, 2012 2:09 am

The moderation has to apply to more than the first post and longer than the first day. These people are posting a multitude of posts from the get go.

As far as confusing genuine users is concerned, can one or more of the pages seen in the registration process explain that their posts have to be moderated temporarily because of the need to prevent spam?

EDIT: To give an idea of how this looks to the public, here is a snapshot of what I see near the top of the General board in a reader.

Click on the thumbnail to see the image full size (it was too large a file for this forum).

by **acknak** » Mon Apr 23, 2012 3:43 am

kingfisher wrote:The moderation has to apply to more than the first post and longer than the first day. These people are posting a multitude of posts from the get go.

I'm not sure that's how it works.

As I understand it, all posts from a newly-registered user will go into the moderation queue for review by the mods. It doesn't matter how many posts they make, none of them will be public.

Once a moderator has reviewed the posts and decided whether they're spam or not, the posts can be approved or trashed by the moderator. If a mod decides the user is legitimate and the post(s) approved, the posts will go to the public boards. Once a user has enough approved posts, enough to meet the threshold we set, then they automatically get normal user status and no further moderation of their posts is needed.

We've always avoided moderation because of the increased burden for mods, but I can imagine a number of other problems.

However, I don't see any other choice at this point--at least temporarily, as already proposed.

by **/a3** » Mon Apr 23, 2012 3:55 am

Someone with a ban hammer:
memberlist.php?mode=viewprofile&u=53838

Good thing is it seems to have slowed down, at least for now.

EDIT: more...

memberlist.php?mode=viewprofile&u=53839
memberlist.php?mode=viewprofile&u=53840
memberlist.php?mode=viewprofile&u=53843
memberlist.php?mode=viewprofile&u=53844

by **kingfisher** » Mon Apr 23, 2012 4:10 am

@acknak

Thanks for the information. What about transferring people from NRU to ordinary membership once their bona fides has been established?

[Solved] Spam - straight to delete instead of quarantine?

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Re: Increase of spam - straight to delete instead of quarant

Who is online