Help With Human Spambots

Dreadnaught · 11-04-2009, 09:01 AM

So some of you in certain timezones may have noticed that every day at around 10AM GMT there has been a large wave of ad spam here. Most of it is cleaned up by Marby pretty immediately, but it's pretty consistent.

It's become clear that the bulk of these ad-spammers are actually people in India who are breaking the registration CAPTCHA, making semi-relevant posts with links and then scattering. It's really one of the lamest possible ad-spam efforts because it's relatively labor-intensive, but it also is getting those spam posts here for at least a short period of time.

Does anyone here know of any VB upgrades/registration changes that might help that we can bring to the admins?

Two ideas that have come up among the mods (I personally don't like either option):

1) Limit registrations per hour- We usually get about ten registrations at the same time from different IPs, but almost all coming from India. If we capped registrations per hour, it could slow them down. But it would also mean legitimate people would be bumped by ad spammers.

2) Install a hack that limits link posting within the first #x posts- This would prevent blatant link posting, but I think we've seen that these human ad-spammers will often make a slew of semi relevant posts before making their ad spam pitch. I fear this hack would just give us more to clean up and make it harder to spot ad spammers at first.

Any ideas are welcome!

Illusions · 11-04-2009, 10:55 AM

After registration you must lurk for 24 - 48 hours before being able to post.

DecoyMilk · 11-04-2009, 04:28 PM

Just ip ban the whole of India
seriously, how many legitimate users do you actually get from there?

Nessus · 11-04-2009, 04:45 PM

Quote:

Originally Posted by DecoyMilk

Just ip ban the whole of India
seriously, how many legitimate users do you actually get from there?

****

yes

Illusions · 11-04-2009, 05:17 PM

Before you all get so happy, I was going to suggest something like this but then realized they'll likely just start using Tor or some other service that gives IP anonymity...

Nessus · 11-04-2009, 05:18 PM

Quote:

Originally Posted by Illusions

Before you all get so happy, I was going to suggest something like this but then realized they'll likely just start using Tor or some other IP anonymizer service...

I don't think you get what we were happy about

Illusions · 11-04-2009, 05:19 PM

Quote:

Originally Posted by Nessus

I don't think you get what we were happy about

It works either way the spammers (or in your case, the brown people) will still be posting here...

Nessus · 11-04-2009, 05:20 PM

Steely Glint · 11-04-2009, 05:22 PM

EXTERMINATEN

(that's not german for 'exterminate')

EXTERMINATEN

DecoyMilk · 11-04-2009, 05:23 PM

Quote:

Originally Posted by Illusions

Before you all get so happy, I was going to suggest something like this but then realized they'll likely just start using Tor or some other service that gives IP anonymity...

Doubt it. They probs post on loads of websites, instead of spending ages trying to get round it, they'll likely give up and move to next site.

Atari are hardly popular these days anyway :P

Ominous Gamer · 11-04-2009, 06:23 PM

I've been using Tor to post on here since returning to work. I wonder where it says I've been coming from...

I like the lurking idea, **** man, we need that for the legit new users.

Agamemnus · 11-04-2009, 06:34 PM

Ask a semi-random question in English along with the Captcha (like.. "what color is the J in the captcha?"... dunno if that's too complicated to implement) . Half of them won't be able to answer it.

supermarioman · 11-04-2009, 06:53 PM

To be honest, the only thing you can really do is have more mods, IMO.
More mods = less spam posts getting through.

Marby · 11-04-2009, 07:33 PM

Quote:

Originally Posted by Agamemnus

Ask a semi-random question in English along with the Captcha (like.. "what color is the J in the captcha?"... dunno if that's too complicated to implement) . Half of them won't be able to answer it.

I think that would be a bit complicated to implement but it's worth a try. That reminds me of when we had a question in place that said ''how many letters does the word ''Atari'' has'' but that didn't had any effect.

Quote:

Originally Posted by supermarioman

To be honest, the only thing you can really do is have more mods, IMO.
More mods = less spam posts getting through.

Well... more mods might get rid of the ad spam sooner but they will still be able to post it. We are looking for a way to prevent them from posting it in the first place. That said, I'm sure 99% of the users here are smart enough to recognize ad spam when they see it and thus report it and not click on the links. I think the team we have now is able to get rid of ad spam reasonably soon but it's just a lot of extra work for us all, on a really bad morning (US night) during the heat of the battle so to speak it takes around 20 minutes just to find, ban and remove their posts. Time we rather want to spend on other stuff then playing garbage man.

Loki · 11-04-2009, 07:36 PM

How about having to approve the first post of a new member?

-NGS- · 11-04-2009, 08:30 PM

Quote:

Originally Posted by Dreadnaught

I think we've seen that these human ad-spammers will often make a slew of semi relevant posts before making their ad spam pitch.

Quote:

Originally Posted by Loki

How about having to approve the first post of a new member?

Loki · 11-04-2009, 08:35 PM

They usually have the adspam in their sig though.

Steely Glint · 11-04-2009, 09:08 PM

Some possible counter-measures:

1) No signature privileges for three weeks after sign on.
2) No use of a free e-mail addresses to sign up.
3) Add the links of the sites they're spamming to the word filter.
4) Add single button to ban an account and delete all the posts should make dealing with spammers much less labour intensive.
5) http://kb.siteground.com/article/Blo...Honey_Pot.html
6) Beheading
7) ????

Dreadnaught · 11-04-2009, 09:12 PM

Ideally we could nab them at the registration point...it's bothersome that they are breaking reCAPTCHA and there are not readily available alternative implementations for VB. Unless someone here has heard of one.

My big beef with the "behavioral" mods is they may frustrate legitimate new members out of posting. We actually used to ban free e-mail addresses, but these days most people don't tie their accounts into ISP e-mail addresses. I've never even set up my ISP e-mail.

As for banning all of India, I don't think it's easy to ban an entire domain with the current software. Plus they use proxies and such. Ominous, why do you use Tor? Because of work filters/tracking?

Steely Glint · 11-04-2009, 09:18 PM

You either do it by inconveniencing legitimate users to one degree or another, or you do it by doing more leg work yourselves.

If these are human spammers, why is CAPTCHA even an issue? If robots are breaking CAPTCHA then there are other ways to stop sign ons: simple maths or general knowledge questions, or a big picture of a car or a bus or something asking the user to identify the content of the picture.

Dreadnaught · 11-04-2009, 09:40 PM

If we make the CAPTCHA more difficult or different from the all-too-common versions, in theory it may discourage them from trying...

Ominous Gamer · 11-04-2009, 10:35 PM

Quote:

Originally Posted by Dreadnaught

Ominous, why do you use Tor? Because of work filters/tracking?

Both. I use a portable combo of Tor and Firefox. I don't leave any history and its mostly encrpyted, or something like that.

Its ungodly slow and unpredictable, I can not see spammers using it to get around a ban.

Agamemnus · 11-04-2009, 11:05 PM

Anywayz, I just found a funny ad spammer over in the beta tests forum, everyone!

Ominous Gamer · 11-04-2009, 11:16 PM

The tourettes guy?

To slow

Dreadnaught · 11-04-2009, 11:29 PM

Perfect example of the kinds of stuff we're up against. Just deleted all of those.

SUICIDE · 11-05-2009, 01:54 AM

Adspam in Atari Retro, Anime & Manga Chat forums, and http://www.ataricommunity.com/forums...2#post11580842

try this:

- for new users, have them make 50 posts before they can stretch a page like those of ipod/WM thingies

Marby said:

Quote:

I think that would be a bit complicated to implement but it's worth a try. That reminds me of when we had a question in place that said ''how many letters does the word ''Atari'' has'' but that didn't had any effect.

yeah, that was a hard one.

LittleFuzzy · 11-05-2009, 02:24 AM

Quote:

Originally Posted by Dreadnaught

Ideally we could nab them at the registration point...it's bothersome that they are breaking reCAPTCHA and there are not readily available alternative implementations for VB. Unless someone here has heard of one.

There pretty much aren't any that would be useful to you and which are better than a Captcha. The only good one requires approval of all new registrations. I don't see the admin going for that.

bctrainers · 11-05-2009, 03:19 AM

The following links are for the vbulletin 3.7 series. A few might be of use, most will not be.

NoSpam! for vBulletin 3.7 - http://www.vbulletin.org/forum/showthread.php?t=183329
Stop the Registration Bots - http://www.vbulletin.org/forum/showthread.php?t=183917
Spam Decimator - http://www.vbulletin.org/forum/showthread.php?t=183244
Keyword weight based spam detector - http://www.vbulletin.org/forum/showthread.php?t=184757

There is also this one, but it is for vB3.6, not sure if it is stable with 3.7: http://www.vbulletin.org/forum/showthread.php?t=176481 Uses StopForumspam's DB.

Edit: I completely forgot about this absolutely awesome hack/mod for VB: http://www.vbulletin.org/forum/showthread.php?t=177704

oldmunchkin · 11-05-2009, 09:49 AM

Quote:

Originally Posted by Steely Glint

Some possible counter-measures:

1) No signature privileges for three weeks after sign on.
2) No use of a free e-mail addresses to sign up.
3) Add the links of the sites they're spamming to the word filter.
4) Add single button to ban an account and delete all the posts should make dealing with spammers much less labour intensive.
5) http://kb.siteground.com/article/Blo...Honey_Pot.html
6) Beheading
7) ????

1.)When I joined, we had to have 50 post before we could upload an avatar or have a sig.

2.)The free-mail thingy does NOT work. That was in place when I joined, too. I had a free mail account thru myway.com. For some reason, the forum accepted it as a "paid" e-mail.

3.) But what if I, a legit member, wanted an opinion on buying an i-phone? Then I can't ask, because the words(?) i-phone would be blocked?

4.)

I hate it that I ban a spammer in CC, and have to wait until either Dread or Rand come on, or another super-mod. I don't want to mod everywhere, just be able to remove the ad-spam so you , the usual members, are not subjected to it.

5.) Can't click links tonight/this morning for some reason. Damn I gotta reformat soon!!

6.) Ok! I found a stump that would be perfect for this, and I have Dad's timber ax, so we gots that covered!

7.) ???? What????

ImAnOgre · 11-05-2009, 12:11 PM

Why not allowing users to use VB code or post links to anything until they hit a 50 post count....

Or have users that sign up with a free email address go through some type of process where there account must be activated by a mod. Make sure this is spelled out at registration. If I NEED to login immediately, I can use my ISP webmail, or I can wait till I get activated.

11-04-2009, 09:01 AM	#1
Dreadnaught User Super Moderator (Not Atari Employee) Join Date: Nov 1998 Location: New York City Posts: 37,030	Help With Human Spambots So some of you in certain timezones may have noticed that every day at around 10AM GMT there has been a large wave of ad spam here. Most of it is cleaned up by Marby pretty immediately, but it's pretty consistent. It's become clear that the bulk of these ad-spammers are actually people in India who are breaking the registration CAPTCHA, making semi-relevant posts with links and then scattering. It's really one of the lamest possible ad-spam efforts because it's relatively labor-intensive, but it also is getting those spam posts here for at least a short period of time. Does anyone here know of any VB upgrades/registration changes that might help that we can bring to the admins? Two ideas that have come up among the mods (I personally don't like either option): 1) Limit registrations per hour- We usually get about ten registrations at the same time from different IPs, but almost all coming from India. If we capped registrations per hour, it could slow them down. But it would also mean legitimate people would be bumped by ad spammers. 2) Install a hack that limits link posting within the first #x posts- This would prevent blatant link posting, but I think we've seen that these human ad-spammers will often make a slew of semi relevant posts before making their ad spam pitch. I fear this hack would just give us more to clean up and make it harder to spot ad spammers at first. Any ideas are welcome! __________________ Dreadnaught's Independence War Page \| I-War FAQ \| September 11, 2001 \| We Sell, Or Else

11-04-2009, 10:55 AM	#2
Illusions King of Ellipses . . . Join Date: Mar 2004 Posts: 13,055	After registration you must lurk for 24 - 48 hours before being able to post. __________________ - The world is what you make of it, but sometimes what you make of it, isn't what the world really is. - Love is a weakness I am willing to live with, because it is one of humanity's greatest strengths. - Hate and ignorance are diseases which easily afflict the weak minded.

11-04-2009, 04:28 PM	#3
DecoyMilk Popping boners over Nessus since 26th Oct '07 Join Date: Jul 2002 Posts: 8,926	Just ip ban the whole of India seriously, how many legitimate users do you actually get from there? __________________ 8,850

11-04-2009, 05:17 PM	#5
Illusions King of Ellipses . . . Join Date: Mar 2004 Posts: 13,055	Before you all get so happy, I was going to suggest something like this but then realized they'll likely just start using Tor or some other service that gives IP anonymity... __________________ - The world is what you make of it, but sometimes what you make of it, isn't what the world really is. - Love is a weakness I am willing to live with, because it is one of humanity's greatest strengths. - Hate and ignorance are diseases which easily afflict the weak minded.

11-04-2009, 05:20 PM	#8
Nessus Let nihilism reign supreme! Join Date: Sep 2002 Location: Kissing Mister Quimper Posts: 23,939	NEIN __________________ In the future, the Berlin wall will be a mile high, and made of steel. You too will be made to crawl, to lick children's blood from jackboots. There will be no creativity, only productivity. Instead of love there will be fear and distrust, instead of surrender there will be submission. Contact will be replaced with isolation, and joy with shame. Hope will cease to exist as a concept. The Earth will be covered with steel and concrete. There will be an electronic policeman in every head. Your children will be born in chains, live only to serve, and die in anguish and ignorance. "The universe we observe has precisely the properties we should expect if there is, at bottom, no design, no purpose, no evil, no good, nothing but blind, pitiless indifference. " - Charles Darwin

11-04-2009, 05:22 PM	#9
Steely Glint Speak to your despised Join Date: Jun 2002 Location: remote Victorian mansion Posts: 15,427	EXTERMINATEN (that's not german for 'exterminate') EXTERMINATEN __________________ "If I can shoot rabbits then I can shoot fascists"

11-04-2009, 06:23 PM	#11
Ominous Gamer Remember, remember the fifth of November Join Date: Jul 2006 Location: Tampa, FL Posts: 14,101	I've been using Tor to post on here since returning to work. I wonder where it says I've been coming from... I like the lurking idea, **** man, we need that for the legit new users. __________________ Digital River SecuRom activation Helpline: 952-253-1234

11-04-2009, 06:34 PM	#12
Agamemnus Grandmaster Noob. Join Date: May 2003 Posts: 3,580	Ask a semi-random question in English along with the Captcha (like.. "what color is the J in the captcha?"... dunno if that's too complicated to implement) . Half of them won't be able to answer it. __________________ "Life exists on the edge of chaos" -the late Carl Sagan, and others.

11-04-2009, 06:53 PM	#13
supermarioman It's a me! Join Date: May 2007 Location: Atlanta, Georgia Posts: 4,055	To be honest, the only thing you can really do is have more mods, IMO. More mods = less spam posts getting through. __________________ Thunder Bobs Gravitation Magical World Of Colors

11-04-2009, 07:36 PM	#15
Loki All Worship Ragnarok Join Date: Jan 2002 Posts: 28,719	How about having to approve the first post of a new member? __________________ Oderint dum metuant

11-04-2009, 08:35 PM	#17
Loki All Worship Ragnarok Join Date: Jan 2002 Posts: 28,719	They usually have the adspam in their sig though. __________________ Oderint dum metuant

11-04-2009, 09:08 PM	#18
Steely Glint Speak to your despised Join Date: Jun 2002 Location: remote Victorian mansion Posts: 15,427	Some possible counter-measures: 1) No signature privileges for three weeks after sign on. 2) No use of a free e-mail addresses to sign up. 3) Add the links of the sites they're spamming to the word filter. 4) Add single button to ban an account and delete all the posts should make dealing with spammers much less labour intensive. 5) http://kb.siteground.com/article/Blo...Honey_Pot.html 6) Beheading 7) ???? __________________ "If I can shoot rabbits then I can shoot fascists"

11-04-2009, 09:12 PM	#19
Dreadnaught User Super Moderator (Not Atari Employee) Join Date: Nov 1998 Location: New York City Posts: 37,030	Ideally we could nab them at the registration point...it's bothersome that they are breaking reCAPTCHA and there are not readily available alternative implementations for VB. Unless someone here has heard of one. My big beef with the "behavioral" mods is they may frustrate legitimate new members out of posting. We actually used to ban free e-mail addresses, but these days most people don't tie their accounts into ISP e-mail addresses. I've never even set up my ISP e-mail. As for banning all of India, I don't think it's easy to ban an entire domain with the current software. Plus they use proxies and such. Ominous, why do you use Tor? Because of work filters/tracking? __________________ Dreadnaught's Independence War Page \| I-War FAQ \| September 11, 2001 \| We Sell, Or Else

11-04-2009, 09:18 PM	#20
Steely Glint Speak to your despised Join Date: Jun 2002 Location: remote Victorian mansion Posts: 15,427	You either do it by inconveniencing legitimate users to one degree or another, or you do it by doing more leg work yourselves. If these are human spammers, why is CAPTCHA even an issue? If robots are breaking CAPTCHA then there are other ways to stop sign ons: simple maths or general knowledge questions, or a big picture of a car or a bus or something asking the user to identify the content of the picture. __________________ "If I can shoot rabbits then I can shoot fascists"

11-04-2009, 09:40 PM	#21
Dreadnaught User Super Moderator (Not Atari Employee) Join Date: Nov 1998 Location: New York City Posts: 37,030	If we make the CAPTCHA more difficult or different from the all-too-common versions, in theory it may discourage them from trying... __________________ Dreadnaught's Independence War Page \| I-War FAQ \| September 11, 2001 \| We Sell, Or Else

11-04-2009, 11:05 PM	#23
Agamemnus Grandmaster Noob. Join Date: May 2003 Posts: 3,580	Anywayz, I just found a funny ad spammer over in the beta tests forum, everyone! __________________ "Life exists on the edge of chaos" -the late Carl Sagan, and others.

11-04-2009, 11:16 PM	#24
Ominous Gamer Remember, remember the fifth of November Join Date: Jul 2006 Location: Tampa, FL Posts: 14,101	The tourettes guy? To slow __________________ Digital River SecuRom activation Helpline: 952-253-1234

11-04-2009, 11:29 PM	#25
Dreadnaught User Super Moderator (Not Atari Employee) Join Date: Nov 1998 Location: New York City Posts: 37,030	Perfect example of the kinds of stuff we're up against. Just deleted all of those. __________________ Dreadnaught's Independence War Page \| I-War FAQ \| September 11, 2001 \| We Sell, Or Else

11-05-2009, 03:19 AM	#28
bctrainers Registered User Join Date: Feb 2003 Location: Kansas Posts: 5,479	The following links are for the vbulletin 3.7 series. A few might be of use, most will not be. NoSpam! for vBulletin 3.7 - http://www.vbulletin.org/forum/showthread.php?t=183329 Stop the Registration Bots - http://www.vbulletin.org/forum/showthread.php?t=183917 Spam Decimator - http://www.vbulletin.org/forum/showthread.php?t=183244 Keyword weight based spam detector - http://www.vbulletin.org/forum/showthread.php?t=184757 There is also this one, but it is for vB3.6, not sure if it is stable with 3.7: http://www.vbulletin.org/forum/showthread.php?t=176481 Uses StopForumspam's DB. Edit: I completely forgot about this absolutely awesome hack/mod for VB: http://www.vbulletin.org/forum/showthread.php?t=177704 __________________ -- bc ReplayIRC.com

11-05-2009, 12:11 PM	#30
ImAnOgre Atari Santa Join Date: Dec 2002 Location: Ola, Ga Posts: 4,348	Why not allowing users to use VB code or post links to anything until they hit a 50 post count.... Or have users that sign up with a free email address go through some type of process where there account must be activated by a mod. Make sure this is spelled out at registration. If I NEED to login immediately, I can use my ISP webmail, or I can wait till I get activated. __________________ "I will call you a dumbass, though. Dumbass."By LittleLolligagged "You my friend is simple minded." by Undertaker64

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode