Increasing Spam Problem

[William Rubel]

For some months I have been getting a single spam entry, usually from China in Chinese, every few days. The last couple days, however, I have been getting several spam entries -- this are typically lists of links -- from a variety of spammers -- some in Chinese, but some also in English. Though the content is not really relevant to the problem, they seem to range from spam links to nokia to adobe to sex sites.

I have also recently begin to get spammers registering.

Banning IP addresses for the spammes has so far done nothing -- presumably the IP address isn't their real address.

What can I do to increase security? How can I mask the forum from spammers?

Thank you for your help.

[Harzem]

If they seem to be manual spammers, you have very few things to do. If they spam in masses, like spam bots, you can use captcha verification mod.

[pkstokes]

I switched to using SMF instead of YABB 1.3 for this very same reason. ...for me the key feature is the ability to require approval for registration.  (One of the "few things to do" that was very attractive!)

Under the ADMIN section I chose "Edit Features and Options" and then went just over halfaw down the screen to where it says "Method of registration employed for new members".  I chose "Member Approval" and this gives me control over who is able to register (guests, of course, have been banned from posting).

Obviously this is not very workable if you get loads of new registrations on a regular basis, but on a slow board like mine it's quite manageable.  And, of course, I still have to guess whether I'm going to trust the new applicant.

One more thought (and it's probably already been done, but just in case ther's an oversight) :
...have you actually removed these people from the list of members, and not simply tried blocking their IP address?

Hope it helps deal with the annoyance!

[Aitsukai]

If they seem to be manual spammers, you have very few things to do. If they spam in masses, like spam bots, you can use captcha verification mod.

This can be found here, for the record.

[William Rubel]

Thank you.

I installed CAPTCHA. I asked a friend to register. She got the following error message:


Not Acceptable
An appropriate representation of the requested resource /forum/index.php could not be found on this server.

Apache/1.3.36 Server at www.williamrubel.com [nofollow] Port 80

On the other hand, the registration did go through and she received the confirmatione-mail and i see her listed as a new member.

Do you know what I can do to fix this error?

I am running the latest SFM 1.1 RC2

Thank you

[William Rubel]

In reply to pkstrokes and others who mentioned manual spammers.

I don't thing the spammers are manual -- but who can know. Some of them might be -- someone in China paid to do this sort of thing -- but I would tend to think that the spam is by robot as I can't imagine it would be worthwhile to pay someone to spam by hand.

I deleted all apparently spurious registrations. I also banned registrations from an e-mail address that was used repeatedly posts *@cachette.com but the bot used by these cachette registrants seems not to be affected by the SMF ban. I entered the e-mail address with wildcard in the space for triggers -- but registrations continued at this domain.

[rnorth6920]

^

I'm having the very same issue your having with cashette.com.  I just banned the email address and required new members to verify their email address to activate their account and all is well so far.

[William Rubel]

I got CAPTCHA to work -- I installed -- uninstalled -- and installed -- and then everything was fine. The first couple days -- total relief -- no more spammers. But today there was a Chinese spam -- looks like links to mp3 related stuff. I was getting solitary Chinese spam -- this same stuff -- before I started getting hit hard. Is it possible that this is being put in manually?

[Kindred]

yes... it is possible to put it in manually... if you have captcha installed and working, then it is likely that is what is happening.

[William Rubel]

Last night I was spammed by 10 Chinese advertising posts.

A friend suggested banning ranges of IP addresses. I went back into my ban log and banned all the Chinese IP addresses associated with spamming -- but as a range e.g. 60.8.*.*. If I leave the bans in place for a couple months then I assume I will be dropped from their manual spam list and then I can remove the ban so legimate users from China can use my boards.

[sawz]

try turning off guest posting

[TLM]

The only thing I do is simply ban the email domain from posting, and it seems to be stoping most of the bots.

Ban list has 6 domains on it so far and seems to be doing very well at blocking them.
*@*.pisem.net, *@cashette.com (kinda funny if you visit the domain), *@hotpop.com, *@mail.ru, *@toughguy.com, *@yandex.net.
cashette and mail dot ru have the most hits but the others have a couple.

Iv only had one try to register a name to post, and it bounced the member activation email.  Unfortantly they dont seem to becoming from just one subnet, its hit or miss all over the place so I am wondering if its not some sort of distributed botnet.

[DarthAnalyst]

I'm having the same problem with my forum (and came out here hoping for a solution).  We're getting a couple 'new members' nearly every day.  I've been banning them by IP and e-mail address (and early on, everything from 'cashette.com'), but keep getting new ones.

So far, we've had problems with the following:

cashette.com
mail.ru
madol.com
hotpop.com
isonline.com
users.1go.dk
ridiadrug.com
toughguy.net
yandex.ru

We're going to try CAPTCHA, but figured the list of e-mail domains might help someone else.

[roxpace]

Sometimes I wish I could ban all IP's in India, Taiwan, Korea, China and Russia. Because I am getting thousands of different spams every day from those countries with too different sending IP's / hostnames+domainnames.

But I have also a lot of serious users from those countries so of course I will never ban those just because a few is abusing the net a lot.

[JayBachatero]

Can someone verify if it's a bot or manual entry.

[TLM]

Its got to be a bot, as soon as I put in the CAPTCHA mod, it quit.

[sawz]

Its got to be a bot, as soon as I put in the CAPTCHA mod, it quit.

HOORAY

[mclane]

Hey, I'm having the same problem on my site. Turning on the email verification did slow it down (Mainly that they can't post) but I still get a lot of registrations to delete.

The big one I'm getting is .gaweb For some reason even though I've banned the hostname it keeps allowing it to register. Very odd.

PA