11 replies to this topic

[Brito]

We are getting hit quite intensively by a wave of spammers.

 

They seem to have registered manually some 50 usernames over the past days and then started to post all kind of silly posts as you might have noticed.

 

The procedure is simple. Stay calm, walk away from these topics and wait for the spam police to arrive.

 

We are working to clean up this mess. Apparently there isn't much defense since these aren't bots but rather some humans doing all the grunt work.

 

Moderators: If you have permission to delete or hide posts then do proceed. When you visit the member profile, you can also mark him as "spammer" to prevent the person from making further posts without moderation.

 

Happy spam-season hunting!

[pscEx]

The "Flag as spammer" is a great enhancement!

 

Congratulations!

 

Peter

[saddlejib]

i'm still muscle building, taking the drugs and on the psycho analysis self worth program

 

Will i recover. ????

[pscEx]

Do not worry!

 

Your doubts are the first step!

 

 

Peter

[Brito]

We're seeing some really weird things over the past three days.

 

I'm still keeping the registration box closed for a bit longer.

[Brito]

Ok, last night I've enabled it and we had 5 registrations in less than 30 minutes.

 

One of the new guys posted a spam message right away.

 

As intermediate solution, I am only allowing people to register through a twitter account. This should still provide a way for those really in need of registering. For the moment still don't have a way of getting over the bots.

[buyerninety]

The spambot messages format is similar to here;

http://www.msfn.org/...ss/#entry532431

so the spambot program has been around for a while. Are you seeing spoofing of the

email header addresses?

[Brito]

He's not sending email messages. Just registers a whole bunch of usernames, waits a bit and then starts to post like crazy in the forum.

 

Oh well. Eventually we will find a way to sort this out.

[buyerninety]

I was thinking more along the lines of identifying the sender IP/subDomain/mailserver/....

& whether they had ever used a unique (gr)avatar...

Edited by buyerninety, 28 November 2013 - 02:44 AM.

[Brito]

Ok, now I understand better.

 

Each time a ban takes place I'm also banning the used IP addresses, email details and they get reported to a database of spammers. Usually we don't get any troubles like recently, this was the first time that we really felt a flood of spam getting through our defenses.

 

I don't have much time to go after the mail servers as these guys are likely just using a swarm of zombie machines instead of legitimate email servers. So, not much conditions to go after them but rather focus on locking down our site to prevent them from re-posting stuff.

 

[florin91]

Do we use Google reCAPTCHA or some other RANDOM captcha method like this? 

[saddlejib]

 I'm missing the spammers now.

Have they got anything for   'Withdrawal Symptoms' ??

 

At one stage I thought I was on reBot.pro had to double check.