Jump to content











Photo
- - - - -

Wave of spammers in progress


  • Please log in to reply
11 replies to this topic

#1 Nuno Brito

Nuno Brito

    Platinum Member

  • Team Reboot
  • 10452 posts
  • Location:boot.wim
  • Interests:I'm just a quiet simple person with a very quiet simple life living one day at a time..
  •  
    European Union

Posted 25 November 2013 - 08:02 PM

We are getting hit quite intensively by a wave of spammers.

 

They seem to have registered manually some 50 usernames over the past days and then started to post all kind of silly posts as you might have noticed.

 

The procedure is simple. Stay calm, walk away from these topics and wait for the spam police to arrive.

 

We are working to clean up this mess. Apparently there isn't much defense since these aren't bots but rather some humans doing all the grunt work.

 

Moderators: If you have permission to delete or hide posts then do proceed. When you visit the member profile, you can also mark him as "spammer" to prevent the person from making further posts without moderation.

 

Happy spam-season hunting! :)


  • pscEx and eye0 like this

#2 pscEx

pscEx

    Platinum Member

  • Team Reboot
  • 12688 posts
  • Location:Korschenbroich, Germany
  • Interests:What somebody else cannot do.
  •  
    European Union

Posted 25 November 2013 - 09:00 PM

The "Flag as spammer" is a great enhancement!

 

Congratulations! :1st:

 

Peter


  • Tripredacus likes this

#3 saddlejib

saddlejib

    Frequent Member

  • Advanced user
  • 270 posts
  •  
    United Kingdom

Posted 25 November 2013 - 10:58 PM

i'm still muscle building, taking the drugs and on the psycho analysis self worth program

 

Will i recover. ????



#4 pscEx

pscEx

    Platinum Member

  • Team Reboot
  • 12688 posts
  • Location:Korschenbroich, Germany
  • Interests:What somebody else cannot do.
  •  
    European Union

Posted 25 November 2013 - 11:43 PM

Do not worry!

 

Your doubts are the first step!

 

 

Peter :cheers:



#5 Nuno Brito

Nuno Brito

    Platinum Member

  • Team Reboot
  • 10452 posts
  • Location:boot.wim
  • Interests:I'm just a quiet simple person with a very quiet simple life living one day at a time..
  •  
    European Union

Posted 26 November 2013 - 09:19 AM

We're seeing some really weird things over the past three days.

 

I'm still keeping the registration box closed for a bit longer.



#6 Nuno Brito

Nuno Brito

    Platinum Member

  • Team Reboot
  • 10452 posts
  • Location:boot.wim
  • Interests:I'm just a quiet simple person with a very quiet simple life living one day at a time..
  •  
    European Union

Posted 27 November 2013 - 09:42 AM

Ok, last night I've enabled it and we had 5 registrations in less than 30 minutes.

 

One of the new guys posted a spam message right away.

 

As intermediate solution, I am only allowing people to register through a twitter account. This should still provide a way for those really in need of registering. For the moment still don't have a way of getting over the bots.



#7 buyerninety

buyerninety

    Newbie

  • Validating
  • 10 posts

Posted 27 November 2013 - 07:49 PM

The spambot messages format is similar to here;

http://www.msfn.org/...ss/#entry532431

so the spambot program has been around for a while. Are you seeing spoofing of the

email header addresses?



#8 Nuno Brito

Nuno Brito

    Platinum Member

  • Team Reboot
  • 10452 posts
  • Location:boot.wim
  • Interests:I'm just a quiet simple person with a very quiet simple life living one day at a time..
  •  
    European Union

Posted 27 November 2013 - 09:15 PM

He's not sending email messages. Just registers a whole bunch of usernames, waits a bit and then starts to post like crazy in the forum.

 

Oh well. Eventually we will find a way to sort this out. :)



#9 buyerninety

buyerninety

    Newbie

  • Validating
  • 10 posts

Posted 28 November 2013 - 02:00 AM

I was thinking more along the lines of identifying the sender IP/subDomain/mailserver/....

& whether they had ever used a unique (gr)avatar...


Edited by buyerninety, 28 November 2013 - 02:44 AM.


#10 Nuno Brito

Nuno Brito

    Platinum Member

  • Team Reboot
  • 10452 posts
  • Location:boot.wim
  • Interests:I'm just a quiet simple person with a very quiet simple life living one day at a time..
  •  
    European Union

Posted 28 November 2013 - 09:39 AM

Ok, now I understand better.

 

Each time a ban takes place I'm also banning the used IP addresses, email details and they get reported to a database of spammers. Usually we don't get any troubles like recently, this was the first time that we really felt a flood of spam getting through our defenses.

 

I don't have much time to go after the mail servers as these guys are likely just using a swarm of zombie machines instead of legitimate email servers. So, not much conditions to go after them but rather focus on locking down our site to prevent them from re-posting stuff.

 

:cheers:



#11 florin91

florin91

    Frequent Member

  • Team Reboot
  • 197 posts
  •  
    European Union

Posted 28 November 2013 - 04:46 PM

Do we use Google reCAPTCHA or some other RANDOM captcha method like this? 



#12 saddlejib

saddlejib

    Frequent Member

  • Advanced user
  • 270 posts
  •  
    United Kingdom

Posted 28 November 2013 - 11:36 PM

 I'm missing the spammers now.

Have they got anything for   'Withdrawal Symptoms' ??

 

At one stage I thought I was on reBot.pro had to double check.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users