Where does all that spam come from?

merz1 · 2011-07-27 20:43:24

Congratulation guys & thanks :)

ruud · 2011-07-27 21:34:34

After two hours: 73 registration attempts of which 71 were rejected.
It’ll be interesting to see what those 2 users do, the ones that did manage to register. I’m wondering if it makes sense to also check for spammers the first time they try to log in with the username/password they received by email, because I noticed that some first posts (spam) occurred several days after the registration. Or perhaps we should also do a check on the first and/or second post. Just a matter of fine-tuning.

After 12 hours: 425 registration attempts. Only 9 were not rejected.

Last edited by ruud (2011-07-28 07:28:23)

merz1 · 2011-07-28 09:30:52

Transparency & in case new TXP-ham users are rejected:

Textpattern should communicate the existence of the new spam barrier on all standard channels (blog, twitter, identi.ca, facebook, ???). A simple link to Ruuds public forum announcement should be sufficient.
What’s the workflow if new TXP-ham users are rejected and give feedback (hopefully)?

Short message

FYI: !Textpattern #CMS forum implemented a check using #stopforumspam during #registration http://bit.ly/osvFZB

Two broadcasts so far

ruud · 2011-07-28 09:36:49

1. Personally I don’t see a need to broadcast this. The only ones who should be informed are the ones being rejected by accident (false positive)… and they get a message saying that their email address or IP address is currently banned.
2. What’s the workflow if someone registers that was previously banned (same user name)? There have always been anti-spam measures on this forum. Those measures were never communicated.

colak · 2011-07-29 03:51:50

Hi ruud

A couple of spammers managed to come through (in fact it was one, using different usernames) in spite the fact that they are listed in stopforumspam. I banned them (usernames: fauseli & leufastpi) before deleting should you want to investigate.

Last edited by colak (2011-07-29 03:55:10)

ruud · 2011-07-29 07:20:40

@Colak (and others)

Look at the date the spammer registered. If it was before the 27th, it’s obvious why it wasn’t rejected, because stopforumspam wasn’t implemented yet at that time.

I never ban users within the forum itself. Looking at the stopforumspam results, it rarely finds a spammer by username, only by IPnumber and email address. What’s interesting for me is the IPnr used when the spammer actually posted something and his/her/its emailadress. If those do show up in stopforumspam (at the time when the spam was posted), then I can take extra measures.

ruud · 2011-07-29 17:53:50

After almost 2 days: 1674 registration attempts. 41 succeeded, only 2.5% (that percentage is pretty stable, if I compare both days).
So let’s see what happens if we look at the accepted registrations now:
27 june: 2 spam, 3 ham
28 june: 15 spam, 4 ham, 2 old (which would’ve been rejected the first time if I had set limits differently)
We can catch a lot of spam registrations by checking again 1 or 2 days later… and looking at the spam reports (at least the ones I handled), a registered account is used to post spam mostly a few days after registration. So what I can do is at least check again the first time they actually log in.

colak · 2011-07-29 19:00:55

ruud you are becoming a punBB god.

ruud · 2011-08-06 13:13:32

During the past week, stopforumspam wasn’t just used to check during registration, but also when the user logged in for the first time.

101 users logged in for the first time (keep in mind that 97% of registration attempts fails, so this is the 3% that is allowed to register)
24 were rejected (detected as spam) and on average tried 2.4 times to log in.
77 got through (hopefully not spammers for the most part).

The next option to detect spam is when they actually post something (during the time they are ‘new members’), but at that stage the appropriate action wouldn’t be just to reject the post, but also to delete the user entirely and that’s not 100% risk-free.

Is the amount of spam acceptable now? I see only 1 or 2 reports per day on average.

els · 2011-08-06 13:54:07

ruud wrote:

Is the amount of spam acceptable now? I see only 1 or 2 reports per day on average.

Very acceptable :) I’ve seen 4 today, but that’s more or less the daily maximum lately. Thanks for all your efforts!

net-carver · 2011-08-06 14:26:23

I applaud the efforts of Ruud, Yiannis, Robert & Els (and any other administrators I’ve missed) in keeping on top of this problem.

Thank you one and all.

colak · 2011-08-06 15:57:24

net-carver wrote:

I applaud the efforts of Ruud, Yiannis, Robert & Els (and any other administrators I’ve missed) in keeping on top of this problem.

Kudos goes to ruud.

For the rest of us deleting 3-4 spammers a day is not hard at all.

ruud, did you create a two way script with stopforumspam? Is sfs notified when we ban anyone?

Textpattern CMS

Textpattern CMS support forum

#49 2011-07-27 20:43:24

Re: Where does all that spam come from?

#50 2011-07-27 21:34:34

Re: Where does all that spam come from?

#51 2011-07-28 09:30:52

Re: Where does all that spam come from?

#52 2011-07-28 09:36:49

Re: Where does all that spam come from?

#53 2011-07-29 03:51:50

Re: Where does all that spam come from?

#54 2011-07-29 07:20:40

Re: Where does all that spam come from?

#55 2011-07-29 17:53:50

Re: Where does all that spam come from?

#56 2011-07-29 19:00:55

Re: Where does all that spam come from?

#57 2011-08-06 13:13:32

Re: Where does all that spam come from?

#58 2011-08-06 13:54:07

Re: Where does all that spam come from?

#59 2011-08-06 14:26:23

Re: Where does all that spam come from?

#60 2011-08-06 15:57:24

Re: Where does all that spam come from?

Board footer