Recent Spambot Activity

[Taw]

Lately there has been quite a few more spambots frequenting our forums than we would like (the number we would like is zero!).

Over the past month the following changes have been enacted to help combat some of the spam:

1. Spam-O-Matic settings were tweaked to be stronger and more strict, as well as more restrictions were imposed on accounts under "New User" (default account when you register - the system checks every 5 minutes to see who has a post of 1 or higher to move them into "Registered Users" and give them full permissions).

2. Our Honeypot has been tweaked to be more strict on IP addresses the visit the site (unfortunately this may also affect some users unintentionally if set too strict, so we can't push it much further).

3. I've installed a product to help combat some spam as the bots are somehow bypassing restrictions in place from Spam-O-Matic. This new plugin requires a post count of 1 before links are posted in any forum section. We'll have to see if spambots are able to get around this as well.

---

Unfortunately, some spammers do bypass our system, and this sometimes isn't the fault of the system itself - some of the spammers may be human and posting spam manually. In these cases, if they follow our forum procedures and gain their first post count and then post their spam - the system wont pick it up.

[PepperHead]

Thanks for being so on-top on this problem It's good to know that the staff are working for us <3
I really like that you need to post once before you can add links. Some forums make you post 10 times, which I think can be too much (especially to those trying to come out of their shell), but the restriction works.

[Taw]

It seems like every time we update our spambot defenses, they eventually find a way to slip through. Hopefully this will quell it for a while!

[Fibriel Solaer]

I have an oddball idea that might help.

When you ban a spambot, they make another account, correct?

What if instead of banning them, you set their posts to not appear to anyone but them? Then they will take longer (if not forever) to realize they've been banned and won't make another account.

This may take more resources as the invisible posts are still stored on the server, but it will dramatically lower the inconvenience to users. If the server also auto-prunes bot posts that reach a certain age it should mitigate any storage space concerns.

[Taw]

I have an oddball idea that might help.

When you ban a spambot, they make another account, correct?

What if instead of banning them, you set their posts to not appear to anyone but them? Then they will take longer (if not forever) to realize they've been banned and won't make another account.

This may take more resources as the invisible posts are still stored on the server, but it will dramatically lower the inconvenience to users. If the server also auto-prunes bot posts that reach a certain age it should mitigate any storage space concerns.

Shadow banning them would work if they were posting more than once. The only ones that have posted multiple times are the ones who figure out our restrictions on posting links (needing 1 post count), so they make a post initially, and then post their spam. It's a good suggestion, but it doesn't really work effectively in this situation.

Also, when we ban a user for spam, their IP gets blacklisted as well so they have to use a new proxy if they make a new account.

[Fibriel Solaer]

Shadow banning them would work if they were posting more than once. The only ones that have posted multiple times are the ones who figure out our restrictions on posting links (needing 1 post count), so they make a post initially, and then post their spam. It's a good suggestion, but it doesn't really work effectively in this situation.

Also, when we ban a user for spam, their IP gets blacklisted as well so they have to use a new proxy if they make a new account.

That depends. My IP changes completely each time my router resets, to the point that I occasionally find myself under IP bans that didn't apply to me before until I reset it again... I'm sure someone making a business of spamming can change their IP just as easily.

[ShadWolf]

Perhaps it might be better to setup ReCaptcha as a security layer, it should in turn prevent spambots from bypassing it so easily.

Also, I dunno if this be possible with VBulliten boards but, you could probably look to setting up registrations so that nobody can register through using proxies for the likes of Tor and all that. This should encourage users to register with their own original IP they are registered with. It does come with a risk though because IP's a randomly changed and reused by ISP's it might cause some users unable to get on the site to login.

[Taw]

Perhaps it might be better to setup ReCaptcha as a security layer, it should in turn prevent spambots from bypassing it so easily.

Also, I dunno if this be possible with VBulliten boards but, you could probably look to setting up registrations so that nobody can register through using proxies for the likes of Tor and all that. This should encourage users to register with their own original IP they are registered with. It does come with a risk though because IP's a randomly changed and reused by ISP's it might cause some users unable to get on the site to login.

We are currently using ReCaptcha as a security layer and since I originally made this post we have gotten roughly 5 spammers in total, so the current system works quite well. If things become a problem then I'll take a look at adjusting the system further.

[Willow]

Perhaps it might be better to setup ReCaptcha as a security layer, it should in turn prevent spambots from bypassing it so easily.

Also, I dunno if this be possible with VBulliten boards but, you could probably look to setting up registrations so that nobody can register through using proxies for the likes of Tor and all that. This should encourage users to register with their own original IP they are registered with. It does come with a risk though because IP's a randomly changed and reused by ISP's it might cause some users unable to get on the site to login.

Wouldn't it also become a problem if you try to sign in from a different location too?

[QT Melon]

Usually a timer filter works really well. There's a product for Vbulletin that lets you set a timer on how quickly a spammer submit a registration. It doesn't eliminate all of them but it keeps many them from registering in the first place.