Anti-Spam Protection on LifeWiki

[Nathaniel]

I had to install an anti-spam extension on LifeWiki due to the ridiculous amount of spam over the last few days. Hopefully it won't be too much of a nuisance - it displays an arithmetic captcha if you try to add new external links to a page. Let me know if you have any problems with it.

[DivusIulius]

Oh my... spambot "evathesee" discovered conwaylife.com forum...

[Nathaniel]

Oh my... spambot "evathesee" discovered conwaylife.com forum...

Yeah, hardly the first I'm just usually faster at catching them (and they don't usually spam *all five* forums).

[apg]

Another spambot, geptmaype, has spammed all five forums!

[Nathaniel]

I installed some more SPAM protection on LifeWiki today, let me know if it gives you any trouble.

[apg]

Nathaniel:



On the forum, can you make threads containing certain 'censored' words disappear after 5 seconds?

Rejecting them would provoke the spam-bot, but deleting them momentarily after would work as intended.

[Nathaniel]

On the forum, can you make threads containing certain 'censored' words disappear after 5 seconds?

Rejecting them would provoke the spam-bot, but deleting them momentarily after would work as intended.

Unfortunately, I doubt it. If I'd coded the forums myself I'm sure I could tack a script like that on no problem. I'm nowhere near that proficient with phpBB though. However, considering the popularity of phpBB, there are almost surely some pre-existing anti-spam solutions that work reasonably well, so I'll do some searching for those this week now that the forum spam has officially hit the ridiculous threshold.

[Elithrion]

For the record, I usually catch the spam within a half hour. calcyman's suggestion there followed the one time in several days that I was distracted for a (long) while

[H. V. McIntosh]

For the record, I usually catch the spam within a half hour. .....

I've noticed that spam tends to disappear fairly quickly, but this must mean someone is spending quite a bit of time watching for it. Which can get to be quite a drag. However, I've wondered why the spammer's registration isn't also cancelled at the same time. There are still some spammish links in the registration list, and this is often all the spammers are after; it improves their client's page rank over at places like Google.

My solution to spammers has been to ban lots of pacific and carribean islands and a fair part of the rest of the world. Maybe there are Life Enthusiasts in Tunisia, Patagonia &c, but unfortunately there might be some legitimate interest on ConwayLife.com's PHPBB forum from places that I wouldn't expect on one that I administrate. However, in deciding whether to delete them, their giving the GMT-12 time zone has always been a good indicator.

Given the probable existence of legitimate interest, making registration relatively easy has probably been a wise choice. I was happy to be included at once, rather than having to wait for acceptance and activation. The latter can weed out posted spam - text and images - but they can still get those links on record. Even if you could discourage the scrounger bots (which seem to be ever present), leaving the links still gives the board a bad name if they bear offensive content.

Reading fuzzy images is little protection - software appears to be able to read them, and in any event the wholesale spammers can (and apparently do) just hire people to send out the spam manually. It's a good business, they can afford it.

[Elithrion]

I've noticed that spam tends to disappear fairly quickly, but this must mean someone is spending quite a bit of time watching for it. Which can get to be quite a drag.

I have all the sections set to notify me by email when there's a new post (the notification usually arrives pretty quickly, although sometimes bizarrely slow), and check emails near-constantly anyway, so it's not too bad, actually.

However, I've wondered why the spammer's registration isn't also cancelled at the same time. There are still some spammish links in the registration list, and this is often all the spammers are after; it improves their client's page rank over at places like Google.

Ah, a good point. I think this is because Nathaniel mostly administered IP bans and I've mostly followed suit (although David Green mostly banned/bans usernames when he spots the offending posts first), resulting in the user being removed, but the username remaining. I'll go clean that up some time, maybe.

[Nathaniel]

OK, I've added a small tweak that should deter most of the bots that have been posting on the forums -- when registering, the forum now asks you for the name of the smallest spaceship in Conway's Game of Life. Let's see how that works.

Also, I've cleaned out the usernames in the username list that linked to pharmaceutical and/or naughty sites. I'll have another go at cleaning out the list of the "dud" accounts after another month or so of inactivity from them (since sometimes legitimate people do register and not post, such as Veronika or Jason Summers, and I'd hate to mistakenly delete an account that I thought was created by a spammer but was actually legit).

Edit: And we have success! No spam accounts/posts in 5 days now.

[apg]

On LifeWiki, most of the spammers possess a username of the following form:

Code: Select all

{numerical string} buy {alphabetic string}

For example, "358 buy penicillin" is a possible spam account.


Could you automatically prevent these usernames from posting?

[Nathaniel]

On LifeWiki, most of the spammers possess a username of the following form:

Code: Select all

{numerical string} buy {alphabetic string}

For example, "358 buy penicillin" is a possible spam account.


Could you automatically prevent these usernames from posting?

That's exactly what my last spam protection update was, actually. And since I implemented that (a couple weeks ago), there hasn't been a single SPAM page posted (though they still are able to register, which is annoying and I'm not sure how to stop).

[Awesomeness]

Sorry for deep nercro on this thread, but I think this community is smart enough not to care and my post is relevant.

There is another type of spammer that has names of the format

Code: Select all

[4 char letters and numbers] [arbitrary length string] [mp3 download]

A regular expression for that shouldn't be too hard.

Example.

[Haycat2009]

Sorry for deep nercro on this thread, but I think this community is smart enough not to care and my post is relevant.

There is another type of spammer that has names of the format

Code: Select all

[4 char letters and numbers] [arbitrary length string] [mp3 download]

A regular expression for that shouldn't be too hard.

Example.

Now we have hackers hijacking accounts and I do not know wheteher mine is next on the chopping board. How do we solve this???

[MEisSCAMMER]

Sorry for deep nercro on this thread, but I think this community is smart enough not to care and my post is relevant.

There is another type of spammer that has names of the format

Code: Select all

[4 char letters and numbers] [arbitrary length string] [mp3 download]

A regular expression for that shouldn't be too hard.

Example.

Now we have hackers hijacking accounts and I do not know wheteher mine is next on the chopping board. How do we solve this???

Answer: we don't, Nathaniel does. Also, I am aware of two, tops, accounts that have been hijacked. As I remember someone saying elsewhere, there's just no money in taking real effort to hijack such an obscure forum when there are others that more people read and thus are more profitable.

[confocaloid]

Rule-violating usernames in Special:Log/newusers (18 August 2024) https://conwaylife.com/w/index.php?titl ... ogid=59825 https://conwaylife.com/w/index.php?titl ... ogid=59826

[dvgrn]

Rule-violating usernames in Special:Log/newusers (18 August 2024) https://conwaylife.com/w/index.php?titl ... ogid=59825 https://conwaylife.com/w/index.php?titl ... ogid=59826

The two newly created LifeWiki user accounts have been blocked. Not sure if I did it entirely right -- the blocklist only got used a couple of times last year, and before that it hasn't been needed since 2015. I left the option checked to "Automatically block the last IP address used by this user, and any subsequent IP addresses they try to edit from".

[hotdogPi]

Is a rename possible?

[dvgrn]

Is a rename possible?

... Maybe? Or maybe more likely, Nathaniel might just delete those two usernames eventually -- not sure. Why would a rename be important?

It's an awfully mild violation of the no-foul-language rule -- as a forum search will show, it's a word that gets used quite a lot with hardly anyone ever bothering to complain about it.

In a LifeWiki username, though, it was a fairly clear sign of intent to mis-use the LifeWiki -- or at least, to exclusively use LifeWiki user pages for questionable reasons, with no particular likelihood of making useful contributions elsewhere.

[Haycat2009]

Why block it instead of denying the trusted flag? The block is redundant.

(A 300 year block sounds worse than an infinite block.)

[confocaloid]

Why block it instead of denying the trusted flag? The block is redundant.

To attempt to prevent more user accounts registered by the same spammer?

[Haycat2009]

Why block it instead of denying the trusted flag? The block is redundant.

To attempt to prevent more user accounts registered by the same spammer?

Yes, but the extra user accounts cannot do anything as long as the trusted flag is denied.

[confocaloid]

Why block it instead of denying the trusted flag? The block is redundant.

To attempt to prevent more user accounts registered by the same spammer?

Yes, but the extra user accounts cannot do anything as long as the trusted flag is denied.

Simply creating a SPAM account is already a violation.

[Haycat2009]

Should we actually put our foot down on the creation of the spam users in Lifewiki?