homepage Welcome to WebmasterWorld Guest from 54.161.236.229
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member
Home / Forums Index / WebmasterWorld / Webmaster General
Forum Library, Charter, Moderators: phranque & physics

Webmaster General Forum

This 35 message thread spans 2 pages: 35 ( [1] 2 > >     
How Can I Sort Forum Spam Email
Forum Spam Email
Truegho




msg:3994552
 12:40 am on Sep 24, 2009 (gmt 0)

How can I sift through spam emails to enable me to approve the GENUINE registrations? I have a long list of registered emails waiting for me to activate them. However, a lot of these emails are from gmail, which I believe is a popular address which spammers use.

It is an absolute pain not knowing how to sift out the spam emails from the genuine ones, so I would be really grateful for any advice on how I can do this.

 

piatkow




msg:3994780
 8:33 am on Sep 24, 2009 (gmt 0)

Gmail a popular address generally.

It isn't quite clear what the problem is. Do you:
1. Have a lot of spam spoofing gmail accounts which is quite distinct from genuine registrations?
2. Have spam which is spoofing registration requests?
3. Think that a high proportion of genuine requests from gmail customers may be from people who will then spam your forum?
4. Have requests from gmail customers that appear to have been created by a bot?

JS_Harris




msg:3994791
 8:43 am on Sep 24, 2009 (gmt 0)

The trick isn't to sort the mail but to block the junk before it hits the mailbox.

All of the most widely used applications to help prevent spam are generally good but at the same time are the most widely attacked.

Customize your approach for best results. I find a lot of bots have problems with input boxes that are where they should be on any given site but are hidden so that a human wouldn't see it to type anything in. If a bot adds anything to it, ban them.

Custom questions work too, but nothing generic or mathematical.

Captcha works, but I find using captcha that doesn't come with the application works better. If a bot was looking for a particular type of forum it expects a particular captcha system, swap it out for something different.

The more you customize the fewer bots you will likely see. Human spammers on the other hand will get through but they tend to be hit and run types anyway.

Truegho




msg:3994934
 2:44 pm on Sep 24, 2009 (gmt 0)

To Piatkow:

The problem I am having is that, having set my forum's registration process to "Must be activated by The Moderator," when I look to see how many members are awaiting for me to activate their account, I have a long list of emails, and I don't know which are the spammers and which are the genuine ones. It is a big pain. I mean, I could go ahead and tick ALL of them to be activated - but then I run the risk of finding a huge innundation of spammers in my forum!

piatkow




msg:3994995
 3:45 pm on Sep 24, 2009 (gmt 0)

OK, people have registered and some of them might be bad guys who will post spam. The only way you can tell which is which will be once they start misbehaving.

If it is just spam bots finding your registration form and sending you spam through it then you need a captcha to block them there rather than trying to filter the results.

I would expect the forum software to support both captchas and flood protection which should provide additional, second line, defences.

rocknbil




msg:3995164
 7:28 pm on Sep 24, 2009 (gmt 0)

Is your forum geographically specific?

I run one that is U.S. only. I look up the IP address of the registrant, if it's China, Europe, etc., it's outta there.

creeking




msg:3995239
 9:11 pm on Sep 24, 2009 (gmt 0)

I have heard of forums simply not allowing hotmail/gmail/yahoo email addresses during registration.

Captcha works, but I find using captcha that doesn't come with the application works better. If a bot was looking for a particular type of forum it expects a particular captcha system, swap it out for something different.

nice tip.

piatkow




msg:3995511
 9:12 am on Sep 25, 2009 (gmt 0)


I have heard of forums simply not allowing hotmail/gmail/yahoo email addresses during registration.

Because of the users aren't trusted or because of those providers' reputation for treating automated response messages as spam and not delivering them?

Truegho




msg:3995537
 10:21 am on Sep 25, 2009 (gmt 0)

Rocknbil

But how can you be 100% sure if ALL the registrants from China, Europe etc. really are spammers? A couple of genuine registrants might be in there too.

driller41




msg:3995637
 1:49 pm on Sep 25, 2009 (gmt 0)

Don't over obscure the captha - some are terrible nowadays.

and

Dont make the question too hard either - yesterday I was going to join a woodwork forum and was asked a question something like - "name of a wooden joint which is the same as a birds name"

I know some smarty pants will know it but i did not :) LOL

PS is it lap wing or lap something - this is driving me nuts.

piatkow




msg:3995720
 3:56 pm on Sep 25, 2009 (gmt 0)

Dove tail?

With that sort of Q&A captcha I would expect a multiple choice. Otherwise you have to code at least for "dove tail", "dovetail" and "dove-tail" before getting on to obvious mis-spellings like "tale" and then should you be accepting the name of the joint or the name of the bird?

rocknbil




msg:3995774
 5:26 pm on Sep 25, 2009 (gmt 0)

how can you be 100% sure if ALL the registrants from China, Europe etc. really are spammers?

In this particular instance, there is no reason for non-US registrants to join, but you're correct - you have to tread carefully and read other signs. A combination of a foreign IP, a free mail server, and an email like abc1235@yahoo.com is not a good sign. People tend to personalize their emails, most of the time.

I guess it's a balance between the benefit of gathering more members and the time you want to dedicate to maintenance.

sgietz




msg:3995789
 5:42 pm on Sep 25, 2009 (gmt 0)

I added a required custom field during registration that filters out 95% of the spam. The rest can be detected by checking the IP (most BBSs should have an IP checker built in). If the IP gets traced to India, China, etc., I usually nix them. I also scrutinize the email address.

It's going pretty well with this approach.

... and that wood joint question is quite ambiguous. I would bet on dove tail, but that's part of a bird, not a bird itself. That captcha was ill-conceived :D

docbird




msg:3995798
 5:48 pm on Sep 25, 2009 (gmt 0)

Maybe try googling some email addresses from wannabe members (which may get thro captcha, say), see if on any blacklists.

rogerd




msg:3995805
 6:03 pm on Sep 25, 2009 (gmt 0)

Nothing is perfect, since "human verification systems" can always be defeated by employing cheap humans to solve whatever you throw at them. However, simple combinations of captchas, verbal questions, and hidden form fields can block most bots.

If your forum serves international users, then no country-based filtering will be useful. And I know lots of people whose only address is from Gmail, Hotmail, etc., so simply not allowing those addresses will be a problem.

A "defense in depth" strategy may help. After doing what you can to block spam registrations, take additional steps to block spam posts. For new members, as one example, you could put their first post into a moderation queue. Or their first five. Or, you could scan new member posts for links or keywords and let most through but hold suspicious ones.

MrSpeed




msg:3995825
 6:49 pm on Sep 25, 2009 (gmt 0)

I was getting so many spam posters/registrations that I just shut down the forum. I was using phpbb3. I tried to manually approve the registrations but it was a pain as noted above.

Too bad there isn't a system for forums that works as well as akismet.

creeking




msg:3995831
 7:02 pm on Sep 25, 2009 (gmt 0)

Because of the users aren't trusted or because of those providers' reputation for treating automated response messages as spam and not delivering them?

because of the volume of spammer signups using those providers.

jimh009




msg:3995864
 8:08 pm on Sep 25, 2009 (gmt 0)

I came up with a novel solution that completely got rid of all forum spam registrations and as a happy benefit also seemed to drive the bots away. The problem is that it only works on boards that aren't especially busy or popular.

What I did was simply turn off forum registration altogether. I then redirected the link to register for the forum to lead to a static HTML page I created. On that page it lists instructions to register for the forum (the user simply has to send me an email with a few pieces of information). The email link itself is embedded in javascript and can be changed quickly and easily should the email address get spammed out (so far that address has remained spam free). I then manually register the users.

I had a friend who also has a VB board try this and it worked. But we both have very small forums. Needless to say, if you have 100 "real people" a day registering this isn't going to work. But for smaller, less-active boards, doing this can be a real time AND bandwidth saver. My server has worked sooooo much better since I started doing this.

Gomvents




msg:3995865
 8:10 pm on Sep 25, 2009 (gmt 0)

We use a custom made captcha and it stopped all the automated spam registrants. We also require email confirmation which stopped a lot more. Admin approval on the first 5 posts stops even more. you'll never kill ALL spam, but I've found these techniques to be the most effective.

Gomvents




msg:3995866
 8:11 pm on Sep 25, 2009 (gmt 0)

oh, and captchas don't have to be complicated to work, of course if someone writes a script against you they need to, but our captcha has you type in three, clearly easy to read numbers and it still stopped 100% of automated registrants.

stapel




msg:3995872
 8:18 pm on Sep 25, 2009 (gmt 0)

I'm using phpbb3 as well, and I found the following suggestion to be very helpful!

Custom Profile Fields as an Anti-Spammer Tool [phpbb.com]

You'd want to tweak your custom fields, of course.

phranque




msg:3995889
 9:07 pm on Sep 25, 2009 (gmt 0)

The email link itself is embedded in javascript

if by "email link" you mean a "mailto:mbx@example.com" url that is a usability issue for those who use web mail.
the mailto: scheme will start up the default email client which may not be familiar to the user or may not exist for that user on the platform they are using such as a borrowed or public computer.

jkovar




msg:3995916
 9:43 pm on Sep 25, 2009 (gmt 0)

Sounds like you need some help going through those emails to me.

madmatt69




msg:3995918
 9:45 pm on Sep 25, 2009 (gmt 0)

I modded my phpbb3 install so that if a spammer gets through registration, users aren't allowed to post links until they have a certain number of posts. Even then, the links they post are nofollowed and only after they hit a high number of posts (say 150) then it'll remove the nofollow because presumably that user is trustworthy.

Profile pages are denied in robots.txt and links only appear to logged in users.

kapow




msg:3995926
 10:18 pm on Sep 25, 2009 (gmt 0)

We have three clients with phpBB. The spam got so bad they wanted to shut down their forums. We recently setup an automated connection to stopforumspam.com which keeps a blacklist of spammers - and is automatically updated with data from member-forum-owners.

The spam has stopped!

mkassets




msg:3995933
 10:34 pm on Sep 25, 2009 (gmt 0)

We suffered from a huge spam problem on our phpBB board. Two measures stopped the spam completely

1. For bots: Custom-coded math question in the registration form.

2. For humans: added this notice to the registration form.

"Spammers, note: all outgoing links on this forum are nofollow. Do not bother!"

No spam now.

Wlauzon




msg:3996203
 2:30 pm on Sep 26, 2009 (gmt 0)

..But how can you be 100% sure if ALL the registrants from China, Europe etc. really are spammers?..

We don't, but we don't care. We don't sellt to China, India, or a host of other countries where 95% of the spam comes from, so we just block the entire IP range.

We use vBulletin, and have email verification that auto registers. In addition to a range of IP's that are blocked, we also block any email registration that comes from a host of countries and servers, such as *.cn.

thecoalman




msg:3996513
 11:06 am on Sep 27, 2009 (gmt 0)

@ Truegho, for the bots you need to stop them at the door. That means an effective captcha system. As far as human spammers are concerned you need to make it unappealing for them. For example hiding profiles, memberlist, signatures or anywhere else they can get a link in that a bot might find.

For those of you using phpBB, the GD captcha in phpBB3 has worked quite well up until a few months ago. It is still somewhat effective as it can be adjusted but the harder you make it the harder it is for human to read. Slight adjustment on my own forum has shown to keep the bots at bay.

Captcha works, but I find using captcha that doesn't come with the application works better. If a bot was looking for a particular type of forum it expects a particular captcha system, swap it out for something different.

With the release of phpBB 3.0.6 which is currently in the RC phase you'll be able to do this out of the box as it will include a captcha plug-in system. It will be released with 3 winners of a competition they had including the popular Q&A captcha. You could of course create your own plug-in or download from other selections. The addition of this should prove to be quite effective against bots because you'll have numerous systems to choose from which can be updated independently of phpBB3.

rocknbil




msg:3996618
 5:04 pm on Sep 27, 2009 (gmt 0)

Bots were dancing right by the captcha in the VB boards I manage, the custom profile question was the only thing that made them go away. The human spam regs where the ones that got through, and as mentioned, a combination of IP address, mail server, and other "fishy clues" indicate whether it's a problem or not.

Brett_Tabke




msg:3997124
 4:06 pm on Sep 28, 2009 (gmt 0)

pardon me while I spam this thread with a link to another some what related thread ;-)

Professional Forum spammers:
[webmasterworld.com...]

If you practice a good user weed every couple of weeks it can cut way down on problems. Just weed any act that isn't validated.

You can also go the next step (like we do here) and weed any act not posted to for about 60 days.

Both those actions nuke any sleeper bots out of the user file.

This 35 message thread spans 2 pages: 35 ( [1] 2 > >
Global Options:
 top home search open messages active posts  
 

Home / Forums Index / WebmasterWorld / Webmaster General
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved