Forum Moderators: phranque
My site is very industry specific, and some idiot came posting "1,000's of useless USED WIDGETS for sale, click here!" in a web site where the topic is so far off base, my visitors may have never even owned or seen one of those widgets.
What are they thinking or are they thinking at all?
Do their little brains just run in a loop to the expense of all other logical thought?
"Must spam, paste, click, submit, must spam, paste, click, submit..."
Luckily this only happens a couple of times a week or I'd be fit to be tied!
As I understand it, forum spamming is more and more an automated process. The spammer him/herself, gets more and more into the role of a software developer. He checks the forum, sees how it works, then programs a few lines in PHP or PERL, and fires off.
Some insight was given here: [theregister.co.uk...]
Thanks for the heads up.
You're on a losing battle, and I see only two ways out:
I think captchas is the way to go, however some of your regular users might not like them.
Captchas isn't such a bad idea, thanks for reminding me, I've been comtemplating them for a while and got lazy. I may also quickly implement full email validation before accepting the submission which means a real human has to initially click a link in an email and do something the first time, that foils bots as well.
I guess it's just a wake up call to get my lazy butt in gear and finish pending projects.
just 3 random people with nothing in common
... or so you believe. Just to recapitulate - modern forum spammers are high-tech warriors. They control bot-nets very similar to the ones used for distributed denial of service attacks. It's fairly easy for them to use the IP's of three different people, and fake 3 user agents. Most likely the bots even use portions of the Internet Explorer (THANK YOU, Microsoft, to embed it so deeply into the system) and therefore it's UA string.
full email verification
And you mean for somebody who can set up a bot-network to spam forums, it would really be a problem to collect email from various POP mailboxes, scan them for links and "click" on these links?
And no, I don't think an automated spam post systems (if indeed it is) would address my mailback confirmations.
I could be wrong, but we'll find out tomorrow :)
1)Spammer Joe writes a script to spam your forum to push the sale of Joe's Widgets.
2)You most likely already have server-side code in place to format the submitted post data. Just add a few lines of code to check for the word "Widget" or "Joe's Widget".
3)If the message contains the words "Widget" send a confirmation that the message was posted succesfully (or whatever you normally do) but instead actaully have your script delete the post.
4)The spam script will think that the posts are getting made and the spammer will never know the difference unless they actually take the time to visit your site.
5)Now if they do visit your site and figure out what is going on and change their spam script to use differen't forms of the word "Widget" like "W1dget" or whatever, then simply adjust your script accordingly.
6)Inevitably, unless the spammer really hates you, they will tire of this game and go find easier prey to target their abuse upon.
or, if you want to do it the easy way,
If you have a bad-word filter, just add "Widget" to the filter and make it display some other words in it's place.
Just color me baffled and bewildered at this point.
The solution turned out to be trivial after thinking about it for a while.
I just check to see where the post came from, and if the form isn't submitted from the form page I reject it.
If they figure it out and fake a page referrer I'm back to square one, but I'm hoping they aren't that interested to figure it out.
What about refining it with form-submitting-pages which change names per each submittal by an algorithm only you know. So referrers can't be tweaked since they change each time.
I also have session tracking technology in the site and I can also bump visitors that hit the form-submit that don't have an active session. If I wanted, I could even set a transaction ID into the form each time someone pulls it up and verify that ID is passed to the submit page.
Fortunately the nonsense has stopped, but if it starts up again I have new ideas to protect it.
I reward those that don't attempt to drop HTML into the post by giving them their home page link that does not contain a ref=nofollow tag.
That seems to be working for me.
