Forums: Rockclimbing.com: Suggestions & Feedback:
Prepare to be massively spammed
RSS FeedRSS Feeds for Suggestions & Feedback

Premier Sponsor:

 


jt512


Dec 12, 2011, 7:28 PM
Post #1 of 7 (1307 views)
Shortcut

Registered: Apr 11, 2001
Posts: 21887

Prepare to be massively spammed
Report this Post
Average: avg_1 avg_2 avg_3 avg_4 avg_5 (0 ratings)  
Can't Post

Below is a snapshot of "who" is currently online. With one notable exception, every username ending in digits is from a spambot.


Attachments: spam-online.png (142 KB)


xmesox


Dec 12, 2011, 10:58 PM
Post #2 of 7 (1290 views)
Shortcut

Registered: Jun 17, 2009
Posts: 326

Re: [jt512] Prepare to be massively spammed [In reply to]
Report this Post
Average: avg_1 avg_2 avg_3 avg_4 avg_5 (0 ratings)  
Can't Post

We recently came under a large spam attack, it started in October but seemed to be fairly small so we tried disabling them when they popped up, but earlier this week a look into the database shows that they were as of then registering up to 5000 spam users a day. These bots were able to 'crack' our captcha and validate their account e-mails.

We have taken action and disabled hotmail and yahoo accounts from registering at the moment, until we increase the security in our registration process. So at the moment no new spammers are registering.

But it's going to take a little while to remove the bots that have registered thus far, the process has started and thousands have already been removed.

The only plus side to this is that they weren't forum spammers and they all rather resort to just link building by inserting URLs in their profiles.

Hopefully they will all be gone soon...


mojomonkey


Dec 13, 2011, 8:19 AM
Post #3 of 7 (1273 views)
Shortcut

Registered: Aug 13, 2006
Posts: 837

Re: [xmesox] Prepare to be massively spammed [In reply to]
Report this Post
Average: avg_1 avg_2 avg_3 avg_4 avg_5 (0 ratings)  
Can't Post

As noted in another thread, the software used to generate accounts seems to like putting "ffd" for interests. Looks like you should be able to query your user DB for accounts with that interest to get a good list for review / pruning.

A quick scan for ffd with Google seems to only pick up spam accounts, but you could do better with your own DB queries, of course.

Perhaps filter by having 0 posts, the only logon being within 24 hours of their account creation, and the homepage filled out (and maybe additionally that at least the last character of their username is a digit). That would likely clean up much of the user DB.


donwanadi


Dec 14, 2011, 4:53 AM
Post #4 of 7 (1249 views)
Shortcut

Registered: Oct 19, 2011
Posts: 170

Re: [jt512] Prepare to be massively spammed [In reply to]
Report this Post
Average: avg_1 avg_2 avg_3 avg_4 avg_5 (3 ratings)  
Can't Post

jt[u][b]512[/b][/u] wrote:
Below is a snapshot of "who" is currently online. With one notable exception, every username ending in digits is from a spambot.

Jt512 is a SPAMMER!


Kartessa


Dec 16, 2011, 5:53 PM
Post #5 of 7 (1221 views)
Shortcut

Registered: Nov 17, 2008
Posts: 7356

Re: [jt512] Prepare to be massively spammed [In reply to]
Report this Post
Average: avg_1 avg_2 avg_3 avg_4 avg_5 (0 ratings)  
Can't Post

I kinda dig how most of them are looking at other users' information


jt512


Dec 18, 2011, 9:18 PM
Post #6 of 7 (1204 views)
Shortcut

Registered: Apr 11, 2001
Posts: 21887

Re: [donwanadi] Prepare to be massively spammed [In reply to]
Report this Post
Average: avg_1 avg_2 avg_3 avg_4 avg_5 (1 rating)  
Can't Post

donwanadi wrote:
jt[u][b]512[/b][/u] wrote:
Below is a snapshot of "who" is currently online. With one notable exception, every username ending in digits is from a spambot.

Jt512 is a SPAMMER!

That's a good catch. The "one notable exception" I had in mind was carabiner96.

Jay


qwert


Dec 26, 2011, 1:57 AM
Post #7 of 7 (1125 views)
Shortcut

Registered: Mar 24, 2004
Posts: 2392

Re: [xmesox] Prepare to be massively spammed [In reply to]
Report this Post
Average: avg_1 avg_2 avg_3 avg_4 avg_5 (0 ratings)  
Can't Post

xmesox wrote:
The only plus side to this is that they weren't forum spammers and they all rather resort to just link building by inserting URLs in their profiles.
http://www.rockclimbing.com/...post=2559313#2559313

Here's one that fits into that name+digits scheme that also posts in the forums. He hasnt yet figured out how the url tags work, and this spam is even more "off" than most stuff, but maybe they have changed tactics?

qwert


Forums : Rockclimbing.com : Suggestions & Feedback

 


Search for (options)

Log In:

Username:
Password: Remember me:

Go Register
Go Lost Password?



Follow us on Twiter Become a Fan on Facebook