Page 1 of 5

SPAM hit list

Posted: Mon Dec 10, 2012 4:26 pm
by reinhard
Hi folks,

Many apologies for being so out of it recently, bulletin-board-wise. As some of you know, we've got a infant at home and our older girls had to spend some time in the ER recently (everybody's doing great now).

Besides not being able to properly attend to the many great posts you all have been adding to this board, I've also been missing a lot of not so great SPAM.

Since I think I've got at least a few more weeks of major distraction to contend with, would you mind posting links to any suspected spam postings here in this discussion thread to make it easier for me to zone in on it and so other people know not to waste their time making duplicate reports? I'll post confirmation when I've zapped it.

Thanks so much for putting up with my recent lack of vigilance and hope this hit list will mitigate it a bit!

Reinhard

Posted: Thu Dec 13, 2012 11:55 am
by eschano

Posted: Wed Dec 19, 2012 5:51 pm
by reinhard
got it! Thanks.

Posted: Wed Dec 19, 2012 5:54 pm
by gratefuldeb67
will do, i have seen a few things this week...
i'm glad your daughters are ok now reinhard, and eagerly awaiting a new during pic with your little boy :)
wishing you a happy and healthy christmas with your family and all the best to you always :)
deb

Posted: Sat Dec 22, 2012 8:24 am
by Too solid flesh
pigwow on the first page of December Challenge:

http://everydaysystems.com/bb/viewtopic.php?t=9021

Thank you, Reinhard.

Season's greetings to you and your lovely family.

Posted: Sat Dec 22, 2012 7:45 pm
by gratefuldeb67
there's one in this thread rein...
profile name "sansandd"

http://everydaysystems.com/bb/viewtopic.php?t=8767

Posted: Thu Dec 27, 2012 10:48 pm
by reinhard
Got pigwow and sansandd. Thanks, Too Solid and Deb! Keep em coming. I just set it to "notify me when a reply is posted" so hopefully next time it'll take me less than a week.

Posted: Mon Dec 31, 2012 8:24 am
by ~hf

Posted: Mon Dec 31, 2012 8:26 am
by ~hf

Is it still spam if it's in the "off-topic" forum?

Posted: Sat Jan 05, 2013 11:03 pm
by Lady Crimson
Is it still spam if it's in the "off-topic" forum?

If it is, then here's another link.
http://everydaysystems.com/bb/viewtopic.php?t=9087

Posted: Mon Jan 07, 2013 3:29 pm
by reinhard
Yes! Got them. Thanks Lady Crimson and Heidi.

Posted: Tue Jan 08, 2013 5:13 am
by idontknow

Posted: Tue Jan 08, 2013 2:06 pm
by reinhard
Got 'em! Thanks, idon'tknow.

Posted: Wed Jan 09, 2013 8:27 pm
by idontknow
and another one!

http://everydaysystems.com/bb/viewtopic.php?t=9107

Pesky UK kitchens!!

Posted: Thu Jan 10, 2013 5:14 pm
by reinhard
Got it! Thanks. I actually added the term "kitchens" to my spambot registration detector but they must be adding them after registration. Might be time to shake up the logic of my simple phrase completion test since it seems like they've been defeating it with increasing frequency lately... (pity -- it worked like a charm for years).

Posted: Mon Jan 14, 2013 1:36 pm
by gratefuldeb67

Posted: Mon Jan 14, 2013 9:52 pm
by reinhard
Got him! Thanks, Deb!

Posted: Fri Feb 15, 2013 3:03 pm
by SpiritSong

Posted: Wed Feb 20, 2013 3:25 pm
by reinhard
Got pamsalters, thanks!

Posted: Wed Mar 06, 2013 5:50 pm
by Graham
http://everydaysystems.com/bb/viewtopic.php?t=9215
http://everydaysystems.com/bb/viewtopic.php?t=9111
http://everydaysystems.com/bb/viewtopic.php?t=9110

All spam. Curse this kitchen company!

I also suspect users alexjhon and marylin of being some sort of effort to promote some web-site or other. Too odd to be regular Everyday Systems folks in my opinion.

Graham

Posted: Wed Mar 06, 2013 7:33 pm
by reinhard
Thanks, Graham! Got the links... now to scratch my head about alexjhon and marylin.

Posted: Thu Mar 07, 2013 11:13 am
by Graham
http://everydaysystems.com/bb/viewtopic.php?t=8779
http://everydaysystems.com/bb/viewtopic.php?t=8670

here are a couple more I missed. I'd write to this company to complain but they'd probably start spamming me too...

Graham

Posted: Mon Mar 11, 2013 3:15 pm
by reinhard
Got em! Thanks again.

Posted: Tue Mar 12, 2013 10:03 pm
by Thalia

Posted: Wed Mar 13, 2013 2:24 pm
by reinhard
Got it! Thanks!

Looks like I'm going to have to upgrade my automated spam defenses again soon.

In the meantime I appreciate all the posts here.

Reinhard

Posted: Wed Mar 13, 2013 4:02 pm
by wosnes
Why don't you make this a sticky so it's always up top if needed?

Posted: Wed Mar 13, 2013 5:23 pm
by reinhard
Good idea. Done....

I'm going to demote a couple of the lesser viewed stickies because it's getting crowded up there.

Posted: Thu Mar 14, 2013 12:17 pm
by gratefuldeb67

Posted: Thu Mar 14, 2013 2:44 pm
by reinhard
Got em! Thanks, Deb!

Funny how "kitchens" have replaced porn in spambot-land. A positive development, I guess?

Posted: Sat Mar 16, 2013 1:14 am
by gratefuldeb67
here's another one reinhard... not sure NoS is what they need... more like NoseS... lol :)

http://everydaysystems.com/bb/viewtopic ... 770#130770

Posted: Sat Mar 16, 2013 1:17 am
by gratefuldeb67
ps... the uk kitchen guys are still at it in the off topic section...

Posted: Sat Mar 16, 2013 8:30 am
by Graham
http://everydaysystems.com/bb/viewtopic.php?t=9273
http://everydaysystems.com/bb/viewtopic.php?t=9268
http://everydaysystems.com/bb/viewtopic.php?t=9263

these are 3 "kitchen" spams from the off-topic section today. I wish I could irritate them back the way they irritate me!

Graham

Posted: Tue Mar 19, 2013 8:43 pm
by SpiritSong

Posted: Wed Mar 20, 2013 12:10 am
by oolala53
Oops. though my URL was different, I posted one to the same SPAM post on a detox diet.

Posted: Wed Mar 20, 2013 3:40 pm
by reinhard
Got em. Thanks again!

Posted: Sat Mar 23, 2013 6:12 pm
by Graham

Posted: Mon Mar 25, 2013 11:16 am
by sophiasapientia

Posted: Mon Mar 25, 2013 12:39 pm
by Graham
http://everydaysystems.com/bb/viewtopic ... 193#131193

this and another posting I couldn't figure out how to highlight on topic "vending machines" from username georgealex who describes himself as an "online service provider" - posts what look like stock paragraphs vaguely relevant to the topic, might be a program rather than a person, irritating **** whatever "he" is.

Posted: Mon Mar 25, 2013 2:29 pm
by BrightAngel
two - spammy vending machine comments
http://everydaysystems.com/bb/viewtopic ... 204#131204

Posted: Mon Mar 25, 2013 4:38 pm
by SpiritSong

Posted: Sat Mar 30, 2013 8:25 am
by Graham

Posted: Mon Apr 01, 2013 3:28 pm
by reinhard
Wow, that was quite a workout for the trigger finger.

Thanks all!

Upping priority for figuring out improved automated anti-spam mechanism...

I'd love to be able to upgrade the entire phpbb but I'm having a hard time figuring out how to tap into the new login mechanism to keep habitcal working.

Reinhard

Posted: Mon Apr 08, 2013 1:15 pm
by SpiritSong

Posted: Tue Apr 09, 2013 11:49 pm
by oolala53

Posted: Wed Apr 10, 2013 7:14 pm
by reinhard
Got em. Thanks again!

Posted: Wed Apr 10, 2013 10:12 pm
by oolala53
Wait, did you get rid of the entire thread? It was about a young woman who lost around 60 pounds and ended her BED. The spam post was just the last one...

Posted: Wed Apr 10, 2013 10:49 pm
by Graham

Posted: Wed Apr 10, 2013 11:10 pm
by reinhard
Wait, did you get rid of the entire thread? It was about a young woman who lost around 60 pounds and ended her BED. The spam post was just the last one...
Ooops. Misfire...

Time to test my backup system.

Reinhard

Posted: Wed Apr 10, 2013 11:12 pm
by reinhard
Actually, I think the thread is OK... (double checking now). The link above is a "post" link (to a deleted post) but I think the thread is still there. I'll post here when I dig up what I think it was just to make sure.

Posted: Wed Apr 10, 2013 11:23 pm
by reinhard

Posted: Wed Apr 10, 2013 11:25 pm
by reinhard
Got your two (and just your two!), Graham, thanks!

Posted: Thu Apr 11, 2013 2:46 am
by oolala53
Yes, that's the thread. I don't know why I couldn't find it this afternoon. Sorry for panicking. :oops:

Posted: Thu Apr 11, 2013 2:30 pm
by SpiritSong

Posted: Thu Apr 11, 2013 9:45 pm
by reinhard
Got it. Thanks, SpiritSong!

No worries about the panic, oolala53. Good reminder to me to be careful.

Posted: Fri Apr 19, 2013 7:03 am
by Graham

Posted: Tue Apr 23, 2013 9:15 pm
by reinhard
Got em, thanks!

Posted: Mon May 06, 2013 4:39 am
by oolala53

re the latest spam suspect

Posted: Mon May 06, 2013 12:50 pm
by Graham
Re: oolala53's spam suspect:

Spotting Spam is getting trickier, as spammers are getting trickier. I notice this "member" "Maaria" has posted 4 suspect posts, 3 with urls which are probably the point of the posts, with a bit of pseudo-content to avoid being easily caught. I note the "occupations" "Online service provider" or "Internet content provider" in the user profile are hallmarks of this new type of on-line dross producer.

How to deal with this? I note, from the members list, there are many "new members" at least one of whom is a probable spammer who hasn't posted yet (clue the web address "kitchen-display uk").

Is there some theory out there that getting your url onto a discussion group, no matter how irrelevant to the topic, is somehow going to pay off?

One thing I am sure of, this sort of fake member activity will be harder to monitor on an automated basis than older styles of spam, and i guess that's why it has been invented.

Posted: Mon May 06, 2013 12:52 pm
by Graham
http://everydaysystems.com/bb/viewtopic ... 151#133151

as I trawled the new members on the members list, I spotted this. Desperately poor product placement....

Posted: Mon May 06, 2013 1:08 pm
by Graham
http://everydaysystems.com/bb/viewtopic ... 870#129870

and is angelblue63 another one?

I identify 1. odd barely relevant text, plus 2. obvious advertising links.

Should links to our business interests be excluded from the No S site? This would be an easy way to frustrate the spammers, though it might limit legitimate members from mentioning their occupations.

Just a thought..

Posted: Tue May 07, 2013 3:19 pm
by reinhard
Thanks again, guys.

I think what I might do is have a script that runs regularly looking for suspicious content and blasting it (an anti spam bot).

The trick is how to avoid collateral damage... but it's getting to the point where draconian tactics are required.

Please do keep posting here -- it definitely helps me kinda sorta keep on top of it in the meantime.

Reinhard

Posted: Tue May 07, 2013 6:01 pm
by Graham
I noticed another whole discussion "Weight Loss with Organic Food" in the off-topic section which, in retrospect looks like it was started by a spammish psuedo-member (look at how his url relates to the topic he posted) and concluded by several others (2 "guests", presumably ex-members, disbarred? plus a contributor with a totally non-relevant url for ED treatment)

What should be the response to someone who posts once, with a vaguely relevant topic, with a url advertising a totally irrelevant service/product who never posts again? What was that? Was it spamming, was it "networking" - do we care? Want it gone? Leave it sitting there? A knotty issue. Off topic is particularly vulnerable to postings which may be pure advertising copy - or is it an acceptable use of the off-topic section? I don't like it myself, but how does one describe what is wrong with it, and devise rules to prevent it?

Graham

Posted: Thu May 09, 2013 1:00 pm
by oolala53

Posted: Thu May 09, 2013 1:28 pm
by reinhard
Got it oolala53, thanks!

Graham -- I think I'm going to err on the side of crushing this stuff. If I'm a wee bit careful, I think it's extremely unlikely that legitimate users should be affected.

My suspicion is that the pattern you describe is completely bot generated. And even if not, I have no compunctions about nuking such posts and such users. If you're a human being who fails the turing test, we don't want you here. :-)

Reinhard

Posted: Fri May 10, 2013 8:06 am
by Graham
Hi Reinhard,

fit2page Paul077 and Protheus look like the kind of spambot/ members we're talking about.

One problem is that sometimes genuine members don't report spam here but leave a "reply" to the spammer saying "spam" or "spambot" and that message remains after you've removed the offending message, keeping the topic heading alive, an irritating perpetual residue.

Wouldn't it be a good idea to remove responses to a spammer as well as the sapm if they are just there to notify you, to completely remove all trace of the bogus topic?

Graham

Posted: Fri May 10, 2013 1:12 pm
by reinhard
This is a tricker issue...

A bunch of the time I guess it would be unproblematic to delete the whole thread, but sometimes spam prompts a genuine, even thoughtful response. It takes a bit of judgement to make the call as to whether it's worth preserving. But it is a problem, you're right, to just consistently leave the "irritating residue." Not 100% sure what the best policy is, but I'll continue to agonize over it and hopefully settle on something more satisfactory.

Reinhard

Posted: Sat May 11, 2013 1:13 am
by oolala53
posted on the thread "when you fail"

lucyming
Guest





Posted: Fri May 10, 2013 12:38 am Post subject:
I just open the cabinet and cook.




__________________________________________________
Diablo 3 Gold;Aion Kinah;Diablo 3 Gold Kaufen;Guild Wars 2 Gold

Didn't know how else to alert you since it was in the middle of other authentic posts. However, doesn't look like anyone fell for it, so not an emergency.

Posted: Mon May 13, 2013 8:09 am
by Graham

Posted: Mon May 13, 2013 1:11 pm
by leafy_greens

Posted: Mon May 13, 2013 1:31 pm
by reinhard
Got em. Thanks again. I need to budget a day to upgrade the bulletin board, figure out how to pluging the login with habitcal, etc. I made a few stabs already but it's been trickier than anticipated.

Posted: Tue May 14, 2013 12:12 pm
by Graham
http://everydaysystems.com/bb/viewtopic ... ht=#133368

DavidSmith789's url is a link to a weight-loss scam. Again the almost relevant text, but not quite - spambot? I'm interested to note it was good enough to generate 2 real respondents!. Tricky stuff.

Is there a way to spot and block advertising?

PS, is there a way to highlight the message I mean, or do I just show the url for the thread and name the suspect post by member name?

Posted: Tue May 14, 2013 1:13 pm
by reinhard
Thanks, Graham.

Yes, DavidSmith789 is part of a new breed of spambots. It's very clever -- they copy bits of text that have already been posted to the target bulletin board. So in a sense, it's real, (semi-) relevant content -- just plagiarised. At a quick glance it seems to fit, but usually when you look closely you see it's slightly out of context (and has a spam link).

Reinhard

Posted: Sat May 25, 2013 4:41 pm
by oolala53

Posted: Fri May 31, 2013 2:41 pm
by reinhard
Blasted this shortly after you reported it -- sorry for the delayed acknowledgement here!

Posted: Sun Jun 09, 2013 9:34 pm
by la_loser
Spam alert-new "testamonial" . . . NOT! promising a mucus free life!

http://everydaysystems.com/bb/viewtopic ... 885#133885

Posted: Mon Jun 10, 2013 2:13 pm
by reinhard
Thanks, LA_Loser! (and welcome back!)

Posted: Sun Jun 16, 2013 2:26 pm
by Graham

Posted: Mon Jun 17, 2013 2:26 pm
by reinhard
Got it! Thanks. No, they'll never stop... though they do seem to have slowed down a bit. Probably just a lull before another major offensive. :-)

Alert...

Posted: Mon Jun 24, 2013 7:55 am
by la_loser
Alert... "What to do this long weekend"
http://everydaysystems.com/bb/viewtopic ... 555#134240

Posted: Mon Jun 24, 2013 8:52 am
by Graham
http://everydaysystems.com/bb/viewtopic.php?t=9445

this too by the same person.

A question: if the spammer has already been outed, is there any need for me/anyone to identify other postings by that person or would you, Reinhard, do that as a matter of course?

Best wishes,

Graham

Posted: Mon Jun 24, 2013 3:39 pm
by reinhard
Got em. Thanks!

Posted: Mon Jun 24, 2013 5:02 pm
by oolala53

Posted: Tue Jun 25, 2013 6:54 pm
by reinhard
ex toothpaste hawker. (thanks!)

Posted: Thu Jul 04, 2013 3:29 pm
by oolala53

Posted: Sat Jul 06, 2013 10:55 pm
by reinhard
Got it! Thanks.

Posted: Tue Jul 09, 2013 4:35 pm
by Giada
Grrrrrr....


http://www.everydaysystems.com/bb/viewt ... c9e#134730

The good news about this is that you have a Norwegian following, Reinhard

Posted: Mon Jul 15, 2013 12:00 am
by reinhard
Got it! And yes, I guess that is good news in a way! When the Norwegians start spamming you, you know you've made it. :-)

(Sorry for the delayed response -- was on vacation with very poor connectivity)

Spammish storyteller

Posted: Wed Jul 24, 2013 10:59 am
by la_loser
Three irrelevant posts by new user casmillehouse. . . Hawking coins I guess.
http://everydaysystems.com/bb/search.ph ... millehouse

Posted: Wed Jul 24, 2013 12:39 pm
by reinhard
I like it that the spambots are telling jokes now! Guess they still have to learn the different between "funny once" and "funny always," though. :-)

Posted: Tue Jul 30, 2013 9:13 am
by Graham
OK, this one is a definite: http://everydaysystems.com/bb/viewtopic.php?t=9510 oh and this too since the 22nd! http://everydaysystems.com/bb/viewtopic ... ht=#135225 how did that slip under the radar?

But what about this one? http://everydaysystems.com/bb/viewtopic.php?t=9500

"The price of freedom is eternal vigilance" (dammit!)

Posted: Tue Jul 30, 2013 12:31 pm
by reinhard
Thanks, Graham. Got em.
But what about this one?
No mercy for the spambots. When in doubt, vaporize. There are two requirements for participating in this forum: be civil, and pass the turing test.

Reinhard

Posted: Fri Aug 02, 2013 11:38 am
by Graham
http://everydaysystems.com/bb/viewtopic.php?t=2658

posting by licdfjk "Guest" seems to be spam but how does a guest get to post to a topic?

OK, I'm guessing, did this person post while they were a member, then they posted a spam and their membership got removed, but this post wasn't spotted?

http://everydaysystems.com/bb/viewtopic ... 694#125694 - is this post by macmilon555 another example?

Posted: Tue Aug 06, 2013 10:59 am
by Graham
Puzzled by the non No S relevance of all 5 posts by GGIPunjab - is "he" a spambot of some sort? this posting is the oddest example: http://everydaysystems.com/bb/viewtopic ... ht=#135412

Posted: Tue Aug 06, 2013 3:37 pm
by reinhard
Yes, the guest posts are orphan posts whose spambot authors have been vaporized. Would be nice if phpbb got rid of the posts automatically, but it doesn't. Gone now!

GGIPunjab looks spambotty enough to be vaporized. He also makes contradictory claims in a post (says he's a student) and his sig (says he's an executive director). In any case, gone now.

[ blowing smoke off his death ray ]

Reinhard

Posted: Tue Aug 20, 2013 8:25 am
by Graham

Posted: Tue Aug 20, 2013 10:38 am
by Graham
lorretahenry posting : http://everydaysystems.com/bb/viewtopic.php?t=8975
looks like a bogus question to get a spammer's "answer"
frickle_4 looks dodgy too: http://everydaysystems.com/bb/viewtopic ... 918#134918

woof!

Posted: Tue Aug 20, 2013 1:29 pm
by reinhard
Thanks again, Graham!

Got em all (except bigshoe, who is actually legit).

I really appreciate your continued vigilance!

Reinhard

Posted: Tue Aug 20, 2013 2:09 pm
by Graham
reinhard wrote: Got em all (except bigshoe, who is actually legit).

Reinhard
You can see how I made that mistake, but it's probably a good thing I'm not armed...

Posted: Wed Aug 21, 2013 11:42 am
by earl7z

Posted: Thu Aug 22, 2013 12:48 pm
by reinhard
Got him. Thanks!