Posted by MeInc on December 23, 2011 at 1:53pm
22 followers
Jump to:
| Project: | Drupal.org webmasters |
| Component: | Spam |
| Category: | task |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | active |
Issue Summary
This issue is here as a place to report the ongoing Vietnamese spam attacks in the forum rather than having many separate issues filed. Most of the issue consists of reports, though there is also some conversation mixed in about solving the problem before that branched off into other issues. To keep this issue from hitting the dreaded 300 comment mark, earlier spam reports and fix notices are occasionally deleted so there will be odd gaps if you are trying to read the issue all the way through.
Comments
#1
Ugh.
#2
Their back at it
user: http://drupal.org/user/1740890
Posted around 20 in the community spotlight forum
#3
User was blocked, spam deleted. I noted the IP address.
Thanks for the report!
#7
They're back at work.....
user: http://drupal.org/user/1759806
spam: Lots in the Community Spotlight Forum
thanks
#9
When will they stop?
Please clean up user: (hung19889) http://drupal.org/user/1761682 spam.
thanks
#10
cleaned up.
Maybe we should just call their phoe and tell them to stop? :p
Preferably when it's night over there...
#12
Could we just block users from Vietnam or any posts in Vietnamese? This is ridiculous!!!
User: http://drupal.org/user/1767140
filling up the hosting support forum.
thanks
#13
Drupal has an international community. Cutting off an entire country is not possible.
Michelle
#14
And a thriving community of spammers. :)
User: http://drupal.org/user/1768074
spam: hosting support forum
thanks
#15
Well, that may be but there are Drupal users there and we can't exclude them because they have spammers in their country.
Michelle
#16
Blocking entire countries is never going to happen.
If I blocked one of these spammers, I have looking up their IPs and blocking specific ones (though, obviously, to no possitive effect.) Here are the IPs I've blocked:
blocked 113.190.157.98 Viet Nam
blocked 113.22.20.121 Viet Nam
blocked 113.190.137.133 Viet Nam
blocked 222.254.17.217 Viet Nam
blocked 113.22.7.75 Viet Nam
blocked 42.113.145.78 Viet Nam
blocked 58.187.53.1 Viet Nam
blocked 183.81.75.5 Viet Nam
blocked 118.71.147.47 Viet Nam
blocked 113.190.143.1 Viet nam
blocked 113.22.107.226 Viet Nam
blocked 1.55.170.127 Viet Nam
So even blocking ranges isn't going to work. And IP blocking isn't as effective as it once was. What we need are better tools (or someone to manage spam.module for D7.)
#17
The most effective method I've found is a question that requires a human to answer. That may be harder here because, on my site, which is local-based, I have no issues excluding people who may find reading the English question impossible. Here, we have to take care to not exclude people who don't read English well and also be accessible to those with disabilities.
Another method I've heard works well is having hidden fields that only bots will fill in. I've never tried that, though.
Whatever method we use, please make it something that will go away once you are established as not being a spammer. I don't want to have to prove myself every time I post.
Having written all that, I just realized it's completely off topic. Sigh. Is there a better issue to discuss this or could we change the title/status here?
Michelle
Edit: Nevermind... Just saw #1293186: Spam - meta: better spam-combating suggestions and realized that I already said this there. LOL!
#18
I agree, blocking all users from a country is not a good idea. But, something should be done to decrease the amount of spam in the forums.
#19
They're back!
http://drupal.org/user/1788788
Got it in the first minute - so only three posts I had to hit, but Gah...
#20
Please don't block all IP from VN :(
#21
They're busy in the Deprecated - Drupal.org infrastructure forum
- washing machine sales must be slow in Vietnam :)
user: http://drupal.org/user/1790306
#22
@thehong: would you mind calling them and explaining to them that d.o is not a place to advertise washing machines?
Apparently the posts already got deleted.
#26
Another 40 posts. I've taken care of it from http://drupal.org/user/1800742
@thehong, I want you to hunt them down and hurt them.
#27
user: http://drupal.org/user/1806642 thinks users in the Deprecated - Drupal Core forum might be interested in Vietnamese washing machines. Please inform him otherwise :)
thanks
#29
Another few dozen just now. Another few dozen 2 days ago. And again several times in the last week. I've lost a stupid amount of time on this bugger.
Still waiting for #1383816: Add "Administer Nodes" VBO to user profiles to land so I don't have to snipe each post individually :-/
#30
Back at it
user: http://drupal.org/user/1825370
post installation forum
#32
another 120 just now http://drupal.org/user/1825982
Searching for the phone number : 0936110049 : Shows up another 50 http://drupal.org/user/1825972 that got through earlier
Searching for another keyword " SỬA BÌNH NÓNG LẠNH TẠI " finds another pile from http://drupal.org/user/1787430
I've killed and swept up after those guys. love the new "Administer nodes" tool
#34
"no activity" my shiny metal ass.
I've got him again a few times this month, and I'm sure others have too.
Most recently http://drupal.org/user/1854632 with 65 more new posts (blocked and deleted)
#35
+246 more http://drupal.org/user/1854674 blocked & deleted
#36
I think i found new Vietnamese spammer. His profile is: http://drupal.org/user/1854734/
Please review his posts and if he is spammer, block him.
#37
Yes. *sigh*
blocked and deleted.
#38
Another Vietnamese spammer found. His profile is: http://drupal.org/user/1854902
#39
It seems that another moderator blocked the last spammer. So more action is not required for blocking him. Thanks a lot.
#40
Oh, yeah, I delete this crap on a regular basis. I don't bother filing issues when I block obvious spammers but put me down for deleting tons of it.
#41
I know it becomes a boring job when the number of spammers increases :).
I have found another spammer too and posted in this node. Please see and block him: http://drupal.org/node/1476836
#42
This user is another Vietnamese spammer. Please block him. http://drupal.org/user/1857078
#45
Thanks a lot. I reported several spammers that seems are not from Vietnam in this node too. Please block them too. http://drupal.org/node/1476836
#48
again with 120 posts http://drupal.org/user/1859080 (blocked and deleted)
Y'know, it seems like it's the same time every night.
approx 7:45AM GMT
- Because I usually get him in the half hour after that (9 PM NZ time, which is GMT+13 right now)
He's not giving up ... :-(
#51
Got it. Thanks.Looks like this account was created at the same time they were spamming with another account. Are they also making an account for the next day when doing the bombing run?
If so, that may be a target for IP-detection.
#52
I think they have some accounts or make accounts after blocking one account. I think the a way is analyzing real users from Vietnam in these hours (about 2- 3 hours) and if they are a few, as we get a lot of spams from this country in these hours, we can prevent them from accessing and then enabling Vietnam IPs after 2-3 hours. We get spammers every day in these hours from Vietnam.
#57
I don't think we should mark this as fixed-- this is a very specific spam attack and we should try and figure out a way, something like dman mentioned above, to automate handling it somehow.
#58
I think its a good way to prevent their IPs in some hours that spammers are working. Or another way is preventing writing Vietnamese language in main forums but its difficult and needs heavy programming.
#59
Although what we are *seeing* is this one bastard, a real solution would need to be a more generic tool for flood prevention.
Tempting as it is, it's not a correct move to hit a single language or even IP block.
No more action seems to be happening right now in #1293186: Spam - meta: better spam-combating suggestions - though I'm REALLY grateful for our recent #1383816: Add "Administer Nodes" VBO to user profiles addition. This Vietnamese rash prompted that happening at least.
Even 'flag abuse' would not stop these attacks :-(
It's a flood-gate that is needed here - more than X posts in X minutes (perhaps modified by UserID seniority) to trigger an IP blacklist - I reckon.
OTOH, I'd like to raise a cash bounty of the old-fashioned kind among our honest Vietnamese community to deal some personal harm to this particular miscreant ...
#60
I guess there is another way too but it effects all website. We can have a captcha or mollom image verification for creating nodes. It means every one wants to post a topic on forums, should pass this image verification. However i myself don't like this at all but i think it helps a lot to reduce spam posts. Whats your idea about it?
#61
Yep, i agree that seems the best way forward (including excluding roles above 'authenticated user'). My only concern would be for the performance implications.
#62
Its a good way but some spammers don't post a lot of posts quickly. For example they post 3 post daily and this way can not block them IMO. However most of them post quickly. Also it can prevent other real members from posting their issues too. For example i myself reported several spams today. Maybe i had more than 5 posts in last 30 minutes to reply this topic or report some others spams in other topics and it makes problem for real members too. Or when a member posts a problem in forums and want to reply to suggestions or answers , if he exceeds this X number of posts is X minutes, he can't do that.
#63
@shamio See discussion on CAPTCHA at #1293186: Spam - meta: better spam-combating suggestions
#64
Yes, i read it yet and i know about CAPTCHA problems and as i said most users don't like it and also there are many CAPTCHA bypass tools or websites. We should find an excellent way to prevent spammers without facing problem for other members.
#65
I know a general approach is wanted but, for this specific spammer, would it be possible to identify the posts by a word or phrase? The forums here are English and, while we don't want to ban someone just for not using English, the fact is that legitimate non-English posts are going to be rare and that could be useful in determining if it's the Vietnamese spammer.
Michelle
#66
Yes, i said it above that if we can have a system to prevent posting in non English languages in main forums, we can block a lot of spammers however we have some English spammers too. But i think its a good way now.
#67
I don't know that we want to automate preventing non-English unless we're very, very careful to do it nicely. There are non-English posts that aren't spam, just people who don't realize we use English in the forum. Drupal is an international project so we need to be careful. My thought was that we could key on specific words in the spam that is currently plaguing us as sort of a band-aid solution as the likelihood of a legitimate Vietnamese post is already slim and the likelihood of one with that particular word-set even slimmer.
#68
Yes, i got your meaning. But we should be sure that what keyword(s) are using in all spam posts and it can be changed i think. But i have a complementary idea for this project. When a user posts a content that includes one or more of those defined keywords, it can be queued for approval. Then admins firstly review them and then approve them if they are not spam. Whats your idea about it?
#69
I seem to recall a lot of them talk about refrigerators and air conditioning, according to Google Translate.
Of course there's no guarantee that would continue,
#70
Yes it seems that they are advertising a product and a website. It needs an intelligent system or we should block them manually always :(
#71
If you are looking for a keyword - their telephone number is consistent. I noted it in #32 above "0936110049"
There are a couple of different numbers, but they are probably the best target.
#72
Its a great idea dman. Its the best way for preventing that user.
#73
Please block him : http://drupal.org/user/1862598
He has 0936110049 in both title and body of his spam again.
#74
It seems that another moderator blocked him now. So no more action is required.
#75
In this very specific case, I suggest we add a post threshold mechanism. E.g. if a user has a total of less than 100 posts, he can only submit less than 5 posts per hour and 10 posts per day (which comes first). If he has more than 100 posts, there is no limit at all.
Also, it a user reaches his threshold, he is automatically flagged to be examined manually by moderators.
#76
Its a good idea too but limiting users should be done carefully. Its possible that a new member faces different problems in first days of working with Drupal and don't find his problems on forums and also not familiar with irc chat and wants to post new topics and answers them and he reaches this daily 10 limits in 24 hours and it makes problems for them. Having such option is a good choice for the community but it should be modified to don't make problems for users. I mean we should do it somehow that members don't think this community has many limitations for them and attacks them to other platforms and communities which are our competitors!!
#77
@shamio - the behavior you describe (10 posts from a newbie) may not be intentionally malicious but it would certainly trigger a very strong warning from any moderator who saw it. That hardly ever happens like that, and when it does it's always cross-posts of bad questions in multiple incorrect places. Which would easily merit an automated cool-down period if such a facility existed.
The limits suggested by jcisio are - to my mind - pretty liberal for sensible humans who have read the forum guidelines and tried a search first.
#78
@dman - Yes, of course you are right. Its very rare as i said too. Ii just wanted to determine very new users that didn't read guidelines and other documentations and want to solve their problems fast. I wanted to think about a modified way that doesn't limit users because usually users don't like to be limited by admins of a website.
#79
@shamio
I honestly don't care if help vampires get their feelings hurt, when by their behavior they are measurably annoying and inconveniencing a much greater number of people who did make an effort to follow the rules. This is not a special-ed kindergarten.
But this is getting off-topic. Actual spam-fighting suggestions, or the policy around it - or even more importantly working code that will do what you propose (!!!) should go over in the meta-issue discussion.
#82
http://drupal.org/user/1861440
http://drupal.org/user/1861432
Now the bastard is racing me in real-time.
f**k this. seriously.
#90
http://drupal.org/user/1870044 blocked and deleted
#91
Please block this spammer: http://drupal.org/user/1871392
#92
VBO is churning thru them now...
#93
Another spammer is here: http://drupal.org/user/1872474
#94
It seems that this user is blocked. So no more action is required.
#95
Another spammer is here: http://drupal.org/user/1873362
#96
It seems that this user is blocked and no more action about him is needed.
#97
They've been on Each Time I came back to d.o today.
4 Different accounts, HUNDREDS of flooded posts, pitching phone numbers 39927495 - 0912584367 usually.
Feels like it's taking several hours a week out of my time, and certainly is making me not want to hang out on d.o like I usually do, it just makes me grumpy.
Would getting a real flood-blocker installed it get more attention if we went back to reporting each individual daily attack as separate issues? 3-5 new issues every day just because of this one user?
#98
@dman: Keep in mind that the number of people who have access to install things on d.o is pretty small and likely most of them have been at Drupalcon all week. Give people a few days to recoup and then let's start making some noise on it. :)
#99
I don't have any code, and I've not analyzed the posts at this point to know whether or not this idea is even feasbile but a question I have is how many seconds pass between posts? And can a threshold be set in that way?
The assumption with this idea is that bots post faster than humans can type.
#100
Please block him too: http://drupal.org/user/1874580
#101
If you want to report spam posts, please do so in a new issue. Also, because of the volume, they are easily caught and don't really need reporting.
#102
OK, thanks. I reported it here because this issue relates to Vietnam spammers and all spammers from Vietnam are reporting here.
#103
@Heine: Your second sentence contradicts your first sentence. :) Because they get caught so easily, it's silly to have issue after issue filed. A quick comment here is a failsafe in case one slips thru the cracks. Since I and other maintainers are following it, we can do a quick check. If a new issue is filed, I won't see it in any sort of timely manner. So I'd much prefer to have them here. I'd prefer to have all spam reports on one issue, actually, but I know I'm a minority so won't push that one.
#104
Then we should probably move the spam limit discussion elsewhere.
#105
Considering this issue started as a spam report and mostly is a series of spam reports aside from some posts in the middle saying we should automate this and also the fact that we already have multiple issues about better spam tools on d.o, I'd be fine with turning this into a spam report issue and having the other discussion in those other issues.
#106
Please block him too: http://drupal.org/user/1875044
#107
It seems that its blocked, so no more action is required.
#108
This user should be blocked :http://drupal.org/user/1875414
I am sure he uses automated tools to spam because he has more than 300 posts in less than one hour. We should think about preventing automated spammers.
#109
Integration of captcha e.g. mollom ? may help in preventing spam a lot but, yeah, it could be bit irritating, when everytime one has to enter some random chars to make a small post even.
#110
Yes. I suggested it above too. But it seems that many users don't like it. But we can have it for new users for example with less than 50 posts or something like it.
#111
Ahh missed that point.
But what if a user starts making spam after 50 posts? Better solution could be limiting number of posts in a day. We can't revoke access & ask users to wait till their posts get approved moderation etc or even marking their posts unpublished if there is more than 'x' number of posts in a day, as that's not how community should run.
We can always engage our resources, time, efforts in blocking those users & their spams, but that would be waste imho.
So only option left is captcha integration.
Though #1293186-76: Spam - meta: better spam-combating suggestions explains another method, to tackle with this issue. I think there is already a discussion going on around "abuse flag integration on d.o", can't recall the node-id.
#112
Killed and blocked 674 spams from http://drupal.org/user/1875414 just now.
#113
And a hundred from http://drupal.org/user/1875480
#114
Its another spammer: http://drupal.org/user/1875450
#115
Another 200+ spams bite the dust.
I know shamio is a *ridiculously* new user to be suggesting this for ... but given the hundred spams that he(?)s reported excellently so far already .. how silly is it to suggest a rapid promotion to moderator role? With some guidance?
Because keeping on top of these things is sucking the life out of me. Much better to tag-team it than pass the bucket all the time.
#116
sorry, but given the history in #1467726: I'm spotting a number of almost-human almost-spam floods. I'm a bit cautious about granting moderator rights at the moment.
#117
true. Was just a tired thought.
#118
For what it's worth, I had the same thought but hadn't looked into the user's history and so didn't suggest it.
#119
This is really annoying... How about writing a quick input filter that don't create links before a user has not posted 50 comments and is a member for 1-3 months or longer and/or add nofollow to all their links within this time. This may stop the backlink spammers... Additionally, add human questions in the first 1-3 month of membership. I guess it would help a lot... Will not stop all, but maybe 98%.
Also add a small button to make quick notifications and unpublishing possible... Creating a case for every spammer is really stressful.
#120
@hass We do not use always filter for links (e.g. link to free tag terms). Also, filter depends actually only on (format, text), not on user. We have a few suggestion on #1293186: Spam - meta: better spam-combating suggestions but the related person have not replied yet (not a priority? busy? waiting for a patch?)
#121
It's not difficult to make a user check on input filters; if the node/comment is from unreliable users.
#122
Please block this spammer: http://drupal.org/user/1876892
#123
Another spammer found here: http://drupal.org/user/1876936
#124
The last two reported spammers are blocked, so no more action about them is required.
#125
@hass hook_filter (D6, which d.o runs) or hook_filter_FILTER_process (D7) takes (text, format) as arguments. I don't know how to "easily" get uid in those functions.
#126
Most links on d.o are already nofollow'd. Spammers don't bother to check that first. The problem isn't giving link juice out but rather that mass spam makes the site look crappy so just adding a nofollow wouldn't have helped that even if it wasn't already there.
#127
Please block this spammer: http://drupal.org/user/1877380
#128
Above user is blocked and more action is not required.
#129
Another spammer. Please block him: http://drupal.org/user/1877588
#130
#131
User is blocked by a moderator.
#132
@jcisio: I thought more about a custom filter that is the default filter for these users. So we don't grant them permission to use the standard filter before they hit the limits... May be very complex to change later as it's permissions stuff. This was just brainstorming... I personally also don't like to enter everytime some digits, just to post my comments/issues... but I'm far above the a 1000 comments limit... so real users that are not spammers should not affected/get hurt by antispam tools :-).
#133
@Michelle: For a year or so I wish there would be a "spam" link next to edit/reply in all comments that I could simply click (like decline in l10n server). If more than 2-3 people hit this, a comment get's auto-unpublished... or a comment goes automatically into a moderation queue or at least the webmasters get a list they can scroll down in a minute and mass unpublish all daily warnings... just thinking how to optimize the review process... it opens a door for abuse if auto-unpublishing is used, but we may be able to limit this to trustworthy users or members for a year or longer. Nevertheless every automated antispam module will be much more efficient to get the first 90% away and the buttons may exists for the rest...
#134
Its another spammer: http://drupal.org/user/1878858
He posted more than 70 spams in less than 23 min after registration. I think these spammers use an automated tool.
#135
Its another spammer: http://drupal.org/user/1878896
#136
Both above users are blocked and no more action is required.
#137
Its another spammer: http://drupal.org/user/1879840
#138
Above user is blocked by a moderator.
#139
Its another spammer: suadieuhoas
#140
Above user is blocked and more action is not required.
#141
One more spammer: http://drupal.org/node/1452916
#142
Yeah - different spammer, but this one has been warned before. blocked and deleting now
#143
This issue seems to be about swatting spammers, but is there an actual plan for what the issue title indicates: automated measures against forum spam?
I am dying inside at all of the collective brainpower/energy of the number of awesome and dedicated peopel in this issue. :( How can we make it so you can go back to making Drupal awesome?
#144
Its another spammer: http://drupal.org/user/1884936
#145
The latest reported user is blocked.
#146
@webchick, this issue is just to capture the repeat visits by one bot.
Actual progress is being made (or mired in discussion, I can't tell any more) over at #1293186: Spam - meta: better spam-combating suggestions
So far we have -
got an "administer nodes" tab on user profiles - and that's been a big help
and someone's recently added one-click unpublish to comments and nodes (not sure where the issue for that was, but it must be inspired by current issues)
and ... talk is ongoing about 'flag' I think.
We still need a flood-prevention thing also. Anyway, real talk is over there.
This thread is just a response to one daily attacker (instead of having a hundred separate responses to him :-/ )
#147
Ok, re-titling then so I quit getting my hopes up. :)
#148
@webchick: Yeah, this thread has wandered a bit from spam report to wtf do we do about this spam back to spam report. :) The other issue is more actionable stuff.
I changed the title a bit because it's not simply a log but a series of reports to make sure none of them slip thru the cracks. Most of the time their spam is a big flood and someone catches it right away but having the report here means we can double check and make sure the user was blocked.
I also changed the priority not because spam deletion isn't critical but because this is ongoing and we take care of it quickly and I don't think it really needs to be jumping out in the webmaster's queue as a critical thing. If others disagree, I won't object to changing it back.
#149
Its another spammer: http://drupal.org/user/1887218
#150
#151
Fixed?
Yeah right. It's fixed when it stops.
http://drupal.org/user/1887234
another hundred posts deleted here.
#152
Another spammers found here: http://drupal.org/user/1893308
#153
And its another spammer: http://drupal.org/user/1893314
#154
Someone got 'em
#155
#156
Another spammer is here: http://drupal.org/user/1893394
#157
Its another one: http://drupal.org/user/1893418
#158
Both above users are blocked now and more action is not needed.
#159
Another spammer: http://drupal.org/user/1893498
#160
Its another spammer: http://drupal.org/user/1893476
#161
Both above users are blocked.
#162
Another spammer is here: http://drupal.org/user/1893494
#163
Its another one: http://drupal.org/user/1893686
#164
Unsubscribe.
#165
@hass: Posting "unsubscribe" isn't going to do anything. Just click the "unfollow" button at the top if you aren't interested in helping with this spam problem.
#166
#167
And another one: http://drupal.org/user/1893514
#168
It seems a moderator blocked this user.
#169
Another spammer: http://drupal.org/user/1894582
#170
Its another spammer: http://drupal.org/user/1893500
#171
Got http://drupal.org/user/1894582 (200 posts)
Got http://drupal.org/user/1893500 (460 posts)
Thanks.
#172
Followed immediately by http://drupal.org/user/1893500 as soon as I blocked the latest active account :-(
Another few hundred successful attacks on d.o. - now being repaired slowly.
#173
#174
Another one, http://drupal.org/user/1896710.
Not the first one I have cleaned up, but I only saw this thread today
#175
user http://drupal.org/user/1896954 is filling up the post installation forum
#176
http://drupal.org/user/1896954 has been got
Hm, English is odd. "has been got" :-/
#177
Its another spammer should be blocked: http://drupal.org/user/1899568
#178
http://drupal.org/user/1899568 blocked and deleted.
Coming in at a different time of day this time...
#179
Latest reported spammer is blocked now.
@dman, I wanted to report that this user is blocked,but your action was faster is blocking user and reporting it here :)
#180
Another spammer is here: http://drupal.org/user/1902524
#181
A slightly different flavour of Vietnamese crap this time.
No phone number, but a link.Probably not the same freak.
Blocked and deleted.
#182
Another spammer found: http://drupal.org/user/1893508
I am sure this spammer uses automated tool because he posted more than 200 spams in less than 40 minutes!!!
#183
Another spammer is here: http://drupal.org/user/1902638
#184
:-(
The system is slowy deleting them now.
Blocked http://drupal.org/user/1893508 and http://drupal.org/user/1902638
#185
#186
http://drupal.org/user/1906962
#187
Someone got that one.
#188
Another spammer found here: http://drupal.org/user/1896982
#189
Got 'im.
#190
These are two other spammers:
http://drupal.org/user/1921000
http://drupal.org/user/1900614
#191
Some one got the last two.
#192
Another spammer: http://drupal.org/user/1923238
#193
Above user is blocked and no more action is required.
#194
Another spammer: http://drupal.org/user/1925352
#195
Above spammer is blocked and its snother spammer:http://drupal.org/user/1925466
#196
Got 'im. Thanks.
#197
Another spammer: http://drupal.org/user/1926778
#198
User blocked , spam removed.
#199
Another spammer: http://drupal.org/user/1927094
#200
Latest reported user is blocked and no more action is required.
#201
Another spammer: http://drupal.org/user/1929010
#202
Screw this guy, honestly.
nguyenhoangyen blocked. (plus two others I hit in the meantime today)
What's the going rate for a kneecapping in Vietnam this month?
#203
we also now seem to be under siege from bangladesh by streaming sports spammers :-(
does this garbage really make anyone money?
#204
Another spammer: http://drupal.org/user/1931438
#205
Another spammer: http://drupal.org/user/1931400
#206
Those two blocked and deleted. Several hundred posts
#207
Spotted this one flooding the forums as I watched ... they'd got to about 40 by the time I blocked and purged.
suatulanh1990 / http://drupal.org/user/1933128
#208
Another spammer: http://drupal.org/user/1934874
#209
Someone got them
#210
Another spammer is here: http://drupal.org/user/1939182
#211
User block, content termoved
#212
Very active new spammer: dfsfsd
We clearly need a module that prevents making more than 40 posts in 6 minutes. :-/
#213
Okay... that one's been blocked. I think they got up to more than 60 posts... in a 15 minute span (or so)... Yikes!
#214
Gaaah! They are back with a new account: JHJHJ
#215
Another spammer: http://drupal.org/user/1940656
#216
Blocked and content currently deleting.
#217
Yet another one, http://drupal.org/user/1940920, this time 252 posts in 36 minutes. I blocked and am cleaning up the content. It would be nice if we could throttle how fast people can make content
#218
And another http://drupal.org/user/1940896, someone else blocked, content removed (they seem to come in waves)
#219
yep... and now we're being attacked by sports streaming spam from bangladesh
#220
Another user, http://drupal.org/user/1941648 :S
#221
Someone blocked last reported spammer.
#222
Another bits the dust: http://drupal.org/user/1941720
#223
And another: http://drupal.org/user/1932234
#224
Another spammer: http://drupal.org/user/1946718
#225
Above user is blocked and no more action is required.
#227
Another spammer: http://drupal.org/user/1952850
#228
I've still been finding and hitting one or two of these daily (x 50 posts each time) (not just those we log here) ... very boring.
I can't imagine why this bugger keeps coming back. But it sucks. horrible times.
.
#230
uyenthang: http://drupal.org/user/1953570 — spamming it up in the forums.
hienanhhn: http://drupal.org/user/1953768 — another one
#231
Oh... and I don't think it ever makes sense to mark this topic as "fixed"... at least while this still happens. It means that those "following" the topic come here only to see a meaningless status change (then hours later there is a new spammer to report here). So keep it "active" or "needs work", please, until we have a working solution in place the prevents this spam.
#232
there has to be a better way than keeping one issue open ad infinitum-- once this issue reaches 300 comments it will be a royal pain to use.
#234
All the more reason not to create open > fixed comments. We DON'T need them! Until this is REALLY fixed, we should, imho, just keep it "open" and only add comments which include a new spammer to report.
We can permanently close this thread and open a new one if the issue is not resolved when we hit 300 posts, but there is no need to change the status of this task every time we add/block a user, imho. It's never "fixed" (until we get a better spam-blocking system for this issue) and always at least "needs work".
But really, we need a way to allow any reasonably trusted member to report any new member as a spammer and have them automatically blocked by this action… or something like that. It shouldn't be so much work or fall to people who need special permissions. It should be like maintaining the documentation, etc: anyone can help (but we should ensure the user is not a just-created account or one with no prior activity).
#235
@Heine: Please don't do that. It just adds to the comment count for no reason.
@WorldFallz: I was hoping we'd have a better way before 300 but it's not looking likely as I've seen no movement on those issues lately. :( When we hit 300, let's open a new one.
@all: If you don't like this issue, don't follow it. Until we have decent spam control measures, this issue is useful as there have been several times that the spammer hasn't been gotten before I saw it here and I went and cleaned up. I check my tracker frequently and shamio finds a lot of spam and having this issue prevents him(?) from having to open up have a billion spam reports.
#236
Ugh... I missed the status and I can't change without adding a comment. :(
#237
I went back and deleted a bunch of the earlier reports as well as a bunch of pure status changes. I'm hoping that this will paginate based on existing comments, not comment numbers, and so will give us some breathing room before 300.
#238
Another spammer: http://drupal.org/user/1953914
#239
#240
Latest reported user is blocked and no more action is required.
#241
@LoMo, I've marked the issue fixed whenever a spammer reported here was blocked by me. I don't get why you get upset that I've added these comments.
Issue #1293186: Spam - meta: better spam-combating suggestions deals with the anti-spam suggestions.
#242
@Heine: Because we are using and re-using this issue so it isn't "fixed" until we get alternate spam fighting methods.
There really isn't any need to change the status at all, actually. If you block the latest spammer or confirm it's blocked, just leave a comment. This issue is always active because the spammers sure are. :(
#243
@Heine... We all just don't need a notification every time someone just changes a status here and we don't need to rush to 300 if we can help it, so I think it makes most sense to edit the comment and indicate "fixed" without actually changing the status or adding a new comment/post each time a spammer is blocked. Anyway, I didn't realize you'd blocked a spammer — I appreciate what you are doing and understand your approach now. I just saw you'd changed the status to "fixed", which I think for a thread like this should only be done if a way is found to prevent the spam flow.
And yeah... I guess I did know that there was a related general discussion thread about how to handle spam. We should at least have some kind of system to prevent a new account from making dozens of posts in minutes -- hell, new users should maybe be limited to 3 new topics per day until they have proven they are actually here for Drupal. Or... Ideas, ideas... ;-)
#244
For this particular issue it's probably best to start with extreme limits (say, 40 posts in 6 minutes) and work down ...
Thinking about it, it shouldn't be too hard to code a module that picks up if a user has exceeded a posting threshold and blocks/unpublishes the user/content (respectively) ... maybe even create a post or send an email to notify webmasters...?
EDIT: Never mind, having checked #1293186: Spam - meta: better spam-combating suggestions they've already discussed flood control modules and I don't think any of the quick hack jobs I had in mind would cut it.
#245
In no particular order:
* I was going to close this thread and start a new one before we got to 300 anyways!
* I've added
<del>to a couple comments to indicate it's been done. Saves a comment.* Spam control in Drupal sucks. For D7 it's all about Mollom. Sheesh.
* It's probably better to report the spammers that only leave 4-5 comments. The ones that leave 70+ are easy to see. The stealthy ones aren't.
* I want flag.module for general use. Just sayin'.
#246
They start spamming groups:
- http://groups.drupal.org/node/231623
- http://groups.drupal.org/node/231618
- http://groups.drupal.org/node/231613
- http://groups.drupal.org/node/231608
#247
Blocked http://drupal.org/user/1962002 - http://groups.drupal.org/user/1789448
and deleted 4 nodes on groups
(plus another ~700 this week)
*sigh*
4 posts wouldn't trip any threshold we are hoping for.
definately need a string-based blacklist for whatever it is they are pushing.
#248
same(?) user http://groups.drupal.org/user/1789258 wifiprovn http://drupal.org/user/1961866 blocked
With another 4 posts in groups.
Spamming phone numbers like "0976334045"
and
https://sites.google.com/site/bophatwifi
https://sites.google.com/site/giabophatwifi
https://sites.google.com/site/caidatmangwifi
https://sites.google.com/site/lapdatmangwifi
Probably more if we could monitor keywords or something
#249
also http://drupal.org/user/1962200 anhbuihn
pushing "0974.003.616" x 11
blocked & deleted.
#250
Now Bolivia too, and they start hijacking legitimate posts. User hzc001 http://drupal.org/user/1962360/track
#251
The keywords are "Ha Noi", "Hà Nội", "sua chua", "lap dat".
#252
Another spammer: http://drupal.org/user/1967032
#253
User blocked, spam deleted
#254
Another spammer who posts so fast :) http://drupal.org/user/1967042
#255
Some one got them
#256
Since the first two are alternate (local) spellings for the city more typically written (in English) as "Hanoi", I wouldn't suggest blocking any post that mentions the city, assuming we start identifying "keywords" since I can imagine legitimate posts might well mention Hanoi and write it as "Ha Noi", etc.
#257
Are you able to suggest better string-based keywords if we were to enable blacklisting.
With a few thousand spams per week coming in with this unique identifier, and a theoretical (?) coming in that match this pattern but are not spam, what would be a more accurate suggestion?
I (personally) could live with a 1% false-positive hit-rate if it means 99% accuracy.
But if there is an alternative string to refine it, please post it here and we may be able to use that as a better suggestion.
I'm unable to parse those posts to figure out what is common grammar and what is a spammy pattern.
#258
another one with lots of posts today ongoing
http://drupal.org/user/1971014
#259
User blocked and spam deleted
#260
Please also list their phone number here. We will contact the provider to block their accounts.
#261
and another.. but from Australia (purportedly)
http://drupal.org/user/1971718
#262
I blocked the users and deleted the spam (different than the focus of this thread)