Ongoing Vietnamese forum spam reports

Ugh.

User was blocked, spam deleted. I noted the IP address.

Thanks for the report!

cleaned up.

Maybe we should just call their phoe and tell them to stop? :p

Preferably when it's night over there...

Could we just block users from Vietnam

Drupal has an international community. Cutting off an entire country is not possible.

Michelle

Well, that may be but there are Drupal users there and we can't exclude them because they have spammers in their country.

Michelle

Blocking entire countries is never going to happen.

If I blocked one of these spammers, I have looking up their IPs and blocking specific ones (though, obviously, to no possitive effect.) Here are the IPs I've blocked:

blocked 113.190.157.98 Viet Nam
blocked 113.22.20.121 Viet Nam
blocked 113.190.137.133 Viet Nam
blocked 222.254.17.217 Viet Nam
blocked 113.22.7.75 Viet Nam
blocked 42.113.145.78 Viet Nam
blocked 58.187.53.1 Viet Nam
blocked 183.81.75.5 Viet Nam
blocked 118.71.147.47 Viet Nam
blocked 113.190.143.1 Viet nam
blocked 113.22.107.226 Viet Nam
blocked 1.55.170.127 Viet Nam

So even blocking ranges isn't going to work. And IP blocking isn't as effective as it once was. What we need are better tools (or someone to manage spam.module for D7.)

The most effective method I've found is a question that requires a human to answer. That may be harder here because, on my site, which is local-based, I have no issues excluding people who may find reading the English question impossible. Here, we have to take care to not exclude people who don't read English well and also be accessible to those with disabilities.

Another method I've heard works well is having hidden fields that only bots will fill in. I've never tried that, though.

Whatever method we use, please make it something that will go away once you are established as not being a spammer. I don't want to have to prove myself every time I post.

Having written all that, I just realized it's completely off topic. Sigh. Is there a better issue to discuss this or could we change the title/status here?

Michelle

Edit: Nevermind... Just saw #1293186: Spam - meta: better spam-combating suggestions and realized that I already said this there. LOL!

They're back!
http://drupal.org/user/1788788
Got it in the first minute - so only three posts I had to hit, but Gah...

Please don't block all IP from VN :(

@thehong: would you mind calling them and explaining to them that d.o is not a place to advertise washing machines?

Apparently the posts already got deleted.

Another 40 posts. I've taken care of it from http://drupal.org/user/1800742

@thehong, I want you to hunt them down and hurt them.

Another few dozen just now. Another few dozen 2 days ago. And again several times in the last week. I've lost a stupid amount of time on this bugger.
Still waiting for #1383816: Add "Administer Nodes" VBO to user profiles to land so I don't have to snipe each post individually :-/

another 120 just now http://drupal.org/user/1825982

Searching for the phone number : 0936110049 : Shows up another 50 http://drupal.org/user/1825972 that got through earlier

Searching for another keyword " SỬA BÌNH NÓNG LẠNH TẠI " finds another pile from http://drupal.org/user/1787430

I've killed and swept up after those guys. love the new "Administer nodes" tool

"no activity" my shiny metal ass.
I've got him again a few times this month, and I'm sure others have too.
Most recently http://drupal.org/user/1854632 with 65 more new posts (blocked and deleted)

+246 more http://drupal.org/user/1854674 blocked & deleted

I think i found new Vietnamese spammer. His profile is: http://drupal.org/user/1854734/
Please review his posts and if he is spammer, block him.

Yes. *sigh*
blocked and deleted.

Another Vietnamese spammer found. His profile is: http://drupal.org/user/1854902

It seems that another moderator blocked the last spammer. So more action is not required for blocking him. Thanks a lot.

Oh, yeah, I delete this crap on a regular basis. I don't bother filing issues when I block obvious spammers but put me down for deleting tons of it.

I know it becomes a boring job when the number of spammers increases :).
I have found another spammer too and posted in this node. Please see and block him: http://drupal.org/node/1476836

This user is another Vietnamese spammer. Please block him. http://drupal.org/user/1857078

Thanks a lot. I reported several spammers that seems are not from Vietnam in this node too. Please block them too. http://drupal.org/node/1476836

again with 120 posts http://drupal.org/user/1859080 (blocked and deleted)
Y'know, it seems like it's the same time every night.
approx 7:45AM GMT
- Because I usually get him in the half hour after that (9 PM NZ time, which is GMT+13 right now)
He's not giving up ... :-(

Got it. Thanks.Looks like this account was created at the same time they were spamming with another account. Are they also making an account for the next day when doing the bombing run?
If so, that may be a target for IP-detection.

I think they have some accounts or make accounts after blocking one account. I think the a way is analyzing real users from Vietnam in these hours (about 2- 3 hours) and if they are a few, as we get a lot of spams from this country in these hours, we can prevent them from accessing and then enabling Vietnam IPs after 2-3 hours. We get spammers every day in these hours from Vietnam.

I don't think we should mark this as fixed-- this is a very specific spam attack and we should try and figure out a way, something like dman mentioned above, to automate handling it somehow.

I think its a good way to prevent their IPs in some hours that spammers are working. Or another way is preventing writing Vietnamese language in main forums but its difficult and needs heavy programming.

Although what we are *seeing* is this one bastard, a real solution would need to be a more generic tool for flood prevention.
Tempting as it is, it's not a correct move to hit a single language or even IP block.

No more action seems to be happening right now in #1293186: Spam - meta: better spam-combating suggestions - though I'm REALLY grateful for our recent #1383816: Add "Administer Nodes" VBO to user profiles addition. This Vietnamese rash prompted that happening at least.
Even 'flag abuse' would not stop these attacks :-(

It's a flood-gate that is needed here - more than X posts in X minutes (perhaps modified by UserID seniority) to trigger an IP blacklist - I reckon.

OTOH, I'd like to raise a cash bounty of the old-fashioned kind among our honest Vietnamese community to deal some personal harm to this particular miscreant ...

I guess there is another way too but it effects all website. We can have a captcha or mollom image verification for creating nodes. It means every one wants to post a topic on forums, should pass this image verification. However i myself don't like this at all but i think it helps a lot to reduce spam posts. Whats your idea about it?

It's a flood-gate that is needed here - more than X posts in X minutes (perhaps modified by UserID seniority) to trigger an IP blacklist - I reckon.

Yep, i agree that seems the best way forward (including excluding roles above 'authenticated user'). My only concern would be for the performance implications.

Its a good way but some spammers don't post a lot of posts quickly. For example they post 3 post daily and this way can not block them IMO. However most of them post quickly. Also it can prevent other real members from posting their issues too. For example i myself reported several spams today. Maybe i had more than 5 posts in last 30 minutes to reply this topic or report some others spams in other topics and it makes problem for real members too. Or when a member posts a problem in forums and want to reply to suggestions or answers , if he exceeds this X number of posts is X minutes, he can't do that.

@shamio See discussion on CAPTCHA at #1293186: Spam - meta: better spam-combating suggestions

Yes, i read it yet and i know about CAPTCHA problems and as i said most users don't like it and also there are many CAPTCHA bypass tools or websites. We should find an excellent way to prevent spammers without facing problem for other members.

I know a general approach is wanted but, for this specific spammer, would it be possible to identify the posts by a word or phrase? The forums here are English and, while we don't want to ban someone just for not using English, the fact is that legitimate non-English posts are going to be rare and that could be useful in determining if it's the Vietnamese spammer.

Michelle

Yes, i said it above that if we can have a system to prevent posting in non English languages in main forums, we can block a lot of spammers however we have some English spammers too. But i think its a good way now.

I don't know that we want to automate preventing non-English unless we're very, very careful to do it nicely. There are non-English posts that aren't spam, just people who don't realize we use English in the forum. Drupal is an international project so we need to be careful. My thought was that we could key on specific words in the spam that is currently plaguing us as sort of a band-aid solution as the likelihood of a legitimate Vietnamese post is already slim and the likelihood of one with that particular word-set even slimmer.

Yes, i got your meaning. But we should be sure that what keyword(s) are using in all spam posts and it can be changed i think. But i have a complementary idea for this project. When a user posts a content that includes one or more of those defined keywords, it can be queued for approval. Then admins firstly review them and then approve them if they are not spam. Whats your idea about it?

I seem to recall a lot of them talk about refrigerators and air conditioning, according to Google Translate.

Of course there's no guarantee that would continue,

Yes it seems that they are advertising a product and a website. It needs an intelligent system or we should block them manually always :(

If you are looking for a keyword - their telephone number is consistent. I noted it in #32 above "0936110049"
There are a couple of different numbers, but they are probably the best target.

Its a great idea dman. Its the best way for preventing that user.

Please block him : http://drupal.org/user/1862598
He has 0936110049 in both title and body of his spam again.

It seems that another moderator blocked him now. So no more action is required.

In this very specific case, I suggest we add a post threshold mechanism. E.g. if a user has a total of less than 100 posts, he can only submit less than 5 posts per hour and 10 posts per day (which comes first). If he has more than 100 posts, there is no limit at all.

Also, it a user reaches his threshold, he is automatically flagged to be examined manually by moderators.

Its a good idea too but limiting users should be done carefully. Its possible that a new member faces different problems in first days of working with Drupal and don't find his problems on forums and also not familiar with irc chat and wants to post new topics and answers them and he reaches this daily 10 limits in 24 hours and it makes problems for them. Having such option is a good choice for the community but it should be modified to don't make problems for users. I mean we should do it somehow that members don't think this community has many limitations for them and attacks them to other platforms and communities which are our competitors!!

@shamio - the behavior you describe (10 posts from a newbie) may not be intentionally malicious but it would certainly trigger a very strong warning from any moderator who saw it. That hardly ever happens like that, and when it does it's always cross-posts of bad questions in multiple incorrect places. Which would easily merit an automated cool-down period if such a facility existed.
The limits suggested by jcisio are - to my mind - pretty liberal for sensible humans who have read the forum guidelines and tried a search first.

@dman - Yes, of course you are right. Its very rare as i said too. Ii just wanted to determine very new users that didn't read guidelines and other documentations and want to solve their problems fast. I wanted to think about a modified way that doesn't limit users because usually users don't like to be limited by admins of a website.

@shamio

new users that didn't read guidelines and other documentations and want to solve their problems fast

I honestly don't care if help vampires get their feelings hurt, when by their behavior they are measurably annoying and inconveniencing a much greater number of people who did make an effort to follow the rules. This is not a special-ed kindergarten.

But this is getting off-topic. Actual spam-fighting suggestions, or the policy around it - or even more importantly working code that will do what you propose (!!!) should go over in the meta-issue discussion.

http://drupal.org/user/1861440
http://drupal.org/user/1861432
Now the bastard is racing me in real-time.
f**k this. seriously.

http://drupal.org/user/1870044 blocked and deleted

Please block this spammer: http://drupal.org/user/1871392

VBO is churning thru them now...

Another spammer is here: http://drupal.org/user/1872474

It seems that this user is blocked. So no more action is required.

Another spammer is here: http://drupal.org/user/1873362

It seems that this user is blocked and no more action about him is needed.

They've been on Each Time I came back to d.o today.
4 Different accounts, HUNDREDS of flooded posts, pitching phone numbers 39927495 - 0912584367 usually.
Feels like it's taking several hours a week out of my time, and certainly is making me not want to hang out on d.o like I usually do, it just makes me grumpy.

Would getting a real flood-blocker installed it get more attention if we went back to reporting each individual daily attack as separate issues? 3-5 new issues every day just because of this one user?

@dman: Keep in mind that the number of people who have access to install things on d.o is pretty small and likely most of them have been at Drupalcon all week. Give people a few days to recoup and then let's start making some noise on it. :)

I don't have any code, and I've not analyzed the posts at this point to know whether or not this idea is even feasbile but a question I have is how many seconds pass between posts? And can a threshold be set in that way?

The assumption with this idea is that bots post faster than humans can type.

Please block him too: http://drupal.org/user/1874580

If you want to report spam posts, please do so in a new issue. Also, because of the volume, they are easily caught and don't really need reporting.

OK, thanks. I reported it here because this issue relates to Vietnam spammers and all spammers from Vietnam are reporting here.

@Heine: Your second sentence contradicts your first sentence. :) Because they get caught so easily, it's silly to have issue after issue filed. A quick comment here is a failsafe in case one slips thru the cracks. Since I and other maintainers are following it, we can do a quick check. If a new issue is filed, I won't see it in any sort of timely manner. So I'd much prefer to have them here. I'd prefer to have all spam reports on one issue, actually, but I know I'm a minority so won't push that one.

Then we should probably move the spam limit discussion elsewhere.

Considering this issue started as a spam report and mostly is a series of spam reports aside from some posts in the middle saying we should automate this and also the fact that we already have multiple issues about better spam tools on d.o, I'd be fine with turning this into a spam report issue and having the other discussion in those other issues.

Please block him too: http://drupal.org/user/1875044

It seems that its blocked, so no more action is required.

This user should be blocked :http://drupal.org/user/1875414
I am sure he uses automated tools to spam because he has more than 300 posts in less than one hour. We should think about preventing automated spammers.

Integration of captcha e.g. mollom ? may help in preventing spam a lot but, yeah, it could be bit irritating, when everytime one has to enter some random chars to make a small post even.

Yes. I suggested it above too. But it seems that many users don't like it. But we can have it for new users for example with less than 50 posts or something like it.

Ahh missed that point.
But what if a user starts making spam after 50 posts? Better solution could be limiting number of posts in a day. We can't revoke access & ask users to wait till their posts get approved moderation etc or even marking their posts unpublished if there is more than 'x' number of posts in a day, as that's not how community should run.
We can always engage our resources, time, efforts in blocking those users & their spams, but that would be waste imho.
So only option left is captcha integration.
Though #1293186-76: Spam - meta: better spam-combating suggestions explains another method, to tackle with this issue. I think there is already a discussion going on around "abuse flag integration on d.o", can't recall the node-id.

Killed and blocked 674 spams from http://drupal.org/user/1875414 just now.

And a hundred from http://drupal.org/user/1875480

Its another spammer: http://drupal.org/user/1875450

Another 200+ spams bite the dust.

I know shamio is a *ridiculously* new user to be suggesting this for ... but given the hundred spams that he(?)s reported excellently so far already .. how silly is it to suggest a rapid promotion to moderator role? With some guidance?
Because keeping on top of these things is sucking the life out of me. Much better to tag-team it than pass the bucket all the time.

sorry, but given the history in #1467726: I'm spotting a number of almost-human almost-spam floods. I'm a bit cautious about granting moderator rights at the moment.

true. Was just a tired thought.

For what it's worth, I had the same thought but hadn't looked into the user's history and so didn't suggest it.

This is really annoying... How about writing a quick input filter that don't create links before a user has not posted 50 comments and is a member for 1-3 months or longer and/or add nofollow to all their links within this time. This may stop the backlink spammers... Additionally, add human questions in the first 1-3 month of membership. I guess it would help a lot... Will not stop all, but maybe 98%.

Also add a small button to make quick notifications and unpublishing possible... Creating a case for every spammer is really stressful.

@hass We do not use always filter for links (e.g. link to free tag terms). Also, filter depends actually only on (format, text), not on user. We have a few suggestion on #1293186: Spam - meta: better spam-combating suggestions but the related person have not replied yet (not a priority? busy? waiting for a patch?)

It's not difficult to make a user check on input filters; if the node/comment is from unreliable users.

Please block this spammer: http://drupal.org/user/1876892

Another spammer found here: http://drupal.org/user/1876936

The last two reported spammers are blocked, so no more action about them is required.

@hass hook_filter (D6, which d.o runs) or hook_filter_FILTER_process (D7) takes (text, format) as arguments. I don't know how to "easily" get uid in those functions.

Most links on d.o are already nofollow'd. Spammers don't bother to check that first. The problem isn't giving link juice out but rather that mass spam makes the site look crappy so just adding a nofollow wouldn't have helped that even if it wasn't already there.

Please block this spammer: http://drupal.org/user/1877380

Above user is blocked and more action is not required.

Another spammer. Please block him: http://drupal.org/user/1877588

User is blocked by a moderator.

@jcisio: I thought more about a custom filter that is the default filter for these users. So we don't grant them permission to use the standard filter before they hit the limits... May be very complex to change later as it's permissions stuff. This was just brainstorming... I personally also don't like to enter everytime some digits, just to post my comments/issues... but I'm far above the a 1000 comments limit... so real users that are not spammers should not affected/get hurt by antispam tools :-).

@Michelle: For a year or so I wish there would be a "spam" link next to edit/reply in all comments that I could simply click (like decline in l10n server). If more than 2-3 people hit this, a comment get's auto-unpublished... or a comment goes automatically into a moderation queue or at least the webmasters get a list they can scroll down in a minute and mass unpublish all daily warnings... just thinking how to optimize the review process... it opens a door for abuse if auto-unpublishing is used, but we may be able to limit this to trustworthy users or members for a year or longer. Nevertheless every automated antispam module will be much more efficient to get the first 90% away and the buttons may exists for the rest...

Its another spammer: http://drupal.org/user/1878858
He posted more than 70 spams in less than 23 min after registration. I think these spammers use an automated tool.

Its another spammer: http://drupal.org/user/1878896

Both above users are blocked and no more action is required.

Its another spammer: http://drupal.org/user/1879840

Above user is blocked by a moderator.

Its another spammer: suadieuhoas

Above user is blocked and more action is not required.

One more spammer: http://drupal.org/node/1452916

Yeah - different spammer, but this one has been warned before. blocked and deleting now

This issue seems to be about swatting spammers, but is there an actual plan for what the issue title indicates: automated measures against forum spam?

I am dying inside at all of the collective brainpower/energy of the number of awesome and dedicated peopel in this issue. :( How can we make it so you can go back to making Drupal awesome?

Its another spammer: http://drupal.org/user/1884936

The latest reported user is blocked.

@webchick, this issue is just to capture the repeat visits by one bot.
Actual progress is being made (or mired in discussion, I can't tell any more) over at #1293186: Spam - meta: better spam-combating suggestions

So far we have -
got an "administer nodes" tab on user profiles - and that's been a big help
and someone's recently added one-click unpublish to comments and nodes (not sure where the issue for that was, but it must be inspired by current issues)
and ... talk is ongoing about 'flag' I think.

We still need a flood-prevention thing also. Anyway, real talk is over there.

This thread is just a response to one daily attacker (instead of having a hundred separate responses to him :-/ )

Ok, re-titling then so I quit getting my hopes up. :)

@webchick: Yeah, this thread has wandered a bit from spam report to wtf do we do about this spam back to spam report. :) The other issue is more actionable stuff.

I changed the title a bit because it's not simply a log but a series of reports to make sure none of them slip thru the cracks. Most of the time their spam is a big flood and someone catches it right away but having the report here means we can double check and make sure the user was blocked.

I also changed the priority not because spam deletion isn't critical but because this is ongoing and we take care of it quickly and I don't think it really needs to be jumping out in the webmaster's queue as a critical thing. If others disagree, I won't object to changing it back.

Its another spammer: http://drupal.org/user/1887218

Fixed?
Yeah right. It's fixed when it stops.

http://drupal.org/user/1887234
another hundred posts deleted here.

Another spammers found here: http://drupal.org/user/1893308

And its another spammer: http://drupal.org/user/1893314

Someone got 'em

Another spammer is here: http://drupal.org/user/1893394

Its another one: http://drupal.org/user/1893418

Both above users are blocked now and more action is not needed.

Another spammer: http://drupal.org/user/1893498

Its another spammer: http://drupal.org/user/1893476

Both above users are blocked.

Another spammer is here: http://drupal.org/user/1893494

Its another one: http://drupal.org/user/1893686

And another one: http://drupal.org/user/1893514

It seems a moderator blocked this user.

Another spammer: http://drupal.org/user/1894582

Its another spammer: http://drupal.org/user/1893500

Got http://drupal.org/user/1894582 (200 posts)
Got http://drupal.org/user/1893500 (460 posts)
Thanks.

Followed immediately by http://drupal.org/user/1893500 as soon as I blocked the latest active account :-(
Another few hundred successful attacks on d.o. - now being repaired slowly.

Another one, http://drupal.org/user/1896710.

Not the first one I have cleaned up, but I only saw this thread today

http://drupal.org/user/1896954 has been got

Hm, English is odd. "has been got" :-/

Its another spammer should be blocked: http://drupal.org/user/1899568

http://drupal.org/user/1899568 blocked and deleted.
Coming in at a different time of day this time...

Latest reported spammer is blocked now.
@dman, I wanted to report that this user is blocked,but your action was faster is blocking user and reporting it here :)

Another spammer is here: http://drupal.org/user/1902524

A slightly different flavour of Vietnamese crap this time.
No phone number, but a link.Probably not the same freak.
Blocked and deleted.

Another spammer found: http://drupal.org/user/1893508
I am sure this spammer uses automated tool because he posted more than 200 spams in less than 40 minutes!!!

Another spammer is here: http://drupal.org/user/1902638

:-(
The system is slowy deleting them now.
Blocked http://drupal.org/user/1893508 and http://drupal.org/user/1902638

http://drupal.org/user/1906962

Someone got that one.

Another spammer found here: http://drupal.org/user/1896982

Got 'im.

These are two other spammers:
http://drupal.org/user/1921000
http://drupal.org/user/1900614

Some one got the last two.

Another spammer: http://drupal.org/user/1923238

Above user is blocked and no more action is required.

Another spammer: http://drupal.org/user/1925352

Above spammer is blocked and its snother spammer:http://drupal.org/user/1925466

Got 'im. Thanks.

Another spammer: http://drupal.org/user/1926778

User blocked , spam removed.

Another spammer: http://drupal.org/user/1927094

Latest reported user is blocked and no more action is required.

Another spammer: http://drupal.org/user/1929010

Screw this guy, honestly.
nguyenhoangyen blocked. (plus two others I hit in the meantime today)

What's the going rate for a kneecapping in Vietnam this month?

we also now seem to be under siege from bangladesh by streaming sports spammers :-(

does this garbage really make anyone money?

Another spammer: http://drupal.org/user/1931438

Another spammer: http://drupal.org/user/1931400

Those two blocked and deleted. Several hundred posts

Spotted this one flooding the forums as I watched ... they'd got to about 40 by the time I blocked and purged.

suatulanh1990 / http://drupal.org/user/1933128

Another spammer: http://drupal.org/user/1934874

Someone got them

Another spammer is here: http://drupal.org/user/1939182

User block, content termoved

Very active new spammer: dfsfsd

We clearly need a module that prevents making more than 40 posts in 6 minutes. :-/

Okay... that one's been blocked. I think they got up to more than 60 posts... in a 15 minute span (or so)... Yikes!

Gaaah! They are back with a new account: JHJHJ

Another spammer: http://drupal.org/user/1940656

Blocked and content currently deleting.

Yet another one, http://drupal.org/user/1940920, this time 252 posts in 36 minutes. I blocked and am cleaning up the content. It would be nice if we could throttle how fast people can make content

And another http://drupal.org/user/1940896, someone else blocked, content removed (they seem to come in waves)

yep... and now we're being attacked by sports streaming spam from bangladesh

Another user, http://drupal.org/user/1941648 :S

Someone blocked last reported spammer.

Another bits the dust: http://drupal.org/user/1941720

And another: http://drupal.org/user/1932234

Another spammer: http://drupal.org/user/1946718

Above user is blocked and no more action is required.

Another spammer: http://drupal.org/user/1952850

I've still been finding and hitting one or two of these daily (x 50 posts each time) (not just those we log here) ... very boring.
I can't imagine why this bugger keeps coming back. But it sucks. horrible times.
.

uyenthang: http://drupal.org/user/1953570 — spamming it up in the forums.
hienanhhn: http://drupal.org/user/1953768 — another one

Oh... and I don't think it ever makes sense to mark this topic as "fixed"... at least while this still happens. It means that those "following" the topic come here only to see a meaningless status change (then hours later there is a new spammer to report here). So keep it "active" or "needs work", please, until we have a working solution in place the prevents this spam.

there has to be a better way than keeping one issue open ad infinitum-- once this issue reaches 300 comments it will be a royal pain to use.

All the more reason not to create open > fixed comments. We DON'T need them! Until this is REALLY fixed, we should, imho, just keep it "open" and only add comments which include a new spammer to report.

We can permanently close this thread and open a new one if the issue is not resolved when we hit 300 posts, but there is no need to change the status of this task every time we add/block a user, imho. It's never "fixed" (until we get a better spam-blocking system for this issue) and always at least "needs work".

But really, we need a way to allow any reasonably trusted member to report any new member as a spammer and have them automatically blocked by this action… or something like that. It shouldn't be so much work or fall to people who need special permissions. It should be like maintaining the documentation, etc: anyone can help (but we should ensure the user is not a just-created account or one with no prior activity).

@Heine: Please don't do that. It just adds to the comment count for no reason.

@WorldFallz: I was hoping we'd have a better way before 300 but it's not looking likely as I've seen no movement on those issues lately. :( When we hit 300, let's open a new one.

@all: If you don't like this issue, don't follow it. Until we have decent spam control measures, this issue is useful as there have been several times that the spammer hasn't been gotten before I saw it here and I went and cleaned up. I check my tracker frequently and shamio finds a lot of spam and having this issue prevents him(?) from having to open up have a billion spam reports.

Ugh... I missed the status and I can't change without adding a comment. :(

I went back and deleted a bunch of the earlier reports as well as a bunch of pure status changes. I'm hoping that this will paginate based on existing comments, not comment numbers, and so will give us some breathing room before 300.

Another spammer: http://drupal.org/user/1953914

Latest reported user is blocked and no more action is required.

@LoMo, I've marked the issue fixed whenever a spammer reported here was blocked by me. I don't get why you get upset that I've added these comments.

Issue #1293186: Spam - meta: better spam-combating suggestions deals with the anti-spam suggestions.

@Heine: Because we are using and re-using this issue so it isn't "fixed" until we get alternate spam fighting methods.

There really isn't any need to change the status at all, actually. If you block the latest spammer or confirm it's blocked, just leave a comment. This issue is always active because the spammers sure are. :(

@Heine... We all just don't need a notification every time someone just changes a status here and we don't need to rush to 300 if we can help it, so I think it makes most sense to edit the comment and indicate "fixed" without actually changing the status or adding a new comment/post each time a spammer is blocked. Anyway, I didn't realize you'd blocked a spammer — I appreciate what you are doing and understand your approach now. I just saw you'd changed the status to "fixed", which I think for a thread like this should only be done if a way is found to prevent the spam flow.

And yeah... I guess I did know that there was a related general discussion thread about how to handle spam. We should at least have some kind of system to prevent a new account from making dozens of posts in minutes -- hell, new users should maybe be limited to 3 new topics per day until they have proven they are actually here for Drupal. Or... Ideas, ideas... ;-)

For this particular issue it's probably best to start with extreme limits (say, 40 posts in 6 minutes) and work down ...

Thinking about it, it shouldn't be too hard to code a module that picks up if a user has exceeded a posting threshold and blocks/unpublishes the user/content (respectively) ... maybe even create a post or send an email to notify webmasters...?

EDIT: Never mind, having checked #1293186: Spam - meta: better spam-combating suggestions they've already discussed flood control modules and I don't think any of the quick hack jobs I had in mind would cut it.

In no particular order:

* I was going to close this thread and start a new one before we got to 300 anyways!

* I've added <del> to a couple comments to indicate it's been done. Saves a comment.

* Spam control in Drupal sucks. For D7 it's all about Mollom. Sheesh.

* It's probably better to report the spammers that only leave 4-5 comments. The ones that leave 70+ are easy to see. The stealthy ones aren't.

* I want flag.module for general use. Just sayin'.

They start spamming groups:

- http://groups.drupal.org/node/231623
- http://groups.drupal.org/node/231618
- http://groups.drupal.org/node/231613
- http://groups.drupal.org/node/231608

Blocked http://drupal.org/user/1962002 - http://groups.drupal.org/user/1789448
and deleted 4 nodes on groups
(plus another ~700 this week)
*sigh*
4 posts wouldn't trip any threshold we are hoping for.
definately need a string-based blacklist for whatever it is they are pushing.

same(?) user http://groups.drupal.org/user/1789258 wifiprovn http://drupal.org/user/1961866 blocked
With another 4 posts in groups.
Spamming phone numbers like "0976334045"
and
https://sites.google.com/site/bophatwifi
https://sites.google.com/site/giabophatwifi
https://sites.google.com/site/caidatmangwifi
https://sites.google.com/site/lapdatmangwifi

Probably more if we could monitor keywords or something

also http://drupal.org/user/1962200 anhbuihn
pushing "0974.003.616" x 11
blocked & deleted.

Now Bolivia too, and they start hijacking legitimate posts. User hzc001 http://drupal.org/user/1962360/track

The keywords are "Ha Noi", "Hà Nội", "sua chua", "lap dat".

Another spammer: http://drupal.org/user/1967032

User blocked, spam deleted

Another spammer who posts so fast :) http://drupal.org/user/1967042

Some one got them

Since the first two are alternate (local) spellings for the city more typically written (in English) as "Hanoi", I wouldn't suggest blocking any post that mentions the city, assuming we start identifying "keywords" since I can imagine legitimate posts might well mention Hanoi and write it as "Ha Noi", etc.

Are you able to suggest better string-based keywords if we were to enable blacklisting.
With a few thousand spams per week coming in with this unique identifier, and a theoretical (?) coming in that match this pattern but are not spam, what would be a more accurate suggestion?

I (personally) could live with a 1% false-positive hit-rate if it means 99% accuracy.
But if there is an alternative string to refine it, please post it here and we may be able to use that as a better suggestion.
I'm unable to parse those posts to figure out what is common grammar and what is a spammy pattern.

another one with lots of posts today ongoing

http://drupal.org/user/1971014

User blocked and spam deleted

Please also list their phone number here. We will contact the provider to block their accounts.

and another.. but from Australia (purportedly)

http://drupal.org/user/1971718

I blocked the users and deleted the spam (different than the focus of this thread)

http://drupal.org/user/1975336/track another

[Edit: This one is done.]

More than 1h and not blocked, so I post http://drupal.org/user/1980602/track

(Interesting thing: member since 1 hour 43 min, but first post: 35 min 10 sec ago)

deleted.

If you block a user, you may want to check their email address and do a user search for it to see if they have more accounts.

For example, I found this user: http://drupal.org/search/user_search/lguyenthang who created 170 accounts in three weeks (about half were blocked, I took care of the rest.)

It won't solve the problem, and they'll keep coming back since their stupid, but it might slow them down a bit. Until they come up with new email addresses. Bastards.

Continuing to kill several thousand a week. :-(

Just making a note of some search terms here. The phone numbers etc.
0914.112.226 043.9927497 0976332524 0974.003.616 0976334045 0936110049 85875045 0976332524 85875044 22132302 85875046 0979821428 0975271462 0936110049 0973056345 0466745218 043.9927496
If anyone hits that search and finds NOT a spam report - kill it.

[Edit - added 0973056345 and 0466745218]
[Edit - added 043.9927496 (kingandy)]

Just found two new numbers: 0973056345 and 0466745218 (http://drupal.org/user/2006216/track)

Thanks, added them to the search link above

Vietnam again

http://drupal.org/user/2035444

Yeah thanks. Got it.

For completeness: User "rungthong" (http://drupal.org/node/1646236) was blocked earlier for spam; their content's gone but Google's cache suggests it belongs in this thread (Vietnamese text "Sửa điều hòa tại TÔN ĐỨC THẮNG" and a phone number).

[Edit: Before Google's cache disappears - the numbers were 0914.112.226>043.9927496. Added this to the search link in #267.]
[Edit: Possibly the search link should be moved up to the issue summary?]

More

http://drupal.org/user/2041152

Always seems to be at this time of day recently?

I've stripped out a number of blank status-change comments from this thread, to keep the post count down...

keo23 http://drupal.org/user/2052714/ - blocked and purged, 41 nodes. Phone numbers already in the search thread above.

EDIT: Also keo12 http://drupal.org/user/2052666/, 90 rows. I'm afraid I didn't check all the phone numbers...

8+ page of spam by http://drupal.org/user/2058158 over the last hour in Post installation

Yeah got it (two users)
Prtty hard to miss

How about using http://www.stopforumspam.com to download IPs of global spammers and blocking them?
Looks like http://drupal.org/project/spambot is exactly doing that

http://drupal.org/user/2218530

These are other spammers:
http://drupal.org/user/2264746
http://drupal.org/user/2264580

Another one is here: http://drupal.org/user/2264624

deleted 1600 or so nodes.

I'm still hitting several *thousand* of these on a weekly basis I no longer bother to note here. Often several hours a week for me this year are just spam squashing. :-(

I also have been cleaning up this type of spam and some of them manage to post hundreds of posts in less than an hour. At least we no longer have to delete them one by one.

I also have been cleaning up this type of spam and some of them manage to post hundreds of posts in less than an hour. At least we no longer have to delete them one by one.

True, but even with bulk delete, there are days when *every time* i check the recent posts there is a new flood with a couple of users.
3 minutes each, 5 times a day, every day ... adds up :-(
How much does a hitman cost in Vietnam? I'll stick $200 in to a chip-in for that.

It does, I am also regularly catching them. I would like an admin page where I could see the people who have posted ranked by the number of posts in the last N hours.

I dare to declare this fixed.

awww... we haven't gotten to 300 comments yet! :(

:)

This is such a relief!!!
I've not seen it for a month or two so phew.

What was done to stop the spamming? I guess they didn't just quit, did they?

They quitted, probably when they were warned that there is no use spamming like that.

There were also threat in the "Vietnamese community" to black mail those telephone numbers, but I'm not sure if it happened.

quit? hardly, lol. They were stopped by killes and the honeypot module: http://drupal.org/node/1759272

It's strange to see honeypot stops a targetted spam. Anyway, it's better that is stopped.