Recent Rash Of Spammers

[palandri]

Are the other Mobile Nation sites getting hit as bad as we are with this recent group of spammers? If so, what are they doing to prevent it?

This morning the forums looked like trash. I think one of the spammers had 14 post.

I remember at Treo Central a new posters first 5 post were moderated, so they had to be approved before being published.

I also remember at Treo Central they would blocked IP subnets, but that would be useless with the current spammers since they are using a random IP generator.

Anything in the works?

 

[Dave Blake]

I'll hit ask I know it bad this is the worst I have seen for a while. They used to let me block IPs but with the DIPs and the whole Mobile Nations thing they won't let me do that anymore.

 

[palandri]

Thanks! I was just curious.

Maybe going to moderated post for new posters would help.

Another thought is we could report them to I.C.E. since they are selling counterfeit movies that are currently in the theaters. I.C.E. has seized a lot of websites for selling counterfeit goods. Just a thought.

 

[Dave Blake]

Cory said he will take care of it

 

[Cory Streater]

Going to be doing some testing. Please do not ban "corytester"

 

[Duvi]

Cool.... I agree that the spam has been excessive.

This site has the most compared to the other MN sites.

 

[Dave Blake]

Thanks for being on point this week guys. I'm in Seattle working we are putting in long days at the Boing Plant trying to get a machine done. We are working 12 and 14 hour days I cant wait till this is over.

 

[palandri]

Thanks for being on point this week guys. I'm in Seattle working we are putting in long days at the Boing Plant trying to get a machine done. We are working 12 and 14 hour days I cant wait till this is over.

I hope they pay overtime.

I am on a job now in Chicago where no one can make a decision. It stops our work for 2 to 3 days at a time. Now they brought the flooring in for the gym, but our overhead work isn't done.

 

[Dave Blake]

That's bad bit get this. Bowings facilities here is huge. They lost all my materials for 2 days. That's right someone unloaded it in the wrong area it took 2 days to find. When we found it it took almost a full day for them to put it on a truck and move it to where we are working.

 

[palandri]

The moderated posting was working yesterday. I would get a notice to approve a post. Today it doesn't seem to be working. First spam post are showing up rather than being moderated.

 

[Duvi]

I saw a few reported posts when I woke this morning...

 

[Dave Blake]

I need to check the Addpanel and see what he did but I think he's moderating post based on key phrases. I think he might have missed this spammer. If that's the case I should be able to do it myself if the hack has been added. Its definitely better today verses yesterday. ill take a look tonight.

 

[palandri]

I need to check the Addpanel and see what he did but I think he's moderating post based on key phrases. I think he might have missed this spammer. If that's the case I should be able to do it myself if the hack has been added. Its definitely better today verses yesterday. ill take a look tonight.

Thanks Dave! It seems to be working again.

 

[Cory Streater]

I'm still working on it.

 

[Duvi]

I'm still working on it.

Thanks Cory!

 

[Cory Streater]

So the ones that did go to Moderation -- did they show up as a notification like it does when you get a new PM? Do you guys use One Touch Ban and Clean? Lastly, do you always give an infraction before you ban them?

I'll explain how it all works when I'm not typing from a phone.

 

[palandri]

So the ones that did go to Moderation -- did they show up as a notification like it does when you get a new PM? Do you guys use One Touch Ban and Clean? Lastly, do you always give an infraction before you ban them?

I'll explain how it all works when I'm not typing from a phone.

Yes a notification showed up.

I don't see access to One Touch Ban and Clean. Maybe I am missing it. I select, delete post as spam and then ban the user.

I haven't given an infraction before banning a spammer.

 

[palandri]

I just banned wadkatt. He showed up as moderated and had 5 spam post: http://forums.windowscentral.com/ban-tracker/192624.htm

 

[Cory Streater]

The forum will now scan each post for an exact match or a minimum character match from the list below. If the condition is true, and the member's post count is < 15, the post will be sent to the moderator queue for review.

If you guys can follow this process, when dealing with spammers, it will help me tune the filter better:

1. Initiate an infraction from the post.
2. If the post was in moderation, choose the Spammed Advertisements (M) infraction. If it wasn't in moderation, choose the (NM) option. There's also an option for cookie stuffing (explanation below)
3. Once the infraction is given, the member will be auto-banned, and you will be redirected back to the post where you initiated the infraction.
4. Click the members username (within the postbit) and choose the "One-touch Ban & Clean" option. Doing so will delete all sent/received PM's, posts, threads, visitor messages, etc., in one shot.

Note: I will remove the word "online" from this list as soon as this current attack is over. Leaving it in there will cause too many false positives.

Spam Filter Keyword List

github terapad bless how-to-watch whatto whoto circuit menin inblack season Battleship fourfour episode windy prix girl online VIATUN Blapk Wholesale Nike Jordan sneakers Handbags Clothing Gucci Pumas Adidas Prada pharma xanax Vuitton viagra replica ENQUIRY meiying rk2918 munkeez whoch ngc wholeswitch Pavtube Dimitrenko quebix Roman Karmazin Osumanu Adama dlew rugby UFC UCF UEFA AEST AFL NRL formula ncaa boxing pugilism DRM wupload TyTN Nuvi CHOICEBAY ? ? ™ Plasma lcut.in Couture Vivaz Armani Eten Courier Sincerely distributorsis RoHS usd cuinsurance glofiish UNITS YUQI Lux rugby ustream edo vshare Sopcast Justin P2P TVANTS TVU ATDHE uggs moncler TNT BBC CBS ABC NBC FOX ESPN TSN GHD adz .cn (at) ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? KOSO kentintrol KKI wts craze4android Froderickbarnes MLB Prix Net4Mobility cialis horoscope commodity mortgage vicodin medication tramadol paxil 4u dosing fexofenadine fibromyalgia pregabalin benzin alprazolam DENTIST Lesbian .biz bloomberg ow.ly bit.ly love2drive tbldevelopmentfirm .pk mattress linebacker Tiquan clover focalprice clothnappies invalidlink iDisksoft Fommy.com onbarcode prntscr reurl.org xxsurl.de myphonemarket streaming Philippines Basatne barcode Vigaglass invalidlink.png steamate mario xaode .info louboutin cuoda sleek @yahoo @gmail union amex paypal 0$ barclay (p) (f) Halifax € Bahamut ltd .doc icsforums .in/ mintm .co. .com. watcha watchb watchc watchd watche watchf watchg watchh watchj watchk watchl watchm watchn watcho watchp watchq watchr watchs watcht watchu watchv watchw watchx watchy watchz Lucian froch 350.com squarespace amzn.to [hl]avatar0 avatar1 avatar2 avatar3 avatar4 avatar5 avatar6 avatar7 avatar8 avatar9 0.gif 1.gif 2.gif 3.gif 4.gif 5.gif 6.gif 7.gif 8.gif 9.gif 1.php 2.php 3.php 4.php 5.php 6.php 7.php 8.php 9.php 0.php happy.gif smile.gif cool.gif sad.gif 0.jpg 1.jpg 2.jpg 3.jpg 4.jpg 5.jpg 6.jpg 7.jpg 8.jpg 9.jpg com[/img] net[/img] info[/img] momshelper image.jpg free123 steamate[/hl][/box] Examples that would trigger moderation: [PLAIN] watch me stream a movie circuitry rugby handbag meninblack www.example.com/happy.gif www.example.com/999.gif Examples that would not trigger moderation: black hand bloom www.example.com/whowho.jpg[/PLAIN] The highlighted section is intended to address a technique called[b] [url=http://en.wikipedia.org/wiki/Cookie_stuffing]Cookie stuffing.[/url][/b] In forums, a malicious poster will wrap the [PLAIN][img][/PLAIN] tags around a link that ends with gif, jpg, or php. The image doesn't actually exist, and IE will display this: [img]http://cdn-forums.androidcentral.com/images/forum_pics/invalidlink.png?101[/img] Firefox browsers do not display the broken image icon, but it's still there. The link is actually a PHP script, and when the browser tries to resolve the link, the visitors browser is stuffed with cookies. Sometimes 100's of them. Please clear your cookies whenever you see one of these. In fact, I always recommend clearing cookies every time you close your browser -- this technique is all over the internet. Cookie stuffing links will look really suspicious when you see them, so they are easy to spot. I have modified the first post, of a reported post, in the Reports & Infractions forum. The quoted text will be wrapped with [noparse] tags, so URL's are not resolved. There are (M) and (NM) infractions for cookie stuffing as well. Please use them in the same way you are using the Spam infractions. False positives and missed posts will occur. Frequent patterns in each will determine how the filter is tweaked over time. Hopefully that all makes sense.

 

[palandri]

Thanks Cory!