Forum Spam from South Korea

[Tdol]

In recent weeks, we have been under a sustained attack of forum spam from South Korea, far worse than anything we have seen before. We have had to delete thousands and thousands of posts, and blocked hundreds of IPs and IP groups, but it kept on coming. As much of it is not posting links, it gets past spam filters and is causing harm to the forum. We have, therefore, reluctantly taken the decision to block all traffic from South Korea as a temporary measure. I hope this block can be lifted soon and apologise to our genuine users from South Korea who are being affected by this, but there is no other way to stop hundreds and hundreds of posts of rubbish appearing every day.

 

[MikeNewYork]

It is an unfortunate, but reasonable action. The attack was ruining the forum. Is it possible to put new members on moderation temporarily? I was able to do this when I moderated delphi Forums. That would allow spam posts to be deleted and the user banned before ever being seen.

 

[Tdol]

A lot of their accounts were being moderated and not showing, but many were still getting through. If we put all new members on moderation, the forum would grind to a halt and many would simply give up as their questions didn't appear. The people behind this were professionals who knew what they were doing and had access to a seemingly unlimited supply of IPs, and were very good at getting themselves registered. This could mean that they're using a botnet. However, the value of posting this kind of rubbish is probably close to zero, so it seems a huge waste of time. Most of the spam we've had before has come from other countries, but I have since found out that they are one of the biggest countries for spam, with a reputation for persisting. Most others give up after a while.

I do feel sorry for our regular posters from there who are being affected, but there really was no other way to deal with it.

 

[MikeNewYork]

I sincerely appreciate your efforts in handling this problem.

 

[Skrej]

I think I saw a few of them make a couple of 'real' posts before launching into their Spamapoloza acts.

You could pretty much predict who was going to be spammer, by their screen names. There was a sense of dread every time I saw 'congrats to our newest member zzzzggy1lologh1'....

Thank you to all the moderators who're working on keeping the forum clean. Too bad the real users from South Korea have to suffer, but drastic measures require drastic steps.

From personal experience moderating a besieged forum, I imagine it will take a few months for the onslaught to subside. Once spammers find a vulnerability, there seems to be some kind of pro-spam brotherhood that shares their latest hot-spot. It's mostly all automated, so it takes a few months of unsuccessfully logging in to get off the bot lists.

 

[MikeNewYork]

The Forum is much more pleasant today. I also feel badly for the normal students from South Korea. But hopefully this will be short-lived.

 

[Tdol]

It's mostly all automated, so it takes a few months of unsuccessfully logging in to get off the bot lists.

Most of them are not very good at what they do- the vast majority don't succeed in registering, but this lot were different. They had access to so many IPs that they just couldn't be stopped by normal banning and blocking methods.

 

[tzfujimino]

If I were given the authority to delete all those rubbish threads, I would be happy to do so.

Unforgivable, indeed.

 

[MikeNewYork]

The spammers are back in a big way tonight. I think I agree with you that the deletion power needs to be expanded so that different time zones are covered. I would be happy to participate.

 

[tzfujimino]

Yes, I agree with you wholeheartedly.
We need to work together to tackle this problem.

 

[MikeNewYork]

Miraculously, all the spam has disappeared.

 

[tzfujimino]

I think ems and Rover have dealt with it.
Thank you for your efforts, ems and Rover.

 

[MikeNewYork]

All hail ems and Rover.

 

[Esredux]

The spammers are back in a big way tonight. I think I agree with you that the deletion power needs to be expanded so that different time zones are covered. I would be happy to participate.

:up: It could be not necessarily just delition, though.

I have never run a site and might well be wide of the mark. (sorry if that's the case, just ignore it)

Probably due to my current location, I think I am among those who will bump into spammers first and have to wait till someone comes online and cleans the whole mess. I also noticed that during such attacks the number of people online (members and guests) usually goes down, sometimes quite drastically. And it's easy to understand why: for a second language student it can take forever to wade through all those fake threads, so many would probably give up.

Could there be any forum option/s to protect decent users, like adding spammers to one's ignore list? For me it didn't work as it didn't eliminate their threads from the 'what's new' page. For the same reason reporting such threads didn't help either. I assume I might have overlooked reporting users with all their threads at once or anything more efficient.

I was also wondering what if newcomers had any time limitations, like 1-2 new threads a day or till the first comment from a moderator or something similar?

Many thanks for all your time and effort you put into this site - it's priceless.

 

[emsr2d2]

Generally, in the mornings before work, I don't have time (or the brain cells) to answer actual questions but I can whoosh my way through a whole load of spam-o-maticking and will continue to do so until (hopefully) the attacks come to an end!

This must be a complete nightmare for you, Red5, so thanks for all your hard work trying to shut it down.

 

[MikeNewYork]

Yes, many thanks to Red5.

 

[Red5]

I was also wondering what if newcomers had any time limitations, like 1-2 new threads a day or till the first comment from a moderator or something similar?

Thanks for the suggestion. I've now changed the forum so that the first posts from new members are moderated. It's unlikely to be 100% perfect, but hopefully this will help us catch more of this spam before it appears on the public site.

Many thanks for all your time and effort you put into this site - it's priceless.

Thank you very much! All of our staff here are volunteers and they work very hard to keep things running smoothly. Comments like this make all the difference! :up:

 

[Tdol]

Thanks. Let's see how effective these measures are. This is the first time they have got round the block with significant numbers of posts- we've only had a few minor cases of them getting through from machines in other countries in the last couple of weeks.

 

[Esredux]

It's unlikely to be 100% perfect, but hopefully this will help us catch more of this spam before it appears on the pubic site.

And I suspect it might be very time-consuming as well. Fingers crossed it won't last long.

 

[Tdol]

Let's hope it doesn't, but I have my doubts.