The spambot report thread

If you experience problems or errors with the discussion forum, post here. Problems with individual users should be reported to the mods or the admin.
User avatar
wardrich
"Some Troll"
Posts: 3944
Joined: Sat Sep 14, 2002 9:08 pm
Location: Ontario Canada

Post by wardrich »

Rwolf wrote:10 more spam today, likely from same source as before.

On another forum we had to vet new registered users before letting them post in public; there was some 40-50 spammers each day, looking valid on the surface, but the profiles were faked, stolen from hacked user databases & the post content was always spam. It kept up from august to november last year.
Cleaned up the mess. Banned all of the users, added common key words from the subjects and the URL roots to the spam word list.
User avatar
Rwolf
Gaming Demi-god
Gaming Demi-god
Posts: 1533
Joined: Fri Jan 11, 2013 3:19 pm
Location: Sweden

Post by Rwolf »

17/4 Only seven new spams from the same source managed to avoid the filter today.

18/4 Fifteen more from the same Indonesian garbage heap today.

19/4 Nine new Indonesian spam. (so far)

(not listing the above)


Plus another returning spammer, wall of text-type:
http://www.dosgames.com/forum/profile.p ... le&u=13636

http://www.dosgames.com/forum/profile.p ... le&u=13648
User avatar
MrFlibble
Demoniac Demo maniac
Demoniac Demo maniac
Posts: 3730
Joined: Sun Dec 05, 2010 11:39 am

Post by MrFlibble »

I've just Trash Heap'd about 20 threads made in the last two days.

Have you tried changing the CAPTCHA type used as countermeasure? A question with no easy to look up answer can do wonders.
User avatar
Rwolf
Gaming Demi-god
Gaming Demi-god
Posts: 1533
Joined: Fri Jan 11, 2013 3:19 pm
Location: Sweden

Post by Rwolf »

20/4:
12 Indonesian spams today.

1 other spam:
http://www.dosgames.com/forum/profile.p ... le&u=13664

21/4:
8 Indonesian spam.

1 other spam (same one as yesterday):
http://www.dosgames.com/forum/profile.p ... le&u=13674

22/4:
10 Indonesian spam.

1 other spam (same pills as before)
http://www.dosgames.com/forum/profile.p ... le&u=13687

23-24/4
8 Indonesian spams (so far)

25/4
12 Indonesian spams

1 other spam (pills)
http://www.dosgames.com/forum/profile.p ... le&u=13708

26/4
8 Indonesian spams

plus 2 other spams from these boneheads:
http://www.dosgames.com/forum/profile.p ... le&u=13723
http://www.dosgames.com/forum/profile.p ... le&u=13486

---

A suggestion about the Indonesian crap:
What if you required at least some words in the post to match an English lexicon? None of the content seem to do so, what I can recall.

A *simple* filtering is to check the users profile, the web link gives the game away immediately, since they want to promote their site.
User avatar
Rwolf
Gaming Demi-god
Gaming Demi-god
Posts: 1533
Joined: Fri Jan 11, 2013 3:19 pm
Location: Sweden

Post by Rwolf »

The Indonesian language spam is for a webshop hosted in the US, administered from Canada. Obviously not intended for anyone here, so why spam in completely irrelevant areas, not likely they will find any customers anyway?
User avatar
Quadko
Darklander
Darklander
Posts: 2092
Joined: Fri Jun 24, 2011 10:07 am

Post by Quadko »

I've wondered about that. Maybe it's pay per post, or hikes up their advertisable "# outlets we can reach" pitch?
User avatar
MrFlibble
Demoniac Demo maniac
Demoniac Demo maniac
Posts: 3730
Joined: Sun Dec 05, 2010 11:39 am

Post by MrFlibble »

Rwolf wrote:Obviously not intended for anyone here, so why spam in completely irrelevant areas, not likely they will find any customers anyway?
Spam posts are never intended for forum users (you're probably encountered spam posts that are nothing but a mishmash of keywords and links - nothing readable). It's purely a SEO technique.

[Edit] Here's an even better article on this:
https://en.wikipedia.org/wiki/Spamdexing
User avatar
Rwolf
Gaming Demi-god
Gaming Demi-god
Posts: 1533
Joined: Fri Jan 11, 2013 3:19 pm
Location: Sweden

Post by Rwolf »

Thanks for the link, always interesting reads.

So what I gather from the link is that they hope to get a high number of *popular* sites linking to their *garbage* site, thus having their page ending high in search engines results for their products of 'Best Rotten Tomatoes', by the mere funcion of e.g. Google Bots scraping this and other sites to feed their search engines.

Ok, and the stopforumspam etc. sites? No good or not practical here?
User avatar
MrFlibble
Demoniac Demo maniac
Demoniac Demo maniac
Posts: 3730
Joined: Sun Dec 05, 2010 11:39 am

Post by MrFlibble »

Rwolf wrote:Ok, and the stopforumspam etc. sites? No good or not practical here?
That's for the admins to decide. I don't get any more feedback from them than you do, and I can only Trash Heap the posts.
User avatar
Rwolf
Gaming Demi-god
Gaming Demi-god
Posts: 1533
Joined: Fri Jan 11, 2013 3:19 pm
Location: Sweden

Post by Rwolf »

A returning tinfoil-hat spammer: jamlieight
http://www.dosgames.com/forum/profile.p ... le&u=13824

(long time no see - at least a variation from the 'rotten wood' salesmen)

Banned account. Stripped spam URL from profile.
User avatar
Rwolf
Gaming Demi-god
Gaming Demi-god
Posts: 1533
Joined: Fri Jan 11, 2013 3:19 pm
Location: Sweden

Post by Rwolf »

More tin-foil mad-hatter spamming: jamlinine
http://www.dosgames.com/forum/profile.p ... le&u=13833

Targetting audience: someone afraid of radio waves.

I note the name is concatenated with a number, the last two were jamli+eight/nine, expecting a spam from jamli+ten real soon now.
Last edited by Rwolf on Sat May 28, 2016 7:29 am, edited 1 time in total.
User avatar
CPT Worm
<font color=gold>American Hero</font>
<font color=gold>American Hero</font>
Posts: 1383
Joined: Tue May 25, 2004 12:04 pm
Location: Shiloh, IL
Contact:

Post by CPT Worm »

OHHHH NOOO
THE GOVERNMENT IS ON TO MEEEEEE
I WISH I DIDN'T DELETE THAT GUY'S POST ABOUT THE GPS JAMMERS
I THINK THEY'RE GOING TO G
Sustinendum Victoriam!
User avatar
MrFlibble
Demoniac Demo maniac
Demoniac Demo maniac
Posts: 3730
Joined: Sun Dec 05, 2010 11:39 am

Post by MrFlibble »

Just Trash Heaped a whoop-load of Indian spam (in English).
User avatar
Rwolf
Gaming Demi-god
Gaming Demi-god
Posts: 1533
Joined: Fri Jan 11, 2013 3:19 pm
Location: Sweden

Post by Rwolf »

A suspected pornsite spammer:

http://www.dosgames.com/forum/profile.p ... le&u=13863

The single post made (so far) has a link to a porn site.
User avatar
Joris
Way too much free time
Way too much free time
Posts: 394
Joined: Sun Jul 27, 2003 10:23 am
Location: the Netherlands

Post by Joris »

User avatar
Rwolf
Gaming Demi-god
Gaming Demi-god
Posts: 1533
Joined: Fri Jan 11, 2013 3:19 pm
Location: Sweden

Post by Rwolf »

Suspected spammer, the only post made contains generic praise and a link to a dating site:

http://www.dosgames.com/forum/profile.p ... le&u=13869
User avatar
MrFlibble
Demoniac Demo maniac
Demoniac Demo maniac
Posts: 3730
Joined: Sun Dec 05, 2010 11:39 am

Post by MrFlibble »

We're in the middle of a massive Korean spambot attack! I've just removed like five or six pages of spam threads to Trash Heap, but they keep coming! Someone shut down this user ASAP:
http://www.dosgames.com/forum/profile.p ... le&u=13883
User avatar
wardrich
"Some Troll"
Posts: 3944
Joined: Sat Sep 14, 2002 9:08 pm
Location: Ontario Canada

Post by wardrich »

MrFlibble wrote:We're in the middle of a massive Korean spambot attack! I've just removed like five or six pages of spam threads to Trash Heap, but they keep coming! Someone shut down this user ASAP:
http://www.dosgames.com/forum/profile.p ... le&u=13883
God damn... thanks for taking care of that one. I've banned the user. I'll see if I can update the spam words.
User avatar
Rwolf
Gaming Demi-god
Gaming Demi-god
Posts: 1533
Joined: Fri Jan 11, 2013 3:19 pm
Location: Sweden

Post by Rwolf »

Sells healthy drinks with too much spam in them.
http://www.dosgames.com/forum/profile.p ... le&u=13887
User avatar
MrFlibble
Demoniac Demo maniac
Demoniac Demo maniac
Posts: 3730
Joined: Sun Dec 05, 2010 11:39 am

Post by MrFlibble »

Spammer with SEO link in profile:
http://www.dosgames.com/forum/profile.p ... le&u=13760

Status: BANNED. Stripped URL from profile
Post Reply