# Dealing with persistent Korean human spammers

**URL:** https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143
**Category:** Support
**Created:** [July 31, 2017, 6:27am UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143 "2017-07-31T06:27:53Z")
**Posts on this page:** 12
**Page:** 1

<div class="post-metadata">

### Author: ![smth](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/smth/32/120300_2.png) [@smth](https://meta.discourse.org/u/smth)
#### Post date: [July 31, 2017, 6:27am UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143/1 "2017-07-31T06:27:53Z")

</div>

Right now, the only way admins can specify manual spam classifiers is using case-insensitive regex.

However, this has proved to be insufficient to me on PyTorch forums that I’ve been running. I’ve also enabled Akismet, but it isn’t doing a great job of filtering the kind of spam I’m seeing.

To give an example, this is an example spam entry:

```plaintext
슈퍼카지노- (₮【79SCV.ＣoM】₮) -SUPER카지노슈퍼카지노- (₮【79SCV.ＣoM】₮) -SUPER카지노

```

The website and posts keep changing, but there are some clear patterns that repeat such as `ＣoM`.  
If there was an inline code snippet that I could write in `admin/site_settings/category/spam`, I think I can get rid of all such spam. It would be so much more convenient to filter spam with advanced filters.

Any thoughts on this?

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [July 31, 2017, 8:19am UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143/2 "2017-07-31T08:19:28Z")

</div>

Have you changed default trust level settings or any other new user rate limits? This looks like bamwar to me, and our built in fast typist check generally stops that sort of thing. Plus you have Akismet. So I’d like to hear more about any non-default security or trust level site settings you might have changed, if any?

---

<div class="post-metadata">

### Author: ![smth](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/smth/32/120300_2.png) [@smth](https://meta.discourse.org/u/smth)
#### Post date: [July 31, 2017, 8:59am UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143/3 "2017-07-31T08:59:15Z")

</div>

I haven’t changed any of the defaults for trust level settings, or new user rate limits. Occasionally, some of the spam does get caught by the fast typist filter, but it’s only occasional. I think the spammers figured out something around this.

I’ve changed the spam filter settings to be much more aggressive yesterday. By default it waits for 3 flags for blocking stuff, and I made it to 1.

Everyday, this bamwar spam comes in about 12 posts, all within a 1 hour timeframe. Each user posts 3 times.

The bamwar spam stopped coming in for about 2 months, when I enabled all new user posts to be moderated (and then I’d reject all the bamwar, but I also end up with having to approve all legitimate posts). The spammers noticed this after a couple of days and stopped spamming. They’ve restarted spamming again since last week.

This manual moderation wasn’t sustainable, as I was getting 100 legit posts / day in traffic, and I was holding discussions back, so I reset back to defaults.

 ![52 AM](https://global.discourse-cdn.com/meta/original/3X/1/7/178b10831277d99da52efee7df38b48b37fd5294.png)

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [July 31, 2017, 9:12am UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143/4 "2017-07-31T09:12:58Z")

</div>

You are confident Akismet is configured and working?

---

<div class="post-metadata">

### Author: ![smth](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/smth/32/120300_2.png) [@smth](https://meta.discourse.org/u/smth)
#### Post date: [July 31, 2017, 9:26am UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143/5 "2017-07-31T09:26:19Z")

</div>

Yes.  
My confidence in it’s working is because occasionally Akismet asks me to confirm that something’s spam. So posts are going through it and it’s classifying them. But it doesn’t classify the bamwar spam, it classifies spam of a different kind (lots of nonsensical characters in the post with a title being the URL for some website).

---

<div class="post-metadata">

### Author: ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [July 31, 2017, 3:00pm UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143/6 "2017-07-31T15:00:09Z")

</div>

What do you do when you find spam posts on your site? Do you delete them or flag as spam and Take action? I think that only the latter sends the post to Akismet as an example of spam – doing this a few times _should_ teach it to recognize this. 🙂

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [July 31, 2017, 4:20pm UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143/7 "2017-07-31T16:20:03Z")

</div>

What I recommend doing here is just adding:

`auto block first post regex` : `\p{Hangul}{3}`

If a first post contains more than 3 korean letters, chuck it in the require approval queue.

---

<div class="post-metadata">

### Author: ![smth](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/smth/32/120300_2.png) [@smth](https://meta.discourse.org/u/smth)
#### Post date: [July 31, 2017, 5:49pm UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143/8 "2017-07-31T17:49:03Z")

</div>

@fefrei I flag the post, but there’s an immediate option that shows up to `Delete Spammer` and ban IP (also deletes all posts by the user). This is convenient because each user usually posts thrice, and this is one button that kills three birds. I suspect this does not report the posts to Akismet, I’ll do the longer way of sending the post to the spam queue via `Flag Post`. Thanks for the heads-up.

@sam that’s a super-cool trick, doing that right away! thank you.

@fefrei here’s some screenshots on what I exactly do:

 ![49 PM](https://global.discourse-cdn.com/meta/original/3X/a/d/ad7c42b81a42be85128dc3ccffb87d0761796d8c.png)

---

<div class="post-metadata">

### Author: ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [July 31, 2017, 5:51pm UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143/9 "2017-07-31T17:51:08Z")

</div>

Too bad, looks like this is the correct way to go. I find it a bit weird that Akismet didn’t get that – but the RegExp from @sam should help a lot 🙂

---

<div class="post-metadata">

### Author: ![smth](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/smth/32/120300_2.png) [@smth](https://meta.discourse.org/u/smth)
#### Post date: [August 5, 2017, 12:19am UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143/10 "2017-08-05T00:19:46Z")

</div>

just wanted to follow up here. @sam’s trick works really really great. Thanks @sam.

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [October 7, 2021, 7:30pm UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143/13 "2021-10-07T19:30:34Z")

</div>



---

<div class="post-metadata">

### Author: ![Canapin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/canapin/32/119591_2.png) [@Canapin](https://meta.discourse.org/u/Canapin)
#### Post date: [October 7, 2021, 8:39pm UTC](https://meta.discourse.org/t/dealing-with-persistent-korean-human-spammers/67143/14 "2021-10-07T20:39:45Z")

</div>

Since the topic was automatically bumped, I’d like to say that I’ve been using the Akismet plugin and I find it very effective.

> [@Discourse Akismet](https://meta.discourse.org/t/discourse-akismet-anti-spam/109337):
>
> discourse2Summary Discourse Akismet allows you to fight spam with [Akismet](https://akismet.com/), an algorithm used by millions of sites to combat spam automatically.hammer_and_wrenchRepository Link [https://github.com/discourse/discourse-akismet](https://github.com/discourse/discourse-akismet)open_bookInstall Guide [How to install plugins in Discourse](https://meta.discourse.org/t/install-plugins-in-discourse/19157)Features What does it do? Akismet helps keep your site free of spam by automatically scanning all posts from new users. Scanned posts that Akismet flags as spam are immediately removed f…
