# Diagnosing spam attack of 100 topics **URL:** \ **Category:** Feature\ **Created:** [2017年五月24日 21:36 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320 "2017-05-24T21:36:48Z")\ **Posts on this page:** 15\ **Page:** 2
**Author:** ![AstonJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/astonj/32/215041_2.png) [@AstonJ](https://meta.discourse.org/u/AstonJ)\ **Post date:** [2017年五月25日 11:44 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/21 "2017-05-25T11:44:48Z")
Yes both of those are enabled - I’d like to know which is triggering the moderation as ideally I’d like to disable TL0 users threads going into moderation (It’s all tl0 topics not just the first one right?) ---
**Author:** ![cpradio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cpradio/32/4970_2.png) [@cpradio](https://meta.discourse.org/u/cpradio)\ **Post date:** [2017年五月25日 11:53 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/22 "2017-05-25T11:53:09Z")
> [@AstonJ](#): > > (It’s all tl0 topics not just the first one right?) Ah, so it is. I had mis-read it. Did you enable that option for both posts and topics, or just one of the two? Oh, I remember the setting we had you undo, was the disabling of `auto block fast typers on first post`, that alone will likely solve the issue you experienced with 100 topics being created that were pure spam. You probably do not need to send TL0 into the moderation queue intentionally. And if you ever get an opportunity, setting up Akismet is well worth it (if you haven’t already). Between fast typing and akismet, we rarely have actual spam posts shown on our latest view for any length of time. It really does keep the forum clean and what does get through, mods/users are quick to flag so it gets hidden. ---
**Author:** ![AstonJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/astonj/32/215041_2.png) [@AstonJ](https://meta.discourse.org/u/AstonJ)\ **Post date:** [2017年五月25日 12:19 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/23 "2017-05-25T12:19:56Z")
I believe it is for topics only. Tbh DC has been brilliant to date, with just the odd human spammer getting through and they usually post in an existing topic and are easily identified. This is the first time we’ve had a co-ordinated attack on this forum (we get them periodically on other forums I admin that run different software). It would be great to see what is triggering requiring approval (I’m guessing it is the TL0 posters, but am hoping it’s the fast typing posters). ---
**Author:** ![cpradio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cpradio/32/4970_2.png) [@cpradio](https://meta.discourse.org/u/cpradio)\ **Post date:** [2017年五月25日 12:21 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/24 "2017-05-25T12:21:24Z")
Have you checked the Staff Action Logs area? I can’t recall if that helps identify the cause. ---
**Author:** ![AstonJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/astonj/32/215041_2.png) [@AstonJ](https://meta.discourse.org/u/AstonJ)\ **Post date:** [2017年五月25日 12:22 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/25 "2017-05-25T12:22:38Z")
Yep, it just says `Deleted via post moderation queue` ---
**Author:** ![AstonJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/astonj/32/215041_2.png) [@AstonJ](https://meta.discourse.org/u/AstonJ)\ **Post date:** [2017年五月25日 18:05 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/26 "2017-05-25T18:05:46Z")
It does actually differentiate between the two: ![](https://global.discourse-cdn.com/meta/original/3X/3/6/36064167b6db15d735b242f0c7f0d3b928a6bc32.png) So looks like TL0 restrictions need to stay in place… for now.. ---
**Author:** ![AstonJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/astonj/32/215041_2.png) [@AstonJ](https://meta.discourse.org/u/AstonJ)\ **Post date:** [2017年五月26日 01:21 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/27 "2017-05-26T01:21:22Z")
Quick update to say in the last 24hrs there’s been 9 accounts blocked by moderation queue and 8 accounts blocked by typing too fast. * * * A strategy we use on another forum is checking user profile location/country field with the IP country - automating that check (and perhaps other honeypots) might prove useful as well.. ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2017年五月26日 01:22 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/28 "2017-05-26T01:22:46Z")
> [@AstonJ](#): > > Quick update to say in the last 24hrs there’s been 9 accounts blocked by moderation queue and 8 accounts blocked by typing too fast. How many got through then? ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2017年五月26日 01:32 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/29 "2017-05-26T01:32:59Z")
You can blacklist ip ranges in Admin, Logs as needed, up to `255.*.*.*` if necessary. Also if you do not have Akismet set up yet, why not? Realize these _are_ humans so only anti-human techniques will work. ---
**Author:** ![AstonJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/astonj/32/215041_2.png) [@AstonJ](https://meta.discourse.org/u/AstonJ)\ **Post date:** [2017年五月26日 01:50 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/30 "2017-05-26T01:50:36Z")
> [@sam](#): > > How many got through then? …none 🙂 They all got caught via quick typing or TL0-moderate-threads. I wish we didn’t have to use TL0-moderate tho, I know from personal experience what a pain it is joining a forum then posting a thread which you want a quick answer to but it goes into moderate… sometimes for days. Hopefully that won’t happen as we have quite a few mods onboard. I read that you hate spam, thank you for making DC unfriendly to spammers 😃 > [@codinghorror](#): > > You can blacklist ip ranges in Admin, Logs as needed, up to 255._._.\* if necessary. That’s good to know. When we first got hit by a huge spam attack (several years ago) we resorted to simply banning several of the worst culprits by country - on a server level. Not ideal but was very effective. > [@codinghorror](#): > > Also if you do not have Akismet set up yet, why not? Realize these are humans so only anti-human techniques will work. I’m going to have to look into it. I vaguely remembering trying it (on my blog I think) and found that it didn’t really do much, but that was a long time ago. When it’s installed on DC do we get some sort of notifications (in the logs) of how many posts/threads Akismet is catching? Also, is it given precedence so that we can use the block by fast typing and put tl0 users threads in moderation as fail-safes? This would also help determine whether it’s worth keeping. The only other drawback (which isn’t too big a deal for the programming forums) is posts being sent to akismet (on some of the forums I run some posts can be of a highly personal nature). ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2017年五月26日 02:04 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/31 "2017-05-26T02:04:46Z")
try turning off tl0 moderation queue and see what gets through, paste some screenshots here of spam that sneaks past. ---
**Author:** ![AstonJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/astonj/32/215041_2.png) [@AstonJ](https://meta.discourse.org/u/AstonJ)\ **Post date:** [2017年五月26日 16:40 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/32 "2017-05-26T16:40:33Z")
Hi Sam, shall I keep it on (so our Twitter feed isn’t affected) but take screen grabs and post those here if the logs say it’s a TL0 related incident? Here’s the first lot: ![](https://global.discourse-cdn.com/meta/original/3X/7/3/7377d9a64d14bc9be5e98f7de8794393b8276f54.png) That’s the entire thread content (so title spam). Based on what we’ve seen so far, a large string on numbers (I assume tel numbers) is present in nearly all the threads. I wonder if we could use custom spam rules (actually I think XF has this feature) so certain things can trigger posts or threads to be put in the moderation queue. So for example: IF - TL0 User AND - more than 6 digits in thread title Require approval or IF - TL0 User AND - content includes more than one link Require approval or IF - User posts link to [thisdomain.com](http://thisdomain.com) Place account into moderate Do you think something like this could be handy? ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2017年五月26日 16:43 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/33 "2017-05-26T16:43:06Z")
> [@AstonJ](#): > > AND - more than 6 digits in thread title This is easily doable today, see: `auto block first post regex` , adjust it to taste! I will see if I can split that setting up so there is a seperate one for title and body… One sec, did any of the spam actually land, it is hard to tell if the fast typing would have caught it anyway. Also no idea how that is passing the built in entropy test for body. Did you disable that? ---
**Author:** ![AstonJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/astonj/32/215041_2.png) [@AstonJ](https://meta.discourse.org/u/AstonJ)\ **Post date:** [2017年五月26日 18:57 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/34 "2017-05-26T18:57:34Z")
> [@sam](#): > > One sec, did any of the spam actually land, it is hard to tell if the fast typing would have caught it anyway. According to the logs, it was caught by TL0-moderate. Previously others have been caught by fast-typing so I assume fast typing is checked first? If not I can disable our Twitter-poster and turn the TL0-moderate off for a few hours to see if they continue to get caught (probably tomorrow as the weekends are our quietest periods) - just let me know if you need me to do that. > [@sam](#): > > This is easily doable today, see: auto block first post regex , adjust it to taste! > I will see if I can split that setting up so there is a seperate one for title and body… That would be cool - there’s definitely a pattern, but it’s only in the titles at present. > [@sam](#): > > Also no idea how that is passing the built in entropy test for body. Did you disable that? I had changed them to 3 (not sure why :/) reverted now 😊 ---
**Author:** ![AstonJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/astonj/32/215041_2.png) [@AstonJ](https://meta.discourse.org/u/AstonJ)\ **Post date:** [2017年五月29日 12:41 UTC](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320/35 "2017-05-29T12:41:05Z")
Pleased to update the last spam from this group was 2 days ago 🙂 However, they do seem attack periodically - usually a couple of times a year per site with the attack lasting several days. I’ll report back if we encounter it again. Huge thanks to the DC team for all their help and their continued intense dislike of spam and doing everything they can to minimise it 👍 [上一頁](https://meta.discourse.org/t/diagnosing-spam-attack-of-100-topics/63320.md?page=1)