Email in This new user tried to create multiple posts with links to the same domain

(Carlo Kok) #1

Did something change here for email? I had a user just blocked by the system as spam (got 20 different emails for it too for individual posts) because he used email in and had linkedin, facebook, twitter, his website, etc all in the email footer. (All these posts were several days old, some 24 days and this just hit last night)

(Carlo Kok) #2

Related: How do I un-hide the top post that is light gray now? I already set the 4 flagged posts to “don’t take action” but it still shows as light gray.

(Sam Saffron) #3

Sorry not following, is this an issue on or your instance?

(Carlo Kok) #4

Sorry if I wasn’t clear. It happened on my own system. It seems that a user emailed last night and his post had several links in it (just like his past posts). Discourse scanned all his previous posts and flagged those, they also had multiple links. I got 1 email per domain per post he made:

This new user tried to create multiple posts with links to the same domain ( See the newuser_spam_host_threshold site setting. 

(Already increased that one)

My question is, is this a new check and why does it scan historical, like 24 days old posts?

(Matt Palmer) #5

Was the post actually there 24 days ago? The e-mail system uses the date on the incoming e-mail to set the date/time on the post, so if the e-mail got held up, all the posts would turn up in the system together, but they’d appear to be from 24 days ago, according to the UI.

(Sam Saffron) #6

This is very strange, we need to look at it that check should only apply to the first 24 hours after the user made their first post.

Can you repro this somehow?

(Carlo Kok) #7

The first one it hit was from May 10th (which is even further away), there was no update on that post at all since may 11th; I got 3 emails for that

[RemObjects Talk] "RemObjects SDK for Delphi and Indy upgrade" was flagged as spam

1 for each domain in the originals email footer.

The 4th email is:

The new user ***  tried to create multiple posts with links to www.user ***,,,,, but those posts were blocked to avoid spam. The 
user is still able to create new posts that do not link to www.user ***,,,,

(*** indicating a private domain from that customer)

What triggered this is however a mail from about 7 hours ago (around the time this time started) on a completely separate thread.

It doesn’t look like this user ever logged in, only used email to communicate with our forum.

The user was created may10, but was still set to “new user”, status wise.

(Carlo Kok) #8

Not sure, I can post the email that triggered this privately though if needed.