# Only allow user profiles for TL1 and above?

**URL:** <https://meta.discourse.org/t/only-allow-user-profiles-for-tl1-and-above/21436>\
**Category:** Feature\
**Created:** [October 22, 2014, 10:37pm UTC](https://meta.discourse.org/t/only-allow-user-profiles-for-tl1-and-above/21436 "2014-10-22T22:37:47Z")\
**Posts on this page:** 1\
**Showing post:** 53

<div class="post-metadata">

**Author:** ![jeffwidman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jeffwidman/32/105515_2.png) [@jeffwidman](https://meta.discourse.org/u/jeffwidman)\
**Post date:** [February 15, 2015, 12:11am UTC](https://meta.discourse.org/t/only-allow-user-profiles-for-tl1-and-above/21436/53 "2015-02-15T00:11:34Z")

</div>

I recently spent about a week cleaning up a ton of spam on a forum I purchased. This was from SMF software, not Discourse, but I think the patterns might be useful for building spam heuristics.

Telltale signs of spammer:

1. They use a lot of '.'s in a gmail address. Basically they can have one spam gmail address and register 50 accounts by randomly sprinkling periods throughout. This is a little tricky because legit users sometimes do the same thing with [susie.forumname@gmail.com](mailto:susie.forumname@gmail.com)  
So I ran a regex to remove all periods and anything after the “+” sign, and then GROUP BY email address and anyone with more than three accounts tied to the same gmail address got nuked. This is a gmail specific tactic, but it wiped out 10K spammers for me. This particular forum allows users to have multiple accounts, so I allowed users who had two accounts tied to the same email to live.
2. Users linking to the same url. Required manual inspection again, but there were 4 urls out of 100 that were legit. The other 96 urls were clearly spammers who’d created multiple spam accounts linking to these sites.
3. Anyone with a url in their description/about me/homepage/any text box was worth doublechecking.
4. Spammers often copy/paste “location”… found a lot of accounts sharing the same typos even. Example “location field = ‘United STates’” A simple SQL group by on location flushed a lot of these out, but I still had to manually review just in case.

For all these tests, I doublechecked that none of the accounts had any PMs or Posts–if they did I manually reviewed the account to verify my filter wasn’t catching spammers.

Other random comments:  
I do agree with @codinghorror above that I’d rather give spammers a chance to expose themselves, which means letting them enter profile info.

Google does crawl plain text urls, even non-hyperlinked ones. Excluding through robots.txt makes a lot of sense.

I would never delete inactive users unless they were verifiably spammers. I can personally attest to being one of those users who’s signed up for a forum account, never posted, and then returned years later and started using the account.

Similarly, most forum owners I know would rather have more accounts than less and so would _never_ delete inactive users. A potential forum buyer will generally pay more for more accounts even if they’re inactive. A sophisticated buyer will ask you to run a few SQL queries to see how many users are actually active, but most won’t.

---

_[View the full topic](https://meta.discourse.org/t/only-allow-user-profiles-for-tl1-and-above/21436)._