Our forum at http://www.openfl.org has been under attack from spam bots :frowning: What once was a quiet hamlet became pages and pages of spam. We now have discourse-akismet installed, the good news is it properly detects incoming new spam whenever it runs. With great effort, we deleted all of the older posts that already gone through. The bad news is that the spam traffic continues, while reading this post we had 20 more. Akismet is run every 10 minutes, is there something that could be done before that happens? For example, what if there was a way to detect “probable spam”, keeping a post hidden for 10 minutes or so, so there is time for it to be run against Akismet? If it is not spam, it could be shown and new post notifications could go out, no real harm is done.

Ouch - getting hit with a Bamwar is never fun :frowning: - this can go on for days… [imagen] @sam - is there any way to adjust the settings on Akismet to be more effective against this kind of spam? We’ve had a number of bamwar “campaigns” hit our forums over the years and they are a real pain to clean up after.

I’d like to know this too - Our existing xenForo install gets a fair amount of spam signups/threads every day and I’d like to have that problem go away when we move to Discourse at the end of August. Does Akismet not scan every post as its made?

Akismet has helped tremendously to fight the “wake up to tons of spam on the forums” problem You see in the image that @strager took that within the 10 minute window (before the “CheckForSpam” job is run) it continues to pile up. We have temporarily disabled new user registrations – certainly not a good long-term solution – until (hopefully?) this quiets down We did start a poll to vote for our favorite spammer: [imagen] Favorite spammer? I also have problem with spammers before and reCaptcha solved all of my problem . Just put recaptcha on registration page and not allow guest to make posts. I have experience with php, not Ruby, so can’t help with integration , but hope so this...

[imagen] singmajesty: We have temporarily disabled new user registrations That seems overly drastic. Wouldn’t a better initial measure be to require approval-by-moderator for all first-time posts?

It looks like Trust Level 0 users are checked faster than every 10 minutes… … what Trust Level are the default for your new users? plugin.rb main require_relative "jobs/regular/check_akismet_post.rb" require_relative "jobs/regular/check_akismet_post_voting_comment.rb" require_relative "jobs/regular/check_akismet_user.rb" require_relative "jobs/regular/confirm_akismet_flagged_posts.rb" require_relative "jobs/regular/update_akismet_status.rb" require_relative "jobs/scheduled/check_for_spam_post_voting_comments.rb" require_relative "jobs/scheduled/check_for_spam_posts.rb"

Instead of disabling new user signups, try using the “approve post count” setting. Set it to 1 so you have to review the first post from every new user before it appears.

Have you manipulated trust defaults or other Discourse new user settings? New users are strictly rate limited so once you add Akismet to check for human spammers (which these are) you should not have a problem. Also trust level 0 users are required to pass through Akismet before posting. We also recently added topic title as a check for Akismet so make sure you are on the latest version of our official Akismet plugin! I strongly suspect you may have changed these defaults? If so I strongly recommend you revert them to default.

I just cleaned up a bamwar on talk.commonmark.org so I have info. Here are the accounts that were used: ariel122iori@gmail.com dlcjsghk4@gmail.com argie121ikuya@gmail.com alchemy1236emori@gmail.com mingoksong@gmail.com antook1316ikuei@gmail.com aagaard1165akashi@gmail.com aakre1167akifumi@gmail.com aaker1166aki@gmail.com anacino1162aiji@gmail.com anchor1289gengo@gmail.com andrei1294genya@gmail.com ando1292genki@gmail.com andrews1295giichi@gmail.com aadland1164aiya@gmail.com andy1296ginga@gmail.com angel1298gou@gmail.com angela1299gouki@gmail.com angeles1300goushi@gmail.com annjo1312ikkei@gmail.com anthony1313ikki@gmail.com antilop1314ikkou@gmail.com antonio1315iku@gmail.com cameronbrown02@mail.com gfdhgfhg433@gmail.com jajahgdgad187@gmail.com ertetwetg78@gmail.com ttttttttttt1478@gmail.com shooipoip478@gmail.com fgdfhdh154@gmail.com jamypineda1234@gmail.com meguilapascubillo4787@gmail.com pineschuway489@gmail.com delmadela1234@gmail.com bong289balo@gmail.com durtkadurdksak@gmail.com javina111malay@gmail.com rkdskadksak@yahoo.com eocldksak@gmail.com forisj0828@nate.com tmxktkdan5@gmail.com didwodksak@gmail.com estillertricia63@gmail.com anne998ann@gmail.com raudi885dew@gmail.com jona109jo@gmail.com alona268bane@gmail.com tricia594trish@gmail.com wanda213dang@gmail.com jhoy789jo@gmail.com vip043680@naver.com p01072896066@gmail.com kalamansi123juice@gmail.com qfafafaa@yahoo.com afafafqfwqfq@yahoo.com hbt9126@gmail.com balagtas158junya@gmail.com balagyas159kadoma@gmail.com cessyah@email.com baldo162kai@gmail.com balatbat161kageki@gmail.com bernard456pot@gmail.com ldh5429@gmail.com cessyah1330@gmail.com park791212@gmail.com qkrehdrb2016@daum.net p01066037635@gmail.com yabam100@gmail.com ganutan456anthony@gmail.com 69 unique email accounts so far. Seems to be using gmail (almost) exclusively, and possibly Google auth login as well. Here are the IP ranges that got banned after deleting all those users as spammers: [imagen] Commonalities are: 210.89.162.* 211.233.* 104.131.* And that’s… about it, really, pretty good variety of IPs here. I haven’t geolocated them yet but that might assist as well. As you can see they have a lot of users and they mostly come from different IPs and unique email addresses on a legit provider which makes this more challenging. (The ultimate challenge is when they all come from Tor, but this is not that.) I went ahead and bumped up two Discourse site setting defaults to assist in blocking this kind of human spam in the future: rate_limit_new_user_create_topic: 120 (was 60, this is in seconds) max_topics_in_first_day: 3 (was 5) These should only affect TL0 users, but we do prevent first day new topics in total for the first 24 hour life of the account.

[imagen] codinghorror: @gmail.com Hmm, maybe someone found a way to bot Google account signups, sold a batch of “clean” accounts to the spammers, and the spammers were using the Google OAuth to sign in without going through the email confirmation. Yeah, looks like these guys love Google accounts: https://www.stopforumspam.com/ipcheck/213.229.75.30 (! that IP was not included !)

Our forum is getting "bamwar" spam

Product Support

riking (Kane York) 30 Julio, 2015 17:22 4

Should we add a “delete spam” bulk action? So you could clean it all up from the topic list.

Tema		Respuestas	Vistas
Diagnosing spam attack of 100 topics Feature	34	3525	29 Mayo 2017
Blocking recent wave of spam Product Support	20	1118	29 Julio 2025
Lots of Spam New User Registrations? Product Support	42	6343	7 Abril 2020
Need assistance with massive amounts of spam Product Support	13	2352	10 Junio 2023
Stop Forum Spam - Spam Countermeasures Feature completed	21	13610	22 Junio 2019

Our forum is getting "bamwar" spam

Temas relacionados