[Chucko]

I just reported 3 linkspam posts in the EEC Geeks forum.

Why is it that every phpBB forum I've seen takes you back to the offending post after you report it?

[dualdj1]

that's been a big problem on forums i run too. Hopefully they figure out a better way to handle spam down the road. I've just been banning email addresses for the last year or so ><

[cgrey8]

We already have a customized registration page which stops the vast majority of BOTs from registering. But it doesn't stop humans from registering to be spammers. But when they do post, I block their IP range that they registered from. Hopefully that stops at least that particular spammer. Although it could inadvertently block innocent users that happen to be connecting from the same locations the spammers are using to register from (e.g. hot spots in restaurants, libraries, etc).

[dualdj1]

i've found the best way is to block emails by domain. as long as it's not a major domain, it's pretty safe to block. unfortunately it takes a while to build up that list. ex. *@iamaspammer.com

[cgrey8]

The problem for us is the VAST majority of spammers are registering with @gmail.com, @yahoo.com, or any of the other major freebie email domains of which we have lots of legitimate users using as their only email address. Back when I had those domains blocked, I was regularly getting emails from people from those email domains asking to be manually registered since the automated registration wouldn't work for them. Since then, Jon's made the changes to the registration page so we get far less spammers than we did 2 years ago. So for the little bit of spam we get, I'm content just to handle it on a cast-by-case basis and block them using IPs. If spamming was like it used to be where I was deleting 20-30 spam posts a day, then I'd reluctantly be back to blocking those major domains as well as sweeping IP range blocks from foreign countries. But today, I delete a spam post once a month maybe.

[vristang]

May be a sensitive subject, but have you guys considered moving to SMF software?
They seem to do a pretty good job with security updates...

[cgrey8]

It's not really my call. I don't have control of the site server in any way. That's 100% Jon's domain there. All I have access to is the admin framework within the phpBB board itself. To change over to another board technology would require Jon to do.

And I don't know if other boards can consume a phpBB's database so all the existing posts and discussions carry over. If they do, that sounds doable. It's just a matter of getting Jon to do it. And being he's not really an active member of the forum anymore, I'm hesitant to bother him with too much related to this site unless its absolutely necessary.

[vristang]

Supposedly, there is an 'converter' software. I haven't used it though...
I use SMF for a local board I started a while back, and have had good luck with it... I haven't updated in a while, which is why I have to manually evaluate all new members for approval... about 5-10 for my little board.

http://download.simplemachines.org/?converters

I would be very eager to help in any way I could...

[dualdj1]

Thanks for the info. I had heard that newer versions of phpbb were better for spam prevention, but unfortunately the boards I host are so hacked/customed that I haven't upgraded yet. and my email block list has gotten solid enough that i don't get that much spam. But I'm always open to new ideas/products, so will check it out.

I know for here, Jon was developing a new system from scratch, but I haven't heard back from him on it since last year. I know he was real busy at work at the time, so it may have gotten pushed off his plate.

[EDS50]

You know what else is annoying to me...lol All the freakin registered users that have never made a reply and advertise their website they want to direct you to in their profile. I come across them everyday. Why do we have to share our valuable server space with them....lol.. For real though, I wish Chris would delegate this job to me...

[cgrey8]

Jon gave me admin rights, but as of one of the phpBB updates, there seems to be different levels of admin access. I don't have the same level that Jon has. Email him and see if he'll give you the access you need to prune the user list of users that never post. Occasionally I delete users that have never activated, but I've never taken the time to prune users based purely on whether they've posted or not.

[EDS50]

Jon gave me admin rights, but as of one of the phpBB updates, there seems to be different levels of admin access. I don't have the same level that Jon has. Email him and see if he'll give you the access you need to prune the user list of users that never post. Occasionally I delete users that have never activated, but I've never taken the time to prune users based purely on whether they've posted or not.

I hope I didnt ruffle your feathers with my reply as it was not intended to. I just hate having to bother you all the time by pm'ing you with my findings and having to waste your time with the pruning....

[cgrey8]

No offense taken. I'll PM you with specifics...

[dualdj1]

Keep in mind though, that there are a lot of users here that don't hardly post and just read the info. *generally* they post a "hey i'm new to the site" post, but not always. I don't know that you want to cut them off.

[EDS50]

Keep in mind though, that there are a lot of users here that don't hardly post and just read the info. *generally* they post a "hey i'm new to the site" post, but not always. I don't know that you want to cut them off.

Nah, I am only interested in weeding out the ones that have website redirections as their hobbies or signatures or come on here making threads that try to get you to click and go to another spam filled site and offenders of similar nature.

[dualdj1]

yeah that's what i figured

[cgrey8]

Well, the days of the forum getting spammed seem to be back. I don't know why, but today, the site has gotten absolutely slammed by spammers. EDS50 and I have been deleting spammers almost all day. We can't keep up as fast as they are registering so unfortunately, I've had to pull a play from history which is to implement a WIDE sweeping ban on foreign IP addresses. This unfortunately tends to hit the innocent foreign members that are Ford enthusiasts. To handle them, the best I can do is wait for the emails to come in and unban their individual IP ranges as we learn them. That seems far more manageable than trying to keep up with the barrage of crap hitting the forum.

I'm letting Jon know so he can look into updating the forum software and possibly come up with a more elaborate user registration "filtering" system that will hopefully be more effective. In the meantime, I'm hoping the IP ban is effective. We'll see...

[EDS50]

We will just have to keep up the goo fight.

[Jon 94GT]

Hey guys, I got notice that we were getting flooded with crap again. I have added a couple different catches to the user registration which *should* stop this recent influx if it is a bot that is doing it.

[cgrey8]

I removed the IP bans now that Jon has some additional registration "challenges" in place to help avoid the spam bots. We'll see how long these hold out.

At least from the past few hours, we can see that the sweeping IP Bans seem to be effective so if the site gets hit again, they can be easily put right back in place. And if any legitimate users are being affected by the IP bans, email/PM me your Internet IP address so I can get it out of my IP ban list. If you don't know what your Internet IP is, you can go to a website called WhatIsMyIPAddress.com to find out.

[cgrey8]

Well, that didn't last long. Already, we have another spammer on the site that had to be deleted. So the IP bans go back up until Jon can look into it further.

[EDS50]

I am on it as well and processing them as they appear.

[cgrey8]

The one I deleted was actually reusing an old account created earlier today. As I delete the posts and ban the emails, I'm also changing the passwords of the accounts so they can't be used. I must've missed that one. Once the IP ban was lifted, it was all too easy for the spammer to reuse an already-existing account. Now that the password is changed, we'll see if any NEW spammers get through.

[EDS50]

I have also been banning their usernames, emails and ip addresses.

[dualdj1]

I wish someone would develop an active registration blacklist. (ie you become a member, flag someone, and it updates the master list). Unfortunately it just looks like you have to keep updating your list manually.

A quick search gave me this site:

http://www.sumbit.com/phpbb_spam.htm

I'm guessing it'll take care of a good portion of the spammer domains and emails.

[vristang]

On my local board... I have the new members set to require staff approval before activation.
Before I approve any accounts, I run their IP, screen name, and email through this search....
http://www.stopforumspam.com/search

hope it helps...

[cgrey8]

The new filter seems to be working pretty well now. However my fear in activating the admin approval for everything is that us admins would get swamped with hundreds of new user requests with 1 or 2 being legit. Filtering through all that seemed just as daunting as deleting posts and users after the fact.

[dualdj1]

The new filter seems to be working pretty well now. However my fear in activating the admin approval for everything is that us admins would get swamped with hundreds of new user requests with 1 or 2 being legit. Filtering through all that seemed just as daunting as deleting posts and users after the fact.

I agree here. With the number of spam registrations I get, it's easier to be reactive instead of proactive. I still may take up the call to build a blacklist mod though, if i get some free time one of these days...

[Jon 94GT]

I think what we are doing currently is working well enough. It is a cat and mouse game with the spammers, the catches I put in place are absolutely crackable, and quite easily actually.

A spammer needs to be both technically proficient enough to figure out my little stumbling blocks and also willing to spend the time to figure it out. They broke my last one, and this one is similar to the old one...but different enough to stop them. I have additional tricks I have in the event they completely 'break' the current method in place (which is totally possible...I can think of a way it can easily be done...and I am honestly confused as to why spammers don't do it).

[cgrey8]

It seems here recently, the spammers have gotten even more sophisticated. What's odd is what they are doing obviously takes a bit more involvement than just BOTs dropping new spam posts. The new generation of spammer replies to existing posts with links in their signature or weird links within the text of what they are writing, which often on the surface seem like legitimate posts, but don't actually contribute anything useful. The most recent spammer was one claiming to have a link to fix issues with the Borland Database installer on Win7/10/11. But the link is clearly a spam link, not anything legit.

If I had to guess, the "new era" spammer is incorporating GPT technology into their techniques, getting a sophisticated chat-bot to concoct reasonable enough responses that also happen to include their spam link. I don't know that this is their technique, but I suspect that's what they are doing.

As is the case with ANY link you encounter whether its through a forum like this or through email (especially through email), treat it with suspicion. There are bad actors casting webs of deceit just waiting for someone to get caught by it that they can exploit.

One of the most annoying recent hacks is seemingly legitimate seller websites that have real product listings/descriptions/pictures and often for just a little less than anybody else on the Internet. These sites even implement a shopping cart for you to load up "purchases" with, and when you checkout, they offer you convenient links to pay with...that should link to places like ApplePay, GooglePay, and PayPal but instead link to imposter sites that look and respond JUST LIKE the site you expect so that you'll enter your credentials. What's made these so successful is the legitimate site's practices of using popups (looking at you PayPal) to keep you on the checkout-page you were on, but do all your payment-authentication with them via a popup which often does not display the link to the PayPal website in the popup for you to know whether you are interacting with the genuine article or an imposter. And even if it did, the imposters could spoof a picture that looks like a URL of the real site so you wouldn't notice. And just to put you at ease and not raise suspicions (in order to give them more time with your info), you'll get a confirmation email from the website you made your "purchase" with, but what you ordered never shows up...and you start getting notifications from your CC company that fraudulent activity is being detected.

It really is a shame, but it is getting to the point where you are taking somewhat of a chance with any website you don't have an existing relationship with. Thus new startup companies that are legitimately just trying to run an online business get hurt by this since people learn not to trust them and opt for the big .coms like eBay/Amazon/Walmart.

At the moment, I don't have an easy answer for you other than to never use a Bank Card for anything but ATM interactions. ALWAYS use a Credit Card (CC) for online transactions. At least then if your CC numbers get compromised, it's the CC company's money they've gotten, not your personal bank account that you rely on to pay your bills with. And while most banks will return whatever you've lost once its been reported, that often takes time and that's time you don't have access to YOUR money. Most CC companies do not hold you responsible for fraudulent activity on your CC as long as you get it reported as soon as you recognize it.