The war on spam has a different face, but we are about to start winning it again.

RainMotorsports

RainMotorsports

Leadership
Leadership
Joined
Mar 6, 2011
Messages
8,649
When we switched to Xenforo we ran a plugin that actually blocked 99% of our spam without any stupid Captcha's. But recently forum's have been over run by spam, including ours.

These aren't bots... They're HUMAN!

Seriously, antispam has gotten so good they have resorted to paying people in Pakistan and India to spam websites. While the majority of automatic spam still seems to come out of China, we haven't seen a single Chinese spam registration in the last 6 months. The issue with human spammers is captcha's, Puzzles, physical interaction devices are all useless.

While I have no problem blocking Pakistan for example, the rest of the spam comes through US IP's via VPN services. I don't mind blocking VPN's for registration but I don't wish to block those VPN services altogether because we have soldiers, privacy minded individuals and hell I use a VPN at work to bypass restrictions or the tethering block on my cell service.

So we have a new plugin.
https://xenforo.com/community/resources/tpu-detect-and-block-spam-registrations.2973/

It's score based. This is on top of checking a database for reported usernames, ip's and email's for spam. Additional checks available include ISP's AS name, hostname, country and checking what ports the computer has open.

40% of our spam came from Pakistan Telecom Company Limited or PKTELECOM-AS-PK as it is now blocked.
40% of the rest came from Bharti Airtel Ltd or AIRTELBROADBAND-AS-AP
The rest of it came from VPN's from places like zenmate.com via LEASEWEB-US or LEASEWEB-NET all of which will over time be added to the list and blocked entirely.

One of our usual Pakistani spammers:
upload_2015-1-24_6-20-15.png

Tried a second time using a different email which was clean on the spam database however the country and ISP are now blocked.

Good example of a person that would get through if they didn't match the spam database:
upload_2015-1-24_6-22-29.png

Already rejected due to email and IP, the AS Name was already in our plugin thanks to the author, the 2 ports open look like a web server. +3 would have moderated the guy, I changed the As to +6 and now all traffice from Choopa is rejected straight up.

Another new one but still auto rejected:
upload_2015-1-24_6-24-56.png

You can actually see in the first one (lower) his score got him rejected. However I added the AS Name before he tried again and the score went up.

One of our usual VPN spammers... blocked:
upload_2015-1-24_6-26-10.png
 
As a side note, dont be surprised if you still see spam right now. I have dialed back the stock anti spam to let some through so that the new plugin can be tuned faster.
 
Bob369963 said:
Great work Rain. They're persistent aren't they...lol
Click to expand...
Shit, I wish they would slam us right now. I am sitting here waiting on some even if they are already blocked. Been going through the old spam bans trying to pry info from the weird ones.

I do wonder if they will give up, like if they have a do not waste time on list. Probably not but at the same time with this new plugin they mind as well. They WILL run out of datacenters to get service from, we are blocking entire data centers and hundreds of hosts inside them. There are literally only so many in the world and being not home or mobile internet I am no too worried about blocking them.

All spam human and automated together we are probably 1,000 hits a day.
 
OfftheRails said:
The economics of this activity are puzzling to me.
Click to expand...

The concept behind this sort of Black Hat SEO is to increase search engine ranking for a particular site by spamming links to it all over the web. The funny thing is pretty much the day Google was invented this became just plain bad SEO. So why its still done I am not sure. Plus the fact that even my grand mother would never be stupid enough to buy anything off any of these sites being spammed. Somehow they are making money...

XRumer the bot that is responsible for almost all automated spam costs $600 dollars. Its highly effective in automatically creating gmail accounts, finding new sites to spam, and defeating captcha's. Now this makes a little bit of sense if you can make money. But humans? Even the lowest paid workers in the world seem a little expensive.

If I were China, India, and Pakistan I would drag people caught practicing this into the street and beat them to death on national television. They are ruining the internet for their country. Ordinary citizens are blocked out of thousands of sites because of spammers activities. It costs companies in those countries a lot of money in lost business. Spam would probably go down world wide 90% overnight.

I was well aware they paid people to defeat captchas manually:
http://www.theregister.co.uk/2008/10/03/captcha_break/
Bots are signing up for accounts, but the CAPTCHAs puzzles themselves are being solved in 21st century sweatshops, where workers in India are paid as little as $4 a day to defeat security checks. The images they decipher are thought to be served up to them by specialist applications for maximum efficiency.
Click to expand...
 
Great work rain. Looks like a good tool.

Sent from my Nexus 5 using Tapatalk
 
You must log in or register to reply here.
Back
Top