Can you consider implementing 'cap' on this forum?

23Sha-ger

There is lots of spam and it takes time to remove it.
This framework, since its relatively unknown, uses PoW
JS test to check for a real browser. Might be enough just
for registration. Otherwise sometimes the forum looks like
a total mess with all the bots.

de0u

23Sha-ger I think the moderators have said that they plan to use only extensions on the "Friend of Flarum" list (which is short). Is this one of them?

de0u

23Sha-ger There is lots of spam and it takes time to remove it.

Seems as if our intrepid moderator team has caught up with the miscreants. 🎆 🎉

admin

23Sha-ger The spam is being posted using real browsers with JavaScript support whether it's done by bots or humans. Most of the spam which gets through is also very clearly being done by humans, not bots. The only thing which works for a while is banning the IPs for registration. We participate in a cross-forum system for banning them:

https://www.stopforumspam.com/

The recent spam appears to be specifically targeted to this forum and therefore the IPs haven't already been added to the registration IP ban lists we obtain from Stop Forum Spam.

23Sha-ger

de0u
Nope, still appearing. Personally I don't care, they can advertise underwear
as long as they want to. This just doesn't look professional for a security focused forum.

admin

23Sha-ger Our forum has skyrocketing engagement and search rank so it's a high priority for the spammers. The spam is usually removed quickly and a lot is caught by the automated filters. An actual captcha would not stop much of what actually gets through because it's being done by humans. They can work around whatever is done because they're humans. They cycle through dynamic IPs and use VPNs so the IP banning helps but is far from a solution. We could largely solve it by entirely banning certain VPNs, Indian mobile ISPs, etc. but we don't want to start banning hundreds of millions of people from registering on the forum because of this.

nandohyphen1

admin it must be hard work keeping all that spam away! Appreciate everything that's done to keep it minimal. You guys do a great job running the forum! ;)

DeletedUser433

admin Hello, I appreciate your engaging with us on this matter. I was wondering if you had any plans to implement a block feature to hide posts from spammers even if they hadn't been banned yet?

DeletedUser622

I strongly dislike captchas.

admin

The only service we have without IPv6 is this discussion forum because we had to turn it off due to Stop Forum Spam not having good data for IPv6. Most forums don't have IPv6 and therefore the Stop Forum Spam data for IPv6 is much worse and it was a huge hole in the system. The only way we could enable IPv6 is setting up registration to force IPv4 so the IP blocking still works. It's something we can theoretically implement but it would involve some work and is not worth the effort right now.

23Sha-ger

Blacklists don't work, if you want some insights I can even tell you which software they are using,
to make this spam account. Its called Xrumer from Botmasterlabs.
This is not a "targeted spam" or whatever. Just because you don't have any countermeasures.
Anyway if you are not interested, it's not my issue.

Sevv

23Sha-ger
sus

MetropleX

DeletedUser433 They're (admin) currently engaged however we're looking into options available to mitigate and discussing them. Until then we as a moderation team are reacting as swiftly as possible to reduce the inconvenience.

userofgos

MetropleX thanks for your hard work. These spammers are fast. Just reported 8 newly created spams posts of airline phone number lists.

DeletedUser433

Afaik the anti-spam filter usually works pretty well but no system is perfect, it's normal to have an occasional spike in spammers so no worries

ejns

userofgos
I'm a bit baffled about what they're gaining by spamming this stuff.

DeletedUser433

ejns Probably just for the attention. That happens when one has too much free time

linux-dev

ejns
It is possible, that they are posting this to manipulate search engine results. E.g. you could post wrong phone numbers along with the texts, if there are enough references on websites search results may present those numers along with the text. Now Image the phone numbers are false and instead of leading to e.g. lufthansa service to a scammers phone. A lot of campains nowadays attack search engine results or data for AI training in order to inject bad data.

de0u

linux-dev It is possible, that they are posting this to manipulate search engine results.

Yup.

https://abcnews.go.com/GMA/Travel/man-fell-travel-scam-rebooking-united-airlines-flight/story?id=124873491

JayJay

My experience is that from signup to being able to post or activate account should be 24-48 hours.
And if also implemented the way that once you do your first post, receive an email with a link to verify/activate first post then it should be very effective.

de0u

JayJay My experience is that from signup to being able to post or activate account should be 24-48 hours.

That might help filter out some miscreants, but it would be pretty troublesome for people whose devices are in a boot loop or people who are stuck during an installation.

JayJay And if also implemented the way that once you do your first post, receive an email with a link to verify/activate first post then it should be very effective.

I think this fake-airline-phone-number spammer would have waited 24 or 48 hours and clicked that link.