Organized Crazy Addicts

LeeBe · Posted: Thu Nov 30, 2006 10:16 am Post subject:

by making dumb posts you silly spambot

roba · Posted: Thu Nov 30, 2006 10:30 am Post subject:

Heh I think I already killed them on WGF, so I guess its time to do it here too. Razz

Tempus · Posted: Thu Nov 30, 2006 7:36 pm Post subject:

Hey if you have a way that completly kills them can you let me know.
The catforum I admin is plagued by them.

Zed · Posted: Thu Nov 30, 2006 8:11 pm Post subject:

roba · Posted: Thu Nov 30, 2006 10:01 pm Post subject:

Yeah I was doing that, but these bots are incredibly smart. They were able to adapt. Even if was renaming fields in form, they adapted in like few hours.

So I tried to create new fields and give them dynamic names (based on host IP etc.) and bots adapted in hours as well! Shocked

Either this software is really really good, or that company has ppl updating their bots 24/7.

Last trick I tried to them was new hidden field in register form, that didnt work earlier, but this time I made it via JavaScript - so bot without JS engine cant see it. So far it seems bots did not figure it out. I woll post details how to do it if it lasts for few more days at least...

Zed · Posted: Fri Dec 01, 2006 12:13 am Post subject:

roba · Posted: Fri Dec 01, 2006 10:19 am Post subject:

I have seen info about that forum spammer soft and author claimed he can read like 20 different image verifications, including all Ihave found on phpbb.

I guess there is more spambots, more and less advanced. We get less spam here too than on WGF- those on WGF are tough.

Here: http://www.botmaster.net/pictocod/

Sardukar · Post more Noob Joined: 08 Aug 2002 Posts: 14

I have written a PHP application called SpamNailer which I am about to start selling, but will install it on friends sites for free of course!

It is a PHP-based spam filter that can be installed on nearly anything that resembles a forum (a forum, a guest book, a blog, Kayako eSupport etc.).

I have set up a lot of dies with some companies like Outblaze who build blacklists of IP addresses of spammers, compromised hosts (that spammers abused) and most impotantly, URLs of spamvertised web sites. The script will use this and some other methods to detect and reject spam posts.

Maybe you'd like to beta test it?

roba · Posted: Tue Dec 05, 2006 3:06 pm Post subject:

Depends what it does, I need something which wont let them register, then they cant spam.

It seems that JS keeps them away from WGF for now, but ofc its just matter of time until they improve their bots to understand JS too.

Problem is that they are unspottable. They use realistic user agents and switch them for each session, they are run from normal home/office internets, they accept cookies, properly use http referes, keep delayes between requests, they even follow classic hp->reg path on website like real user would do. IMO without any special tools (Java, flash..), they are now completly unspottable. From server side they look like normal user.

Later when they spam I guess its possible to spot it like email antispam filter works, but that is kinda late for forum. So I guess only way to stop them is to break their programming by adding checks/whatever to confuse them.

Sardukar · Post more Noob Joined: 08 Aug 2002 Posts: 14

Well, for FPC protection (first point of contact), the IP is checked for, on entry on any *.php page you define:

1) Known spam operations / spam runners who have purchased new hosting accounts
2) Spammers
3) Comprimised hosts (i.e. systems and servers running viruses that are abused by spammers)
4) Block list of open proxy servers

And 404d if found according to the agression setting.