Welcome to the MacNN Forums.

C.A.T.S. CEO · Apr 13, 2007, 02:16 PM

Can we get rid of these guys? like that guy who posted 3 times in the Lounge. Are these spambots?

Thanks

Oisín · Apr 13, 2007, 02:19 PM

Bah, they deleted the threads before the guy could see my insult to him

Also (I posted this in the spam thread, but when I hit post, the thread was gone), did anyone notice this slight incongruity-slash-anachronism in all Dakarzh’ posts in those threads:

How the?!?

C.A.T.S. CEO · Apr 13, 2007, 02:38 PM

interesting.... could you explain this demonhood?

Dakarʒ · Apr 13, 2007, 02:39 PM

I feel like God right now.

C.A.T.S. CEO · Apr 13, 2007, 02:42 PM

it seems that the "last edited by Demonhood at 8:59 AM" appers in all of Darkars posts

Dakarʒ · Apr 13, 2007, 02:44 PM

He has a grudge.

C.A.T.S. CEO · Apr 13, 2007, 02:44 PM

Originally Posted by Dakarʒ

He has a grudge.

as it would seem

Gossamer · Apr 13, 2007, 04:22 PM

But Dakar, however did Demonhood edit your posts before made them? I am in the dark, and not able to figure this out!

Dakarʒ · Apr 13, 2007, 04:26 PM

It's a server glitch. That's why it keeps repeating the same time.

mduell · Apr 13, 2007, 04:56 PM

Over a dozen spam threads in the Consumer Hardware forum earlier today.

Dakarʒ · Apr 13, 2007, 04:57 PM

If they were taken care of, they know about it.

Oisín · Apr 13, 2007, 05:41 PM

Originally Posted by Gossamer

But Dakar, however did Demonhood edit your posts before made them? I am in the dark, and not able to figure this out!

Oh, right... didn’t think of that...

Demonhood · Apr 16, 2007, 01:16 PM

my powers are vast.

also, there's no need for a thread about spam. just hit 'report post' and we'll nuke it.

turtle777 · Apr 16, 2007, 02:31 PM

Originally Posted by Demonhood

my powers are vast.

vreaky

-t

Peter · Apr 16, 2007, 03:03 PM

report 'em plaz

besson3c · Apr 16, 2007, 03:04 PM

Demonhood: do these spammers post from a wide variety of different IP addresses? I've never understood why you guys don't simply start blocking IPs... Sure it's an imperfect solution, but a decent deterrent, as it shouldn't take more than a few seconds to drop a new IP into your ruleset, right?

I bet it would also be a much more effective way of dealing with human being ban-evaders such as Rob.

This would at least help deal with the bleeding...

Peter · Apr 16, 2007, 03:15 PM

different IPs. We do block some IPs, but only if its a repeat spammer and we're 100% sure.

besson3c · Apr 16, 2007, 05:15 PM

Originally Posted by Peter

different IPs. We do block some IPs, but only if its a repeat spammer and we're 100% sure.

I was fully expecting they'd post from different IPs, but approx how many? Reason I ask, is because a lot of scripted attacks to our web applications seem to come from compromised accounts compromised via keystroke loggers.

What about for ban evaders, have you IP blocked?

Person Man · Apr 16, 2007, 06:02 PM

Originally Posted by besson3c

What about for ban evaders, have you IP blocked?

The big problem is that for ban evaders, there's too much possibility of innocent people being caught.

What do you do? Ban everyone from Comcast? AOL? Earthlink? Not as easy to do.

Peter · Apr 16, 2007, 06:13 PM

Originally Posted by besson3c

I was fully expecting they'd post from different IPs, but approx how many? Reason I ask, is because a lot of scripted attacks to our web applications seem to come from compromised accounts compromised via keystroke loggers.

What about for ban evaders, have you IP blocked?

Usually we'd only IP ban a spammer if he's made over 2 accounts from the same IP and spammed from both.
Not sure if i can tell how many IP bans we have.

besson3c · Apr 16, 2007, 06:22 PM

Originally Posted by Person Man

The big problem is that for ban evaders, there's too much possibility of innocent people being caught.

What do you do? Ban everyone from Comcast? AOL? Earthlink? Not as easy to do.

You don't block an entire subnet, but individual IPs... most IPs seem to go for sticky DHCP leases these days, so it would be semi-effective. As long as the admins were alert and available, it should take them much less time to add an IP to their blocklist than it would for a ban evader to obtain a new IP, thus frustrating them and giving them less incentive to continue.

besson3c · Apr 16, 2007, 06:24 PM

Originally Posted by Peter

Usually we'd only IP ban a spammer if he's made over 2 accounts from the same IP and spammed from both.
Not sure if i can tell how many IP bans we have.

I think it would be better to do this at the firewall level (sounds like you are doing this at the software/application level). My making the server basically disappear to the attacker, it should take the wind out of their sails, no?

C.A.T.S. CEO · Apr 17, 2007, 05:08 AM

OMFG, check out the iPod forum, ad lest 2o spam threads in there

Peter · Apr 17, 2007, 05:44 AM

'scone