LeafLabs Garden

A place to share, learn, and grow...

1. 

   bnewbold
   Ex-Leaflabs

   Hey Folks,

   There has been a prolonged burst of both spam user accounts and posting over the past two weeks or so. I think this was due to our (dumb, trivial) account registration question plugin being cracked in a big way. Our normal spam filter catches 99.6% of the spam posts (according to our statistics based on false negative detection), but with the wave this is still too little. To mitigate things I added reCAPTCHA as an account registration filter, and after taking a backup first I deleted a few thousand new accounts which had no posts or comments. If any legitimate accounts got caught up in this dragnet, my apologies.

   Thanks to all the moderators who flag spam, especially though the past couple weeks!

   New list 2013/10/08:
   6162opb0ez (X1)
   9900nbo2br (X1)
   tiylhajgu (X1)
   ==== DELETED TO HERE

   Posted 2 years ago #
2. 

   bnewbold
   Ex-Leaflabs

   To clarify:

   IIRC about 40k new spam users had signed up in the previous few weeks.
   Around half of them attempted to post spam, which for the most part was
   detected and blocked. The other half had zero posts or comments. I deleted
   all the zero-posts-or-comments users (about 20k worth), but this leaves many
   thousand spammers. The next logical step would be to delete/block all users
   who have only posts marked as spam, but I don't have an easy tool to do this
   with and need to refresh my SQL-foo (this might also be a slow/dangerous
   JOIN?).

   Also, even with reCAPTCHA for new accounts there still seem to be a handful
   of new spammer account signups every day, guess they use humans or have
   cracked reCAPTCHA. The benefit of reCAPTCHA to me is that it is well
   maintained and will take active measures against complete breakage; it isn't
   even close to a perfect filter through. I re-enabled the old crappy math
   CAPTCHA as well, so now spambots need to known how to defeat both at the
   same time.

   new:
   1286pnh7sq (X2)
   1568zwi3ez (X1)
   2219ryz8sn (X1)
   2552ayb8fi (X1)
   2656dnr6ys (X1)
   2280mlo2wb (X1)
   2884fpw3ee (X1)
   3304hhh6be (X1)
   3239mby2kv (X1)
   3426wen3kf (X2)
   3500fdu8ad (X2)
   3640vnu2kh (X1)
   3711pap6je (X3)
   4113tmo2oq (X1)
   4281qqp8ko (X1)
   4455jyx9bu (X2)
   5055grk7jt (X3)
   5217rkz8ov (X1)
   5330nrj7yp (X2)
   5368rze9fw (X1)
   5593stg5vk (X2)
   6538urr0ai (X1)
   7854cnq3ml (X2)
   8316zrg7at (X4)
   8413uvs1hg (X2)
   8501gwi6wc (X1)
   8642ixk8md (X1)
   9815vch6jf (X1)
   9687haz4jz (X2)
   dy6kK8xqp (X3)
   ejfcvnbyv (X1)
   feryvdazu (X1)
   frk0e26s58s (X1)
   hqtlfrmnf (X1)
   ilcyfeyn (X1)
   js4lawhdd (X4)
   mvyyfsjqo (X1)
   nm4afe663wo (X1)
   pfpbbwqxy (X1)
   ppcfwzyut (X1)
   qgtrsdukr (X1)
   qvvcczvkh (X1)
   ru9rf84555 (X2)
   xlilrdfqa (X1)

   Updated 20131010

   Posted 2 years ago #
3. 

   StephenFromNYC
   Moderator

   @bnewbold,

   I am confused. Should we list new spam users using this new thread or on the original "Sorry about the spam" page? (Stephen)

   In the above list I incremented user "ru9rf84555" to "X2"

   Edit (gbulmer): I am listing here until told otherwise. AFAIK, all the users on the older list have been deleted.
   Edit (gb) a busy day today!

   Posted 2 years ago #

RSS feed for this topic

Reply

You must log in to post.