Read This-PM Problem & Spambot Update

I would consider blocking all countries that aren't the U.S. and Canada (with a couple of exceptions if known members are from a certain country).
I don't think we have anyone on here from China or Thailand, but.. that's where a lot of spam comes from, so......

Also, consider limiting PM rights to actual members by restricting that ability to members with 3 to 5 posts as a minimum before that permission kicks in.

http://www.vbulletin.org/forum/showthread.php?t=168305

[admin]

Originally Posted by Skyway Scott

I would consider blocking all countries that aren't the U.S. and Canada.

Seems like a lot of this is from China.

Thanks for your input Scott. Just had some upgrades and additions added to the site. One is minimum number of posts before being able to PM. I usually catch the spammers after the first post or so. We have a lot of members from various countries other than the USA and Canada so limiting to those areas would a problem. Hope this fix works.

Hope it helps. Limiting PM privileges to a certain number of posts is the least techie and probably most effective step in this case.

Thats one way, or monitoring the number PMs to different people at the same time.

For example, PM's sent to 5 people in one day containing a url, account locked for review due to suspicious activity.

You could do this with a simple cron job and a script with a few queries on the database. Query the PM timestamps count(*) group by date,userid. 5 in one day, update users table and lock the account.

Or, you could just do the obvious. Only let people register with a real name.
Only activate their account after you have validated their identity, and sh.t can all the obviously fake acc'ts about lovingcialis, playingpoker, and buyingviagra. LOL.

Spambots can theoretically be a nightmare, but without admin activation, they are pretty powerless.

[conchxpress]

How do the spammers use other people's already existing forum names? I talked to a few people that got the same porn video, but each PM was sent with a different name.

[ricki]

I am not sure. The site has had extensive updating today. Since the updates went in I haven't noticed what I have learned to interpret as activity by this particular bot. Fingers crossed as I am about to turn PM's back on.

NOTE: IF YOU RECEIVE PM'S WITH SOMETHING LIKE THE FOLLOWING IN THE SUBJECT LINE:

"Have You ever seen this website....."

then JUST DELETE IT, DON'T OPEN IT.


Hopefully this pest has been closed out but I wouldn't be astonished to learn it managed to send out a bunch of spam via PM BEFORE I shut down PM's on the site.

Thanks for your help and patience.



PM's ARE NOW BACK ON