You are not logged in.

#1 2018-08-19 15:26:22

levi
Moderator
From: UK
Registered: 2018-06-16
Posts: 201

The prevalence of spam users

I've checked out a few of the new user names that seem to frequently change at the bottom of the index page of this bbs.  A lot of them seem to feature a similar setup; an email address in the .pw domain, and a suspicious link in their signatures.  I've not seen one yet post, but I think they're involved in a little link farming, and probably aren't even real people.  Other forums I've used generally ban new users from making links, but in our case matching against a .pw email address seems a pretty damn high correlation to these link farmers without hitting many if any real users.

By the way, I couldn't find a good subforum for this kind of discussion.  If a mod wants to move it, I won't argue.

Last edited by levi (2018-08-19 15:27:08)

Offline

#2 2018-08-19 18:22:48

levi
Moderator
From: UK
Registered: 2018-06-16
Posts: 201

Re: The prevalence of spam users

The past two I've spotted have used .gdn and .club TLDs, but they still have a deep link as their homepage and the same link in their signature with a very similar pattern, suggesting these are all the same attacker.  I guess if they're not actually interrupting our discussions with spam posts that's a reason to leave them be, but if they're link farming and trying to achieve SEO then I guess that affects us all sooner of later.

Offline

#3 2018-08-23 00:41:04

levi
Moderator
From: UK
Registered: 2018-06-16
Posts: 201

Re: The prevalence of spam users

Digging through the user list quickly, it seems this started around the end of March.  There are 28 pages of users out of 36, that seem to be very majorly full of link farmers, at the very least 90% meaning that 70% of the users (which currently stands at 1756; 1229 users at 70%) are spammers.  The user list seems to still count banned users though, so a certain proportion of those are already caught spammers.  It's worth mentioning that those banned users retain their profiles including the links to their homepages (although their signatures disappear), and while they're unlikely to be stumbled upon by users given they have no posts, they still count towards their pageranking presumably.

I'll also mention that these users don't seem to be consistently promoting specific links.  I guess they're probably linking to sites containing zero day exploits to try to hack into our browsers - the one I tested seemed to have been taken down already, although a lot of them do seem to hint as to be being about social issues like housing and health, so perhaps they're trying to connect stray google searches to these sites also.

Offline

Board footer

Powered by FluxBB