Talk:War on spam

Spam

On the recent spam bot from Odessa, Ukraine, IP 85.255.120.###

I guess it's a spambot/skiddie.

If you google for one of these IPs, google spits out a lot of infected sites.

Maybe Alloc can set up a word filter for the wiki.

See also http://www.stopforumspam.com/forum/f1-General-Discussion for other ideas.

Ssg 11:22, 6 February 2008 (CET)

---

An obvious fix for that is to protect the whole wiki, i.e., only authorize edits by registered users.

Then there's the obvious escalation: smart bots that register tons of dummy accounts and post through these; these are rather nasty.

We certainly have a lot to learn from other wiki runners, and in particular from Wikipedia folks: they have lots of scripts that try and outsmart those smart spam bots.

There are other solutions that can be implemented for communities such as ours. As the coadmin of seriousengine.com, I've been confronted to the smart bots lately, and the basic idea is to authorize only those users who also have an account on the community forums (in our case, that would be Oni Central Forum), or users explicitly authorized by an admin. This basically boils down to a privately-edited wiki, with a "closed" group of edit-capable users, to which spam bots can never access. I'll keep you up to date on the solution being implemented at seriousengine.com

geyser 17:17, 6 February 2008 (CET)

---

That spambot is still annoying. Are there any upcoming defence steps?

Ssg 17:29, 9 March 2008 (CET)

Oh, it's not all that annoying. "You ain't seen nuthin' yet..."

As long as we only have this one "pet", I'd do nothing at all.

Protecting pages, or the whole wiki, can lead to escalation...

geyser 18:00, 9 March 2008 (CET)

---

Beans and spam

I see that we're still getting vandalized. Really, is barring anon edits a bad thing? I know there's the possibility of bots registering and then editing, but we can easily stop that with capchas (hopefully not the really hard kind, even I can't do those, and I'm more or less a human being!). Let's not be held back by fear, from trying to fight spambots. Remember, the only thing to fear is fear itself. And clowns. Fear and clowns. --Iritscen 16:07, 28 March 2008 (CET)

I investigated a bit on http://www.getnet.com/cgi-bin/trace? and http://logbud.com/ip_whois...

That guy use a proxy network.

IP             86.96.226.15
  Leads to:
Country        United Arab Emirates
City           Dubai
Organisation   Emirates Telecommunications Corporation

Keywords on that side:	ETISALAT, EA1251-RIPE


ETISALAT and RIPE 
  Leads to:
IP             213.186.116.247
Country        Ukraine
Organisation   UTEL Internet Services
mnt-by:        AS6877-MNT

By the way, AS means: autonomous system [AS] (numbers)

IP             200.216.186.35
  Leads to:
Country        Brazil
Organisation   Telemar Norte Leste S.A.
aut-num:       AS7738

AS7738
  Leads to:
IP             213.186.116.247
Country        Ukraine
Organisation   UTEL Internet Services
mnt-by         AS6877-MNT

--Paradox-01 17:52, 28 March 2008 (CET)

Are we definitely of the opinion that this is a bot and not a person? I mean, I thought spambots were supposed to, you know, advertise something, like posting links to places you can buy V**gra. But I have heard that a lot of spam comes from Russia/Ukraine... --Iritscen 17:55, 28 March 2008 (CET)

Well, the spam came from the same country but from different sources. The first was most probably a bot.

But the second is still unclear. "He" deleted a section and left one address at first (look up history, get address and insert it on http://logbud.com/domain_whois, surprise: that side is hosted in the USA). Then he came back to delete the same section. Just strange. In both cases he left an additional signature: "dH0cf7" and "HfpZ3o sd89f984q34slf". Do you ever seen text like this?

--Paradox-01 18:37, 28 March 2008 (CET)

Yeah, I did see that address, but I forgot about it. And I did see that strange text. I don't recognize it. I tried viewing it with different encodings, but that doesn't work. (I thought maybe it was supposed to be Cyrillic.) If I had way more free time, I would try to decode it. But I don't :-) --Iritscen 20:00, 28 March 2008 (CET)

---

Spam spam spam spam eggs bacon and spam

We are still experiencing vandalism of the OniGalore:Community Portal page. I don't know whether to call it spam, because it doesn't seem to be advertising anything, but it's bad and I'm sure we all want to stop it. Let's discuss this further on the War on spam page.

Iritscen, 28 March 2008

Spamwatch update (4/16/08): Seems that it's been a couple weeks since we had spambot activity. Not long enough to get our hopes up that it's done, but at least the bots are on a break or something. At this rate there's no need to block registration or anything.

Iritscen, 16 April 2008

Actually, not many people seem to have noticed, but anonymous edits have been disabled as of April 4, 2008. The only spam bots we can have now are of the kind that register a user name. So relax, but keep your fingers crossed, as that kind of escalation will be likely as the wiki gets more popular. Spam and its escalation is the key reason why I am not making a point of boosting our search engine rankings...

geyser 16:33, 23 May 2008 (CEST)

Hmm, someone was looking at my userpage recently... :-) -- just for the record, I am not advocating the taking of any action to increase page rankings; I just think it's interesting to observe whether there's a natural up-trend as we add more content, so to observe a trend I have to start tracking now.

And I'm glad to hear about the blocking of anon edits. --Iritscen 17:22, 23 May 2008 (CEST)

---

And there we have it...

First non-anon spam

geyser 00:13, 2 June 2008 (CEST)

Yikes. It only took less than two months since anon edits were blocked.

Iritscen 15:23, 2 June 2008 (CEST)