Spam Bots?

[m@nyt1mes]

i havent seen any after phbIII.
i imagine the way they work is set up an account and then subscribe to it so they can see how active it is... in what way does phbIII stop them from just doing something like subscribing to another topic such as oblivion trivia or what are you listening to?

[Dogmantra]

I think the captcha is better (though I'd still talk to daveh about perhaps implementing a "What is the name of the race pictured above?" captcha if we start getting them again), and the moderators can see more, I believe, so suspicious stuff can be dealt with before spambots can even make a post.

[Nephele]

There are multiple ways in which spambots are being prevented from registering since we upgraded to phpbb3 -- that was one of the main objectives for the upgrade, after all. Since then, only one questionable new account has been made. In addition, the 40,000-odd spambot accounts that had previously been registered have all been deleted. Because they don't have accounts, they can't subscribe to topics.

As for adding customizable questions to the registration process to filter out spambots, two separate mechanisms for adding such questions are already in place. However, there's no reason to make registration unnecessarily complex for legitimate new users as long as the existing measures keep working.

[Dogmantra]

However, there's no reason to make registration unnecessarily complex for legitimate new users as long as the existing measures keep working.

Yeah, it was just a suggestion for if we get a lot of them again. Another forum I go to has a custom one and it works very well.

[m@nyt1mes]

how are they being combatted then? mods seeing their names before they post?

[Nephele]

They're being automatically prevented from creating accounts -- bots can't answer the captcha correctly; there's another registration question that effectively detects bots; the registration input form has been tweaked so bots can't easily process it. Previously we had ~50 spambot accounts being created per day; now we're down to one in six weeks. So the measures are working, for now. The one that got through was noticed by the mods and blocked.

Eventually, someone is likely to crack the captcha (every previous version has eventually been cracked), at which point we will add a UESP-specific registration question. Site-specific custom questions are ultimately one of the most effective ways to block spambots, since the spammers don't want to customize their bots for individual sites (compared to breaking a captcha, where the payoff is access to nearly every phpBB3 forum on the web). Our custom "ES games" and "Platform" questions are already pretty good spambot indicators (although they're not being used as automatic filters, at least not yet) -- nearly every new user has been filling in those fields, but spambots would not know how to correctly fill them in (spambots are not smart enough to read the description for examples of legit answers).

[m@nyt1mes]

oh, i didnt know we had a captcha in place...

[Nephele]

Correction: we've had four spambots register in the last six weeks. I hadn't examined the new accounts in a while; when I did, I found three more that failed the spambot litmus tests. Still, we're under one/week, which was the arbitrary point at which I'd planned to think about more ways of blocking them.

[Kestral]

spambot litmus tests..

This intrigues me, what is it comprised of, Nephele?

[Nephele]

spambot litmus tests..

This intrigues me, what is it comprised of, Nephele?

Basically, looking through the user information to look for evidence that there's a real person (in particular one interested in ES games) or, on the other hand, evidence of advertising or bot behaviour. For example:
* If the user has made any forum posts, it's easy to figure out. Or rather, I just assume anyone who's made forum posts is a real user (because of course someone would have already noticed a spam-style post and notified a mod, right? ).
* If the user has filled out the "ES games" and "Platform" entries in their profile, it's also pretty easy to tell (entries such as "ca" or "4G4G" meaning the account is likely to be a bot).
* Any other info in the user profile is also useful (a spambot example being an occupation that advertises wedding planning at great length, including links to a web site); even the username is sometimes relevant ("PhoneAds" probably spambot; "Almalexia" probably ES gamer); there are some other spambot profile patterns that I've noticed after scanning a few thousand such accounts.
* Registering from an IP address in China, Nigeria, or other odd locations is not a good sign.
* Email addresses can also be a bad sign (.cn, .ru, onlinedrugs.com are all suspicious; even gmail.com catches my attention, since it is by far the most popular email domain for spambots).
IP and email addresses are never the basis of a decision (we do have a lot of legit users with gmail.com accounts), but they do increase confidence when checking an account that's already failed another test.

For the truly curious, most of our 40,000 deleted spambot accounts were identified because they selected "Baker Island Time" as their timezone. Sounds crazy, but it really does work -- not to mention, it seems safe to bet that 90% of our users didn't live an empty time zone in the middle of the Pacific (again, there a few legit users who selected that timezone, but 5 out of 4000 is a more reasonable fraction than 40,005 out of 44,000). Since the upgrade, however, that's one of registration questions used to filter spambots, so it can't be used any more to detect the bots that got through.

[Kestral]

Ah, thanks. I didn't realize some of the obvious at first (No ES-related material), but was surprised when I learned about the UTC-12 time-zone. (I knew about the .ru and .cz or .cn suffix-es, I blocked them all.)

[Fiar]

* Registering from an IP address in China, Nigeria, or other odd locations is not a good sign.
* Email addresses can also be a bad sign (.cn, .ru, onlinedrugs.com are all suspicious; even gmail.com catches my attention, since it is by far the most popular email domain for spambots).

I have never noticed these, I just deleted a spam-bot on another site, and saw that it had the .ru to the E-mail. I usually have other methods of checking that you may want to implement here. On the site, we have gamertag info, I know the person is legit if it's filled out, cause I can check for the tag on Xbox.com. If the tag is gold or shows up, it's legit. If the tag doesn't exist or is silver, it's usually a bot (Some I assume make tags to fit in, but they are usually silver). Since I don't own a PS3, I can' say what you'd check with, same goes for PC, but I'm sure there are ways some have noticed.

Sometimes you'll get a sketchy profile that has signed up and takes some looking into (Same with those with Gmail and convincing names that you mentioned), but for the most part I have seen a good reliability with this method.

Just food for thought, I don't know how it would operate with a site on this large of a scale.