Ron Pope Motorsports                California Custom Roadsters               

Forum Spam

Mike

Well-Known Member
I want to apologize for all the spam that hit the forums this morning. It seems XRumer has been updated and the update has managed to crack the bog-standard XenForo spam blocks. EX JUNK has been going above and beyond the call of duty in getting it removed from open view, but it seems the spammers just keep coming. Jim, I appreciate you being atop all of it the way you were.

I've made some changes to the forum. First off, newly-registered members will not be allowed to post any links, either in post content or in signatures. Most spammers are here for the hit-n-run and can't be bothered to submit posts in order to get around this kind of block. If the problem persists, I will double the number. I recognize this is a PITA, but so is Russian spam.

I have also applied some IP blocks that will deny entire countries. I'm to a point where I cannot see any legitimate members coming from countries like Russia, China, Romania, Uzbekistan and the Ukraine, so I have simply closed the forum to visitors from those countries. Again, if the problem persists and I can narrow the problems down to specific countries, I will continue adding blocks.

I know you don't like spam on the site and I absolutely detest it. So we'll stay atop what is now happening and I give you my word I will continue clamping down until we get it stopped.
 
I've also changed the registration page over to use a series of challenge questions a guest will need to randomly answer, in order to register.

Every account that spammed the site this morning was registered with a Gmail account. I'm jus' sayin'.
 
Mike it is happening on all the forums. I am on the HAMB and late at night they sneak in and actually do a few posts on threads. For example, if someone has a thread going they will enter a sentence that seems to relate to the subject, but it is only one sentence, and at the end of it will be 3 or 4 red boxes with X in them. I guess they want you to click on the boxes or something.

These idiots are really a pain in the butt. :mad:
Don
 
I agree, it is a pain. I work really hard, carefully trying to manage the number of links appearing on each page and when these numpties come in and start slinging links everywhere, I get pretty wound up. The sad part is we're never much more than about a half-step ahead of them.
 
Just to show you what is happening in the back room. We aren't seeing any spam at the moment, but it's certainly not for a lack of trying.

spamlog001.jpg


spamlog002.jpg


There are SIXTEEN pages of this crap, just since midnight, last night.

And look at how persistent the spam software is. The script trying to register as Emepaphapeshy tried three times, with the same username, the same e-mail address and two different IP addresses. But look at the arrows. Five different attempts from one e-mail address, with four different usernames and five different IP addresses. All within one minute. And there have been six more blocked attempts, since I grabbed the first screenshot.

Thursday, there was one, failed spam registration. One. Thursday, there were four. Between 6:00 PM Eastern and midnight, last night, there were five. Since midnight, there have been over 320 blocked attempts. And we actually had a handful of them get in here, early this morning. Plus, I installed the blocking script at 9:37 this morning. Not to mention a nearly four-page .htaccess file that already is blocking hundreds of IP addresses. Can you imagine what this would be like if I didn't have all the safeguards installed? This place would be a three-ring circus with all the animals running loose.

Are we havin' fun, yet? It's just this kind of shite that makes me want to call the host and tell him to wipe my server, because I'm finished.

And I'm yet to share the really good news with you. A very well-known automated forum spamming script has just been updated. (No, I'll not give you the name of the script.) The developer of this software package is really advertising the fact they have managed to get through the bog-standard XenForo spam blocks. Since a heavily concentrated customer block resides in the former U.S.S.R., the script was released in the Russian-language version only, late yesterday. (Must have been around 6:00 PM, last evening, from the looks of my registration logs!) The English-language version is expected to be released by the middle of the week. Ladies and gentlemen, please return your seats to the upright position, return your trays to their locked position and please note the captain has turned on the seatbelt light. We're about to hit some rough air...

In other words, we've not even seen the tip of the iceberg yet. This is fixin' to get really ugly. If we start seeing them getting through the safeguards, I'll change registration over to require manual activation. It might mean new members having to wait a bit before their accounts will be confirmed, but I'm not going to put up with spam. It's either that or close new registrations down until the storm passes. One way or another, we will keep forum spam to an absolute minimum.
 
Please explain this to me because I am computer stupid. Exactly what are they trying to accomplish by doing this ? Same with people who plant viruses, how does that do anything for them ?

Don
 
My business email account gets about 300 spam emails each day. On any given day there are people trying to get us to buy everything from canned soup to nuclear waste. Need any porn? Send me you email address and I'll forward more than you want. Want to marry a
Russian bride while getting your car waxed? I'm your man.
 
Does Google Mail care about this?
Yes, but since many of the e-mail addresses are phony, they never impact the Google POP servers. The problem there is Google is offering up what are basically throw-away e-mail addresses, so how should they determine who can have one and who can't. I have a Gmail address (hardly ever used) I acquired back when you had to have an invitation from Google, in order to get one. I use an auto-responder on that address, which warns people I never use the account, so they should e-mail me at my regularly-known address. It also informs them if they don't know that regularly-known address, I really don't care to hear from them anyway. :D

Mike and Jim: Thanks for all the hard work!
Thank Jim, he was the one mopping up the mess. Don't thank me, I'm the one who should be thanking you, for helping to make the T-Bucket Forums the finest T-Bucket resource on the Web. Without people like you participating here, this place would never have grown into what it is.

Please explain this to me because I am computer stupid. Exactly what are they trying to accomplish by doing this ? Same with people who plant viruses, how does that do anything for them ?
Don, it's a really long story that is really hard to explain. But what these arseholes are doing is building backlinks for their customers.

When you discover a new Web site, you do it by one of three means -
  1. You got the address from a friend
  2. You found by doing a search on a service like Google, Bing, Ask, etc.
  3. You clicked on a link on another site you were visiting
Here are some interesting facts done by a search engine optimization company I once did contract work for. If you're looking to buy a new whig-jig to grind smoke, what's a logical first step? You search for it on teh InterWebz, right? And over 90% of the time, you will perform that search on Google. (Most people would ditch Google in a nanosecond, if they knew the data Google is collecting about them, but that's meat for another meal.)

FACT - Since you use Google more than any other search engine, I need my Web sites to rank well on Google.

When people use Google, 80% of them will never click on page 2 of the SERPs (Search Engine Results Pages).

FACT - Since most people never see page 2 of the SERPs, I need my Web sites to rank on page 1.

Of the above number, 80% of them will never scroll down to the bottom of page 1, so they might only see 5 or 6 results.

FACT - I need my Web sites to rank in the top 6 spots.

The secret to optimizing Web sites, is knowing what it takes to rank well. I just checked Google on the term 'T-Bucket forums' and we rank number 1 out of 14,800,000 results. A check on 'T-Bucket forum' (singular) ranks us as number 1 out of 17,100,000 results. I'm pretty proud of that, because I've studied search engines and how to optimize sites for search engine crawls for over 6 years. I actually earned my crust working as an independent SEO contractor for a couple years. I've learned what search engines like to see and what they don't like to see. I've learned where to place keyword-rich content on Web pages, in order to get it noticed faster and easier by the search engines. And I've optimized all of my sites naturally, without resorting to what are known as 'black-hat tricks'. It has allowed my sites to grow naturally, which puts a smile on the search engines' faces.

I've carefully arranged my sites to get the search engines focused on content, rather than on fluff. And I've tried to carefully build quality backlinks into this site. But instead of just buttering up the entire Internet with backlinks, I've placed them where they would be the most effective. What some people do with backlinks is spam, plain, flat and simple. I've tried to place natural backlinks, to allow traffic to find them and act on them, naturally. Because I've seen what happens to sites that try to manipulate the search engines.

One way to help a site rank better is to build backlinks into the site. In other words, adding links to this site on other sites. But building backlinks can be very risky business. Do it right and it pays off, well. Do it wrong and you can see a site get 'sandboxed' by Google. Again, backlinks need to occur naturally, because trying to stuff backlinks is a practice that is easily identified and soundly penalized.

I own and operate several Web sites and in most instances, I have a backlink to this site on those other sites. But note, I said in most instances and not in all of them. Some backlinks are really good and some are really bad. If I had a Web site selling sports uniforms, placing a link to that site on a cooking forum would be pretty worthless. And much more worthless today than just 5 or 6 months ago, to be honest. But if I could get a link to my sporting goods site on the ESPN site, it would be priceless.

A cooking forum has naught to do with sporting goods, so my link would not be contextual on that site. But the link on ESPN would be contextual, so it would get a lot of link 'weight'. ESPN is all about sports, so a sporting goods link there would be a real flower in my cap.

Another aspect is the ranking each one of those sites would have on the search engines. My link on a cooking forum isn't worth much, but if that link is on a cooking forum that ranks well on Google, it will be worth more than having the link on a cooking site that ranks back on page 6 of Google. Same with getting that link on ESPN. The absolute biggest sports network in the country and their site has a massive amount of ranking 'authority'.

So, if I want to build backlinks to this site, placing a backlink on Spirit's Buckethead Bash forums would be worth more than placing a backlink on a Ford Mustang forum. But the Ford Mustang forum link would be worth more than placing a backlink on a knitting forum. A backlink on a contextual Web site is worth a lot more than a backlink on a completely unrelated site. And if a backlink is placed on a site that is awash in spam, the backlink might even bring you a penalty from Google.

And let me be very clear about this. Again. I do not visit other T-Bucket sites. I don't want people like B.C. or the officers at the NTBA to think I am coming around to spam up their sites with backlinks to this site. Nor do I want them to think I am trying to lure their members away to this site. Heck yes, having some links to this site on those two sites would help, but I'll be damned if I am going to build this site on the hard work of others. I've managed to make this the fastest growing T-Bucket resource on the Web and I've done it without crawling over the backs of others. Heck, I just learned yesterday that the NTBA had switched forum platforms. And I only learned that during a phone call with a pal who is an NTBA officer. I'm that far out of touch with those other sites.

Links are very important to Google, in particular. If a site has loads of incoming links and no outgoing links, Google sees that site as a dead-end. Link juice needs to be able to freely flow both into and out of all sites, to keep Google happy. But there are some limits. And most people do not understand those limits.

If I set up a Web page with just 1 outgoing link, that single link gets all the site's link juice. If I add a second link to the page, then each link gets 50% of the site's link juice. Add 2 more links and suddenly, each link is only getting 25% of the site's link juice. Something like a forum home page can spread the juice pretty thinly, because there are so many links. Look at all these links -

links.jpg

I identified 47 links, just in that small area. And I missed one. The word Shop in the Shop category bar is another link. If those were all the links on the home page, the link juice gets pretty thin, because it would be divided 48 ways. See how easy it is to water down the link juice?

Here's an example of a really good link exchange. On this site, we obviously have sponsor links leading back to RPM's Web site. That's a really good link for him, because he has a site that ranks very well for a lot of T-Bucket-related keywords linking to him. RPM has a link to this site on his own site. Which is a very good link for this site, because Google sees a commercial site, related to T-Buckets, is linking back to us. Quality links for both of us. Both sites are about T-Buckets, so the links are contextual and well-targeted.

But when we come to people spamming forums, they have no qualms or concerns over what they are accomplishing by their actions. They just know there are getting paid for every spam post they submit, so they submit as many of them as possible. Companies that do not understand true link value will pay spammers between 80¢ (on a poorly-ranked site) and $1,000 (on a highly-ranked Web site) for every post containing one of their links.

Anyone remember Overstock dot com? Always had ads on television and you could hardly visit a Web page that didn't have their ads on it. Have you noticed you never see their ads on Web sites, these days? They ran a huge link campaign and spent countless dollars to have spammers drop their links everywhere. That worked really well, until Google updated their algorithms. Suddenly Google saw Overstock had trajillions of links built on kajillions of Web sites, most of which had naught to do with any of the products Overstock was advertising on those sites. Google sandboxed Overstock. Within hours, a site that made its fortunes on Web sales was ranking pretty much nowhere on any of their best keywords. Overstock suddenly rushed out, purchased another domain name (O dot co) and tried shifting all of their pages over to the new domain. But all those trajillions of links they had spent some very serious dollars for were suddenly worthless as a used condom.

I have some recorded data on the J.C. Penney Web site, which was sandboxed on the very same day. At 7:00 PM on that day, Penney's ranked number 1 for the term "Samsonite carry on luggage'. By 9:00 PM that night, they ranked number 71. From top of the pile to page 8, in just two hours. At 7:00, they ranked number 1 for the term 'living room furniture'. At 9:00, they had fallen back to number 68. Love 'em, or hate 'em (and I prefer the latter), Google giveth and Google taketh away. If 80% of you never bother to look at page 2 of Google's SERPs, how many customers do you suppose Penney was getting from residing on page 8?

The spammers only care about turning in a high post count to whoever they might be working for. They report their spam post links, the company paying the bills runs a scraper bot over the URL to verify the link exists and they pay the spammer accordingly. Because they really aren't aware of the mistake they are making. It's not as if huge companies like Penney and Overstock were proudly telling the world about how they got their tender vegetation caught in a wringer. So, in time, those companies will all go down the same plughole as Penney and Overstock.

But it takes time and it takes a bit of salesmanship. Let's say you've just opened Don's Rods and you have a new Web site to sell all your wares. So I come to you and I say I will provide you with more business than you can handle. I tell you it is going to cost you $15,000, but within days, you will be rolling in your profits. You give me the $15K and I go spam the Web with links to your site. Suddenly, your Web site has all these new backlinks and it's appearing in the top five results for searches on streetrod parts. Next month, you come to me and offer me $30K, to do twice as much work. The month after that, you can't find me, because I've closed down my Web site. That's because I've changed my name, opened up shop under a new name and have gone across the street, to sell my services to the flower shop. And then, in the 3rd month, or maybe even the 15th month, when Google sandboxes you for all your spammy links, you're looking at your shoes and I'm spending your $45K on some blond bombshell on a beach, somewhere.

Get this - most of the registrations you saw in those log pages were registrations from an automated script. We call them bot registrations. The script I told you had just been updated and released on Friday? A copy of that script costs $590.00. And it costs another $10.00 per month, to keep it working. See how it works?? Some prick sells a kid an overpriced piece of software to come in here and shred our forum, to diminish my link juice and to make money. :devilish: But once you have a copy of that script, you just plug in a few forum posts, tell the script the kind of sites you want it to find and cut it loose. It takes off, tries to register for all those sites, and if successful, start hammering the site with your posts and then it moves onto another forum to do the same thing.

It is painful, but karma most definitely works on the Web. Spam a site's links all over Creation and you will pay the price for it. It takes some extra effort in times like these, but our users all see we are ready to go the extra mile to keep things safe, secure and spam-free. Our users recognize we are doing it for them, so it all comes home in the end.
 
Early last evening, it looked like we might be seeing a slowdown in the spam registrations. Between 2:00 PM and 6:00 PM, there were only 4 denied registration attempts, so I thought maybe we had weathered the worst of it.

Since midnight, we're on track to set a new daily record. We're already had over 200 denied attempts and it's just past 9:00 AM.
 
I remember when I was blacking out Email Spammers from our mail server that China was a pain. There were over 50 IP ranges and some of those were leased through Great Britian. Africa on the other hand was easy with 4 or 5 ranges... Thanks for all you have done, and Good Luck with the task Mike. I'd have to say that your site is the most spam free site that I frequent. Just shows how much work you put in on keeping it clean.
 
I've just updated all of the IP files in the script for the geographical zones I am now blocking. The zone file for the Russian Federation alone was over half again as large as the original.

I am now blocking the following countries -

Afghanistan
Albania
Armenia
Azerbaijan
Bosnia
Bangladesh
Bulgaria
Belarus
China
Czech Republic
Estonia
Herzegowina
India
Kyrgyzstan
Kazakhstan
Latvia
Pakistan
Russian Federation
Romania
Slovakia
Slovenia
Sri Lanka
Tajikistan
Turkey
Turkmenistan
Ukraine
Izbekistan

In addition, I am now also blocking registrations from any users operating through ports 80, 443 and 8080. I realize very few of you will understand what that actually means, but people like madmike8 will understand.

I recognize there will be some university students that might be blocked because of a campus server running a gateway on one of these ports, but that's a risk I am willing to take. At least until things get settled down a bit more. We may have some servicemen and women deployed to one of the blocked zones who will be blocked whilst using Internet cafes, but I'm not going to endure cleaning up spam for such a tiny percentage of potential users. It's either employing some of these tactics or closing down registrations altogether. I'm reluctant to take so drastic a step, but if push comes to shove, I'll pull the plug.

From 27 December 2011 through 5 August, we had a grand total of 42 spam registrations denied. We've had that many denied in the last 2 hours, 21 minutes.
 
That was a great post on search engine function. The latest thing I have found to be very annoying is when you do a search the first two pages are nothing but links to other search pages. This is why I went to Google in the first place......
 

     Ron Pope Motorsports                Advertise with Us!     
Back
Top