Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

This question already has an answer here:

We have a user who claims to have a vendetta against our community. We run a fairly large social networking website, and for the past four or five weeks, this particular person (or maybe people?) has been spamming our largest discussion groups and personally attacking other members by leaving hateful comments and death threats on their pictures.

We employ CAPTCHA and email verification on signup. We also have cross post analysis that catches users mass-posting a single thing to a lot of groups.

It seems as if he has hundreds of legit emails (they're all gmail, hotmail, yahoo) and looking at our logs, it seems as though he's sitting there and legitimately solving these CAPTCHAs. For hours. Every single day. When he caught on to our cross post analysis, he started generating random titles and bodies to post. He'll hit a dozen of our top groups with those over and over again until we delete his user account or he gets banned by a moderator.

His IPs change constantly. Many are Tor nodes, some are vanilla HTTP proxies. His user agents change for every new user he signups. Sometimes they're even "GoogleBot", which I thought was amusing.

So my question is, are there best practices we could be following besides employing CAPTCHA and email verification? Ones geared towards an extremely motivated human generating spam?

share|improve this question

migrated from stackoverflow.com Dec 29 '13 at 8:04

This question came from our site for professional and enthusiast programmers.

marked as duplicate by John Conde Dec 29 '13 at 17:05

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
you could import the list of Tor nodes and block those for the time being. dan.me.uk/tornodes –  Paul Collingwood Dec 21 '13 at 15:03
1  
Although this is a deplorable situation, this question appears to be off-topic because it is not about programming. –  John Saunders Dec 22 '13 at 0:12
    
You should set filters for those attacking words and automatically unpublish such comments. –  AgA Dec 29 '13 at 13:13

2 Answers 2

  1. Continue with verifying emails, and requiring CAPTCHAs.
  2. Block Tor nodes and known proxies.
  3. Hopefully, after doing so, you should be able to block also IP addresses.

Anyway, if you deal with someone who waste his time to annoy you, you can only make his life hard. I would suggest you to report his mail accounts as spam, in order to close them and enforce him to open new ones. You can send him email addresses to many spam-list on the web.

It seems that you have no simple option to do, but to try and make it harder for him to hurt your site. The solutions for spam, are usually used against spam botnets or commercial spam.

Expensive options, are monitoring all the posts, or filtering them using advanced algorithms (NLP). You can also try to learn your spammer behaviour and use machine learning algorithms, to detect his actions.

No simple solution - sorry.

Last idea I thought about - relying on the IP addresses of the spammers, and according to the times when he act, you might detect his ISP and location (if he just disconnect and reconnect to get new IPs, you can still learn about his ISP). If you do not have other clients from this location&ISP, you can block them completely, or try to require even more CAPTCHAs. Using this approach you might improve the user-experience of your other clients, by removing the CAPTCHAs for them.

share|improve this answer

Are you sure that there is someone sitting and solving the captchas? Because there are a plethora of options for spam bots to solve captchas and captchas are not effective against spam bots any more.

If he/she uses automated scripts and only the captcha solving part is manual, then there is something that you can do: Add a field to every form (for eg, user registration form, commenting form, etc) and cover it up with CSS so that they are not exposed to human visitors. A spam bot will fill it up and you can easily block all those attempts that fill up the hidden field. I am successfully using this to block 99% of spam attacks. Once he learns this, change the field characteristics. If it is a human spammer, then your options are limited.

You may refer to this drupal module that uses the technique I mentioned for more info.

share|improve this answer