1

We have a user who claims to have a vendetta against our community. We run a fairly large social networking website, and for the past four or five weeks, this particular person (or maybe people?) has been spamming our largest discussion groups and personally attacking other members by leaving hateful comments and death threats on their pictures.

We employ CAPTCHA and email verification on signup. We also have cross post analysis that catches users mass-posting a single thing to a lot of groups.

It seems as if he has hundreds of legit emails (they're all gmail, hotmail, yahoo) and looking at our logs, it seems as though he's sitting there and legitimately solving these CAPTCHAs. For hours. Every single day. When he caught on to our cross post analysis, he started generating random titles and bodies to post. He'll hit a dozen of our top groups with those over and over again until we delete his user account or he gets banned by a moderator.

His IPs change constantly. Many are Tor nodes, some are vanilla HTTP proxies. His user agents change for every new user he signups. Sometimes they're even "GoogleBot", which I thought was amusing.

So my question is, are there best practices we could be following besides employing CAPTCHA and email verification? Ones geared towards an extremely motivated human generating spam?

Improve this question
2
  • you could import the list of Tor nodes and block those for the time being. dan.me.uk/tornodes
    – Paul Collingwood
    Commented Dec 21, 2013 at 15:03
  • You should set filters for those attacking words and automatically unpublish such comments.
    – AgA
    Commented Dec 29, 2013 at 13:13

2 Answers 2

Reset to default
1

Are you sure that there is someone sitting and solving the captchas? Because there are a plethora of options for spam bots to solve captchas and captchas are not effective against spam bots any more.

If he/she uses automated scripts and only the captcha solving part is manual, then there is something that you can do: Add a field to every form (for eg, user registration form, commenting form, etc) and cover it up with CSS so that they are not exposed to human visitors. A spam bot will fill it up and you can easily block all those attempts that fill up the hidden field. I am successfully using this to block 99% of spam attacks. Once he learns this, change the field characteristics. If it is a human spammer, then your options are limited.

You may refer to this drupal module that uses the technique I mentioned for more info.

Improve this answer
0
  1. Continue with verifying emails, and requiring CAPTCHAs.
  2. Block Tor nodes and known proxies.
  3. Hopefully, after doing so, you should be able to block also IP addresses.

Anyway, if you deal with someone who waste his time to annoy you, you can only make his life hard. I would suggest you to report his mail accounts as spam, in order to close them and enforce him to open new ones. You can send him email addresses to many spam-list on the web.

It seems that you have no simple option to do, but to try and make it harder for him to hurt your site. The solutions for spam, are usually used against spam botnets or commercial spam.

Expensive options, are monitoring all the posts, or filtering them using advanced algorithms (NLP). You can also try to learn your spammer behaviour and use machine learning algorithms, to detect his actions.

No simple solution - sorry.

Last idea I thought about - relying on the IP addresses of the spammers, and according to the times when he act, you might detect his ISP and location (if he just disconnect and reconnect to get new IPs, you can still learn about his ISP). If you do not have other clients from this location&ISP, you can block them completely, or try to require even more CAPTCHAs. Using this approach you might improve the user-experience of your other clients, by removing the CAPTCHAs for them.

Improve this answer