XF 1.5 Chinese Spam, characters not caught

[spitz]

Hello,

My forum is getting pounded by Chinese spam. These spam posts aren't getting recognized by the spam phrases part of spam management and I can't figure out why. I've read through a few other posts about this and haven't come across a solution that's worked.

They are all variations of the message below.



I've compiled a list of 60 of these Chinese characters and added them to my spam phrases. I've included all of these versions below for each character. From what I understand, much of this is repetitive, but I've just kept trying different things.
大
*大
大*
大

I've added these characters to both my TAC StopHumanSpam and the Spam Phrases in the core Xenforo spam management.

I've tried adding this code to as well that I found in another post without any luck.

[url*
#(?<=\W|^)(微信)(?=\W|$)#iu
/\b(?:[0-9\p{Han}\p{Bopomofo}\p{Hiragana}\p{Katakana}\p{Hangul}０-９Ａ-ｚ]+)?微信(?:[0-9\p{Han}\p{Bopomofo}\p{Hiragana}\p{Katakana}\p{Hangul}０-９Ａ-ｚ]+)?\b/iu
/\b(?:\w+?)?[\p{Han}\p{Bopomofo}\p{Hiragana}\p{Katakana}\p{Hangul}０-９Ａ-ｚ]+(?:\w+?)?\b/iu

All of the posts that have gotten through have included characters that are included in my spam phrases.

Does anyone have any idea why these are not being caught by the spam management tools?

Thanks!

 

[051119]

I’m having exactly the same issue.

My forum is getting pounded by these every night, I’ve even added phrases like Uni because they all seem to be selling fake diplomas.

Last night I had 355 posts by one user and 55 by another. The Spam deletion tool really seems to struggle.

 

[spitz]

I’m having exactly the same issue.

My forum is getting pounded by these every night, I’ve even added phrases like Uni because they all seem to be selling fake diplomas.

Last night I had 355 posts by one user and 55 by another. The Spam deletion tool really seems to struggle.

Have you had any luck figuring this out? I've been testing the CleanTalk add-on. Seemed to be working during the trial. Of course, now that I've paid for a year it isn't working so well. Seems to only catch around 50%.

I really hope someone can chime in here that's had success against this.

 

[Ingenious]

Just to clarify with your wildcard, would the ones shown above only flag text that starts or ends with that character? In my spam settings I use the wildcard as follows so it gets flagged even within a block of text:

*大*

Look for other things to target. I always flag new user posts containing links or media to be approved as this is nearly always spam:

*www*
*MEDIA*
*http*
*URL*
*https*

Are the IP addresses of these spammers usually Chinese? You could flag per country with an appropriate add-on. I use TPU Detect Spam Registrations, initially I flagged any Chinese IP posts to the approval queue then realised nothing other than spam has come from the country so flagged new users from Chinese IPs to the approval queue where they get deleted before they post.

Look at preventing registration if they're bots by changing your Q&A if you use it.

 

[spitz]

Thanks Ingenious for all of the suggestions! Sadly I think I've worked through all of these. I think I've tried a million angles and still can't get it stopped.

Just to clarify with your wildcard, would the ones shown above only flag text that starts or ends with that character? In my spam settings I use the wildcard as follows so it gets flagged even within a block of text:

For some reason I missed this in my original post, but I do already have included the

*大*

version of my list of characters. What's odd is sometimes they are caught by the filters, sometime not. I can't find any rhyme or reason to how they get through.

Look for other things to target. I always flag new user posts containing links or media to be approved as this is nearly always spam:

This is crazy, but none of the post have links. I don't understand it. "University" is about the most common English word that shows up. I may block that, and varriations of it for at least the time being. Good heads up.

Are the IP addresses of these spammers usually Chinese? You could flag per country with an appropriate add-on. I use TPU Detect Spam Registrations, initially I flagged any Chinese IP posts to the approval queue then realized nothing other than spam has come from the country so flagged new users from Chinese IPs to the approval queue where they get deleted before they post.

I have already blocked all of Chinese IP's using Cloudflare. While many were coming from there, now they've been coming from IP's from other countries. It's all over the map.

Look at preventing registration if they're bots by changing your Q&A if you use it.

This is my latest attempt. I believe they are bots. I ran into an issue with the theme I'm using. There seems to be a bug on the registration page that errors out using the Q&A CAPTCHA. I'm waiting on the developer to respond to my ticket. Hopefully I can get that up and running to give it a shot. I would be wonderful if the Q&A could put it to rest.

Thanks so much for all of the suggestions!