What do you do to avoid PM/PC spam?

[ForestForTrees]

In another thread, a year ago, erich37 wrote:

please be aware that it might happen that "human spammers" or "bots" are registering at your site and then are sending mass-conversations (via "Private Conversation" interface) to many of your members.
And then your members receive an Email-notification that they received a PM, then your members go and check it and see some Viagra-spam-links or some other nasty internet-scam-crap.

As an Admin, you will not even be able to notice this "spam and scam" in PM's at your website, if you are not able to have easy access to the PM-interface.
This happened at my Forum already several times and I can tell you that it was not funny

I think as an Admin, you should be able to see what is going on in "Private Conversations" in order to make sure your members are safe from spammers and scammers.... and this is an additional way of detecting spammers at your website.


The only funny thing is if you see one scammer from Nigeria sending some internet-scam (via "Private Conversation" interface) to another scammer from Ukraine.

What do people do to avoid scenarios like this?

I stay in close touch with many of our members, so I think I would be informed fairly immediately of anything that happened. If I suspect that something may have happened, I will visit the Daily Statistics section of the Admin CP. If the number of "Conversations" rises rapidly, I'll start to wonder, especially if there is no corresponding increase in "Conversation Messages." (Good conversations tend to have many replies, whereas spam tends to be just a single message.)

What do others do? What are best practices for different sizes of forums?

 

[ForestForTrees]

Finally, I'm surprised that there isn't an addon to help with this. For example, it could look for someone who sends more than a certain number of personal conversations per day. It could then display the username, the number of new personal conversations started, and whether a link was included in the message. Perhaps it could also display information such as how long the user has been registered and numbers of posts and links.

Not every admin would want an addon like this, but perhaps some might.

 

[m1ne]

https://xenforo.com/community/resources/sonnb-stop-spam-here.1086/

 

[Shelley]

What do you do to avoid PM/PC spam?

Disable it.

 

[ForestForTrees]

https://xenforo.com/community/resources/sonnb-stop-spam-here.1086/

Hmmm.... This looks like a great addon, but it doesn't look like a solution to this problem. All fully automatic spam is already effectively blocked on most sites (I would hope). But how do we know if a human user, using a different IP, a different username, and different email is sending hundreds of personal conversations to our members every day? Some of the recipients may be flagging the notification email as spam in their email clients (because it is), harming our email delivery.

When legal issues come into play, there is something to be said for knowing what is going on rather than blocking 80% of it.

 

[m1ne]

All spammers post links, I use that addon to require messages containing links to be moderated first if user has less than 5 posts, My forum sees no spam at all. They rarely get past registration either.

 

[EQnoble]

In another thread, a year ago, erich37 wrote:
What do people do to avoid scenarios like this?

I stay in close touch with many of our members, so I think I would be informed fairly immediately of anything that happened. If I suspect that something may have happened, I will visit the Daily Statistics section of the Admin CP. If the number of "Conversations" rises rapidly, I'll start to wonder, especially if there is no corresponding increase in "Conversation Messages." (Good conversations tend to have many replies, whereas spam tends to be just a single message.)

What do others do? What are best practices for different sizes of forums?

One way using built in tools is to create a secondary user group that requires X amount of posts as a registered member to be promoted (create new UG promotion) to and make it so only members in that secondary group can start convos.

It's just one way to limit the spam but I am sure there are many different solutions. Ultimately the thing is, having a unique protection (or combinations of) is what will help you, nobody builds automated bots for a single site unless A: the site owner IS the target, or the site has enough visibility to be worth it. If 10000 sites do the same thing, setting up one bot effects 10000 sites, that makes it worth it to a spam artist.

 

[ForestForTrees]

Good point.

I'd bet that the flood check provides some protection against PM spam:
https://xenforo.com/community/threads/bypass-flood-check.52260/

Personally, I'd love to have an addon like the one described above. Or one that only allows a user to start a certain number of personal conversations per day.

 

[AndyB]

Personally, I'd love to have an addon like the one described above. Or one that only allows a user to start a certain number of personal conversations per day.

here you go:

https://xenforo.com/community/resources/new-conversation-limit.3454/

 

[Alpha1]

Personally, I'd love to have an addon like the one described above. Or one that only allows a user to start a certain number of personal conversations per day.

I dont think that is an effective solution unless the staff gets an alert when a new user hits the limit. Most spam PCs are duplicate messages, so most of the spam would be stopped if new members get their account locked/moderated if they send duplicate conversation messages. Another way is to disallow keywords for new members and also lock their account if they send out messages with such keyword or with external links / email address.

 

[rdn]

Only Established Member can create Conversation on my board.

 

[ForestForTrees]

https://xenforo.com/community/resources/new-conversation-limit.3454/

That looks great, Andy, and I love your addons. Free, simple, and do one thing well without adding bloat to the board. Currently it can set a maximum number of messages that any user can send every day (or every n days). IMHO, turning it into a permission so that different user groups could have different limits would make it a pretty killer piece of PM Spam defence. One can always temporarily turn the addon off if a staff member wants to do an authorized PM "blast," of course. Thanks for writing it and sharing it.

I dont think that is an effective solution unless the staff gets an alert when a new user hits the limit.

I agree that alerts would be helpful. On my board, I want to know who the miscreants are.

On the other hand, with an addon that simply limits the number of messages per day, like Andy's, that will slow them down for a little bit before they can do huge damage. The admins would probably be notified soon anyway and then the spam cleaner can be run.

Using a scripting tool like Autohotkey (in conjunction with CURL), it wouldn't be hard to automate the process of sending many PMs. While I don't think this is likely, I just don't like the way that without an addon like Andy's, someone could send a pretty much unlimited amount of messages before I'm even aware.

Most spam PCs are duplicate messages, so most of the spam would be stopped if new members get their account locked/moderated if they send duplicate conversation messages. Another way is to disallow keywords for new members and also lock their account if they send out messages with such keyword or with external links / email address.

That sounds like good stuff, though maybe better for a large board than a tiny 45 post/day board like mine.

 

[Ridemonkey]

https://xenforo.com/community/resources/stophumanspam-anti-human-spam.1480/

The StopHumanSpam plugin will scan conversations for links (or keywords) if the user has fewer than X posts. It will report to the user why their private message has been blocked (so an actual human will see the error and not just be confused), and log the attempt in a log in the control panel.

This means that mods don't have to read personal conversations, but links are still actively blocked, and you can review the logs at regular intervals to see if there are spammers and ban them.