The Forum Has Been Hijacked By Spammers

It's unbelievable that the software acency is not able to protect a forum against spam attacks. IWC should have spent more money to contract a more competentent agency.

Nihil, how do you differentiate between your comments or anyone elses and a spammers?

Spam can be a big problem on a forum. Much of it is generated by automated "bots." Some "bots" generate registrations, and some generate posts after registration. There are apparently a number of sites that support this sort of reprehensible marketing. I'm sort of surprised it hasn't been a problem here until now.

I'm a moderator on two forums. On one, each registrant requires specific, personal approval. On that one I personally verify IPS and check the IPS against available listings of IPSs known for generating spam (e. g., www.stopforumspam.com/).

On another, we will periodically go through newly registered members and vet them, "banning" those we conclude are likely spammers. On that forum the administrator has also modified the registration software to block registrations with certain characteristics we've found to be associated with spammers on that board, e. g., a discrepancy between listed time zone and IPS location and/or an IPS that is a known proxy server.

Frank --thanks for your intelligent comments. We have been subject to a "bot" attack. The registrations mostly occurred in late October, and I have dealt with 100s of spam posts on each of the past few days.

This will be solved, but it is not simple without a lot of manual effort, as you do. Given the volume here that is not easy, esopecially since the Internet is essentially a "mass marketing" media.

Dear IWC and Michael - I just wanted to let you know that you have done a great job keeping such "annoyances" to a minimum on this forum, and that I really appreciate the job you have done "washing" all the threads clean again after the attacks!!

Good job - now we can enjoy the forum and share the passion again :-)

Sunday morning shortly after 08.00 UTC they attacked again and for a while the posts both new and additions to old legit posts were there plus new ones and then by 09.15 they were gone. Not sure whether someone or a little program grabbed them and consigned them to the www trash can.
Either way, well done and congratulations to who ever harvested them up.

Yes, in normal view the spam messages are gone. However, when I answered a question, the spam message was still visible in the "reversed order" list. Maybe something to look into, I guess all traces should be removed.

Kind regards,
Paul

Greg --yes, at 3 a.m. my time today I deleted about 185 posts, about 170 new discussions and 3 users.

The Spam Bot they use apparently is programmed to post inside of about 5 discussions (initiated by someone else) and initiate separately about 60 new discussions. This is per set or "user". I can eliminate all traces except when someone replies to one of the 5 tainted posts, which is what Paul has noticed.

The Spam Bot also appears to be programmed for 5 sets/day, and I only saw 3 user sets when I deleted. Thanks to your e-mail, I got the other two (another 120 or so posts) when I subsequently woke up again.

These manual deletions are not the solution. While Odopod is working on that, in my opinion they are not working on at least a temporary fix quickly enough. What if the Spam also contained viruses? Could anyone afford to wait 4 or 5 days?

This will get fixed.

MF - our unsung hero! I'm just back from a lengthy 8 day travel to Bangkok on business and missed most of this spamming issue. Clearly, you and the IWC team have done a good job in trying to keep the forum healthy - and like the others, I appreciate it.

This forum is important to many of us. A place of near daily visits, of friendship, passion and fine watches and it's a pity when others try to misuse it and/or brig it down.

Thanks MF for your efforts to keep it "clean".

Best regards
Mark

Any chance some legit posts are being scrubbed in the process? I noticed my Plastiki II thread from St Lucia has disappeared.

Any idea whether the spammers got hold of the profile data? The home address being there gives not a reassuring feeling. I notice that my street name disappeared, I'm not sure it was there (I don't look there that often) although if I'm not mistaken it should be, it being used by IWC for Watch International. By the way, the new issue did not arrive yet...

Kind regards,
Paul

Mine arrived on Saturday. It's on it's way.

Alan --it is possible, and did happen once. That's just due to my error, often there's lists of 60 discussions and the wrong box gets checked. I don't know if it happened on your Plastiki post, but apologize if it did.

Sunflower --you should read about Forum Spam bots. To my knowledge after some reasonable inquiry, they do not "invade" or mine data, or change registrations, your information, etc. They are strictly automatic posting software.

Also, there's no need to "hijack" this thread by changing the topic ;)
To change totally the subject being discussed on a thread, it's best to start a new discussion. The Watch International mailing has nothing to do with the Spammer issue here. Thanks.

Michael,

You're doing a great job. I know how dismal it can be. And I'm sorry to say that I just spotted another one when I opened the Forum this morning. See above.

Hi Michael,

Inquiring about possible damage to our privacy after a botnet attack is not too far fetched, bots being able to inflict quite some damage from the inside. As the damage is to the IWC forum I feel it is not me to be the expert about the scope of the possible damage, you could answer without asking me to inform myself about the possibilities. Good luck while cleaning the forum, you are doing a great job.

Kind regards,
Paul

Sunflower --you're entirely correct. I wasn't complaining or concerned about your privacy concerns. They're legitimate but vas far as I know there is absolutely no problem.

I was joking that you too were hijacking the discussion by mentioning that your Watch International hadn't arrived yet.

I think it may be helpful to realize that the spamming bot is still in action but is being ably handled by MF and IWC.

I noticed that any thread will be on one page until the 12th post, at which point a second page is started. And so on.

I now see threads with 23 posts listed but just one page. So obviously the spam, though removed, has left its mark.

Similarly, I have read a thread and then see later on there are new posts I have not yet read. Except when I go to the last page it is no different than before. Again, the spam has been removed but the marks remain.

Anyone notice anything I have missed?

Hi Alan,

There's filtering software now in place, removing Spam but leaving still those pesky traces. I then manually delete the user, which gets rid of some of those traces but not all.

We've had at least four Spambot attacks today and yesterday, with over 80 Spam posts removed. But it's slowed down considerably since the first of the year.

Yes - the offending post is removed, but its date and time stamp impacts the same way as non-offending posts.

An incredible irritation ! I avoid all "newly commented on posts" that have been updated in the same minute.

I have been doing that as well.

And thanks MF for the update.

Indeed irritating Shing and thanks for the tip!

Michael, if I may offer a suggestion for a future enhancement, it would be a nice feature to have a quick way to mark a thread (or set of threads) as read without having to actually open them.

Cheers,
Evan