SPAM - it was nice while it lasted...

PhotosGuy wrote in post #18282343
And WTH is the point of all this Korean spam? Don't they know that nobody will bother to read it? ; D

It's posted by bots. They search the net for any site they can hack into with a brute force attack. That's why there's captcha. If the captcha doesn't lock out an ip address after 5 failed attempts, they'll get in. Even that's not guaranteed to work if the hack is by thousands of botnet zombies operating out of places like Alice's Beauty Parlor where the computer's antivirus is five year's old if they have one at all.

I don't have to be able to read Korean to know that the spams about male performance chemicals or porn. We are a sorry excuse for a species.

monty28428 wrote in post #18282383
I just want to know how it was determined to be Korean!

Post 37 examples are certainly NOT written using the Korean alphabet! I have been to Korea enough times on business to tell you it is easily recognized and very different from Chinese or Japanese.

http://abcdefridays.bl​ogspot.com …habet-and-typography.html

Post 37 examples likely Chinese, not Japanese

Wilt wrote in post #18282586
Post 37 examples are certainly NOT written using the Korean alphabet! I have been to Korea enough times on business to tell you it is easily recognized and very different from Chinese or Japanese.

http://abcdefridays.bl​ogspot.com …habet-and-typography.html

Post 37 examples likely Chinese, not Japanese

Geeez, Wilt! Maybe he said it was a Korean server, or maybe I was just wrong. As long as it's gone...

PhotosGuy wrote in post #18282594
Geeez, Wilt! Maybe he said it was a Korean server, or maybe I was just wrong. As long as it's gone...

Yes, what matters is it disappeared. I reported the burst of spam yesterday when there were only five threads, not like the example shown by TeamSpeed in post 37.
BTW, the OP examples were indeed Korean. The post 37 examples were not; and in post 39 it was you who said, "And WTH is the point of all this Korean spam? Don't they know that nobody will bother to read it?"

Spam could be in the language or Korea, or spam could have been generated out of Korea, China, or Timbuktoo.... Doesn't really matter. It's spam, regardless of language or origin. These are just easy to spot visually and are quite stupid in nature, I doubt this is generating any traffic for them here on POTN. Spam becomes ever increasingly difficult to filter though these days, they are finding ways around spam filters, either industrial, or home grown.

Most forums can block addresses of users from whole geographical areas to prevent attacks from spammers from China, Korea, India etc. The problem with this forum is that can't be done. It is a truly international forum. To block spammers in that manner would also block actual users.

You have to block based on a sequence of patterns, defining and maintaining that pattern is the difficult part.

Limiting new members to, say, three posts in their first hour would eliminate the long runs of spam posts.

OhLook wrote in post #18282858
Limiting new members to, say, three posts in their first hour would eliminate the long runs of spam posts.

Allowing them to only being able to start one new topic the first day would help too.

Nogo wrote in post #18282889
Allowing them to only being able to start one new topic the first day would help too.

Couple that with all posts by a user having an URL in the content... If member < 14 days old and count(posts) = count(posts with url) and count(posts) > 1, then suspend user for mod review. Might be too restrictive though, I could see a new member wanting to know something about a review, and not knowing where to post it, they ask for help in 2 or 3 boards.

Nogo wrote in post #18282664
Most forums can block addresses of users from whole geographical areas to prevent attacks from spammers from China, Korea, India etc. The problem with this forum is that can't be done. It is a truly international forum. To block spammers in that manner would also block actual users.

In registration level it can work, though: registration is now prohibited from north or south korea.

joedlh wrote in post #18282563
It's posted by bots. They search the net for any site they can hack into with a brute force attack. That's why there's captcha. If the captcha doesn't lock out an ip address after 5 failed attempts, they'll get in. Even that's not guaranteed to work if the hack is by thousands of botnet zombies operating out of places like Alice's Beauty Parlor where the computer's antivirus is five year's old if they have one at all.

I verified that those Koreans used humans for registering. With non-standard sites that is cheaper than to hire someone to write complex custom scripts which may/will not ever work (because the internals of our server side code is unknown, unlike with all commercial forum software). My Captcha design has a lot of features that makes automated solving really hard, I dare not say impossible (nothing is) - but really hard.

Adding a non-western character detection to posts and titles is pretty simple, but then again the value of it is only in alerting mods: reporting + a visual look of the pages is equally fast, really. We should not block posting if unknown UTF-8 characters are seen, there are so many that categorizing them is pretty much useless.

Pekka wrote in post #18284060
In registration level it can work, though: registration is now prohibited from north or south korea.

Serious question: there are internet users in Nork? Really? And they can be determined as from Nork, they don't go through a foreign ISP?

LonelyBoy wrote in post #18317777
Serious question: there are internet users in Nork? Really? And they can be determined as from Nork, they don't go through a foreign ISP?

They of course can do it only via VPN.

But we can detect them anyways as their operating system is "Red Star OS" and web browser "Pyongyang Mozilla"