Dwarf Fortress Wiki talk:Spambot attacks

One Possible Solution

The spambots are really getting out of hand. Do we know if they're targeting us specifically? If not, it might help to put something like a nonce on the signup page: just a text box where it forces you to type "magma" to sign up or something else unique to this site to thwart bots. The spammers won't adapt their software to spam us unless it's worth the effort, and if they're just hunting down random wikis to spam, it's probably not worth their effort and they'll go away. Uristocrat 04:09, 31 January 2011 (UTC)

I've already added several things to help deter spambots, which has stemmed a large percentage (we're actually only seeing about .5% of the attacks make it to an actual account registration and post). I'll see about incorporating that as well here in the near future. --Briess 05:02, 31 January 2011 (UTC)

Good to know. I saw another thread about a different spam attack on this wiki when I was looking around and I sent a contact at Google's anti-spam division some ideas about how to combat wiki-spam like what happened here, given that it apparently made it into Google's index at one point. No clue if they'll do anything, but they did make an algorithm change recently, so you never know. And anything that kills their incentive for spamming us is good. I've heard good things about making your site unique (even via dead-simple tests, so long as too many people aren't using the exact same thing), so hopefully that helps get rid of that last 0.5%. I see that we're already using rel=nofollow and such, so best of luck combating the spambot menace. Uristocrat 05:26, 31 January 2011 (UTC)

I mentioned several possible solutions here: Dwarf_Fortress_Wiki_talk:Spamreport, but nobody seemed to notice. Even though actual SPAM has been practically eliminated, all this SPAM and (Deletion log) / (Block log) really clutters up the Recent changes list. In addition, have you considered restricting new members (those that seem to pass the spambot tests) so that they must make at least a few content edits before they (automatically) get permission to start a new page? --Thundercraft 07:14, 9 February 2011 (UTC)

Anything we can do?

I'm watching some spambots attack right now and you guys don't appear to be online to banish them at the moment. I've blanked out the spam I could find and replaced it with the deletion template. I also marked the two user pages for the confirmed spammers with the same template. I don't really know if that helps or not, but is there anything we normal users can do to help kick these spammers out? Uristocrat 07:12, 7 February 2011 (UTC)

What you are doing is extremely helpful (marking them, marking pages for deletion, etc.) Remember that we're only seeing less than .5% of the spam attacks attempted against the wiki, we're working on solutions to kick out the last few successful attacks (we are under rather heavy attack at the moment.) --Briess 12:39, 7 February 2011 (UTC)

I assume you want us to use the AIV page that I now see in announcements as a place to report this stuff? Also, I traced the spam from here to a bunch of other MediaWiki/Drupal sites. They're building an entire web of spam links across random pages as a sort of blackhat SEO trick. Most of the links in their spam pages point to compromised Wikis and such; you can follow them via that. I can't trace this by hand any more. There are too many dead wikis out there and only maybe one in ten or twenty appears to be fighting back. A quick check of "recent changes" on most of them shows that all recent edits are spam. As near as I can tell, the attacks started around 27 JAN 2011, but I only looked at a few sites, so maybe I didn't go far enough back. If you can, check the logs to see if there are any suspicious search queries; that might tell us how they found us. Anyhow, I'll keep tagging them if I find them. Uristocrat 20:42, 7 February 2011 (UTC)

Yeah listing accounts to be blocked/deleted on AIV is the idea. Still mark pages with {{del|spam}} though. Emi [T] 00:13, 8 February 2011 (UTC)

I'm seeing lots of users joining (probably spambots), but I'm not seeing more spam pages. That's good. Except for the fact that they're still trying to break in, I guess you have it under control now? Uristocrat 10:52, 8 February 2011 (UTC)

IP bans

Can you ban IP addresses, instead of waiting for the accounts to be made? Or are they too random, or shared with actual users? --DeMatt 03:28, 9 February 2011 (UTC)

When we block the accounts, we've been also disabling account creation on the IPs associated with the account. They've just got a ton of IPs. Emi [T] 03:41, 9 February 2011 (UTC)