LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > LinuxQuestions.org > LQ Suggestions & Feedback
User Name
Password
LQ Suggestions & Feedback Do you have a suggestion for this site or an idea that will make the site better? This forum is for you.
PLEASE READ THIS FORUM - Information and status updates will also be posted here.

Notices


Reply
  Search this Thread
Old 01-23-2016, 12:52 PM   #76
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 17,520

Rep: Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619

personally the mods are doing a good job on spam

there really is not that much that gets through
now last night was odd , with so much

but today it is gone
 
Old 01-29-2016, 08:01 AM   #77
rtmistler
Moderator
 
Registered: Mar 2011
Location: USA
Distribution: MINT Debian, Angstrom, SUSE, Ubuntu, Debian
Posts: 9,315
Blog Entries: 13

Rep: Reputation: 4371Reputation: 4371Reputation: 4371Reputation: 4371Reputation: 4371Reputation: 4371Reputation: 4371Reputation: 4371Reputation: 4371Reputation: 4371Reputation: 4371
Happy Friday.

The attacks seem to have started again.
 
Old 01-29-2016, 08:31 AM   #78
malekmustaq
Senior Member
 
Registered: Dec 2008
Location: root
Distribution: Slackware & BSD
Posts: 1,667

Rep: Reputation: 495Reputation: 495Reputation: 495Reputation: 495Reputation: 495
Yes it is in right now.
 
Old 01-29-2016, 09:19 AM   #79
Keith Hedger
Senior Member
 
Registered: Jun 2010
Location: Wiltshire, UK
Distribution: Linux From Scratch, Slackware64, Partedmagic
Posts: 2,940

Rep: Reputation: 780Reputation: 780Reputation: 780Reputation: 780Reputation: 780Reputation: 780Reputation: 780
"Here comes another one ..."
"Here it comes again ..."
"Here comes a bunch of 'em ..."

Python has a quote for EVERY situation!
 
Old 01-29-2016, 08:24 PM   #80
astrogeek
Moderator
 
Registered: Oct 2008
Distribution: Slackware [64]-X.{0|1|2|37|-current} ::12<=X<=14, FreeBSD_12{.0|.1}
Posts: 5,616
Blog Entries: 11

Rep: Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655
Friday evening MST, wall of spam, multiple forums... gonna be a long weekend...
 
Old 01-29-2016, 08:36 PM   #81
ardvark71
LQ Veteran
 
Registered: Feb 2015
Location: USA
Distribution: Lubuntu 14.04, Windows Vista
Posts: 6,277
Blog Entries: 3

Rep: Reputation: 841Reputation: 841Reputation: 841Reputation: 841Reputation: 841Reputation: 841Reputation: 841
Quote:
Originally Posted by astrogeek View Post
Friday evening MST, wall of spam, multiple forums... gonna be a long weekend...
Hi...

I thought most, if not all, first time threads had to be cleared by a moderator first, before even they're allowed to be posted on the forum. If that's the case, why are so many of these SPAM threads getting through?

EDIT: Wow, there's a little over 3 pages of SPAM listed on "Zero Reply Threads" as of 6:55 PST.

Regards...

Last edited by ardvark71; 01-29-2016 at 09:00 PM. Reason: Added information/Deleted word.
 
Old 01-29-2016, 08:57 PM   #82
frankbell
LQ Guru
 
Registered: Jan 2006
Location: Virginia, USA
Distribution: Slackware, Ubuntu MATE, Mageia, and whatever VMs I happen to be playing with
Posts: 17,391
Blog Entries: 27

Rep: Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405
I opened a text browser (w3m) and did a search for the english text string that appears in most of the spams.

The results returned a list of a bunch of forums, so I don't think this is targeted to LQ. I must confess, though, I was lazy and followed only a few of the links in the search results.
 
Old 01-29-2016, 09:09 PM   #83
jeremy
root
 
Registered: Jun 2000
Distribution: Debian, Red Hat, Slackware, Fedora, Ubuntu
Posts: 13,431

Rep: Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988
Quote:
Originally Posted by astrogeek View Post
Friday evening MST, wall of spam, multiple forums... gonna be a long weekend...
Posts from two members got through the new filters, and it's already cleaned up. The spam that is getting through now is roughly .001% of the attempts, and we'll continue to improve the filters.

--jeremy
 
1 members found this post helpful.
Old 01-29-2016, 09:13 PM   #84
jeremy
root
 
Registered: Jun 2000
Distribution: Debian, Red Hat, Slackware, Fedora, Ubuntu
Posts: 13,431

Rep: Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988Reputation: 3988
Quote:
Originally Posted by ardvark71 View Post
Hi...

I thought most, if not all, first time threads had to be cleared by a moderator first, before even they're allowed to be posted on the forum. If that's the case, why are so many of these SPAM threads getting through?
The first post made by a new member is evaluated by a variety of heuristics and based on that can be placed in a moderation queue. We err on the side of letting spam through vs blocking legitimate posts, as we want to help new members as quickly as possible. As mentioned, I think the amount of spam we block out of hand would astound most members. The amount of false positives is also very small. It's a balancing act and an area we continually tweak and improve.

--jeremy
 
Old 01-29-2016, 09:21 PM   #85
ardvark71
LQ Veteran
 
Registered: Feb 2015
Location: USA
Distribution: Lubuntu 14.04, Windows Vista
Posts: 6,277
Blog Entries: 3

Rep: Reputation: 841Reputation: 841Reputation: 841Reputation: 841Reputation: 841Reputation: 841Reputation: 841
Quote:
Originally Posted by jeremy View Post
As mentioned, I think the amount of spam we block out of hand would astound most members.
I have absolutely no doubts about that. My thanks to you and the moderators for keeping tabs on this.

Regards...
 
Old 01-29-2016, 09:52 PM   #86
astrogeek
Moderator
 
Registered: Oct 2008
Distribution: Slackware [64]-X.{0|1|2|37|-current} ::12<=X<=14, FreeBSD_12{.0|.1}
Posts: 5,616
Blog Entries: 11

Rep: Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655
Quote:
Originally Posted by jeremy View Post
Posts from two members got through the new filters, and it's already cleaned up. The spam that is getting through now is roughly .001% of the attempts, and we'll continue to improve the filters.

--jeremy
Thanks for the reply, it is reassuring. And my sympathies.

I know that what we see is only a very small part of the attempts. And I recognize that you and the LQ mods and admins do a remarkable job of keeping as much out as you do.

But when I sit down for an LQ session and see the wall of spam it makes me so angry I could... well, all the cats leave the room! And the problem is now so large and persistent globally that I very nearly despair...

As I type this I see another round has now started, so I'll let you get back to it.
 
Old 01-29-2016, 10:44 PM   #87
frankbell
LQ Guru
 
Registered: Jan 2006
Location: Virginia, USA
Distribution: Slackware, Ubuntu MATE, Mageia, and whatever VMs I happen to be playing with
Posts: 17,391
Blog Entries: 27

Rep: Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405Reputation: 5405
I have done a little investigation on this using w3m, links, and lynx.

If you go to the website specified in the spam, it redirects to another website which appears to be some kind of link farm--it's just a listing of links with some text next to them, at least in a text browser. You can see a screenshot here.

As I don't have Korean installed on my machine and couldn't read it if I did, I get lots of asterisks in the display. If anyone is interested in the whois, I'll be happy to post it, but I doubt it's worth the effort.
 
1 members found this post helpful.
Old 01-30-2016, 12:24 AM   #88
astrogeek
Moderator
 
Registered: Oct 2008
Distribution: Slackware [64]-X.{0|1|2|37|-current} ::12<=X<=14, FreeBSD_12{.0|.1}
Posts: 5,616
Blog Entries: 11

Rep: Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655
I have been doing a little investigation as well, every little bit helps I suppose.

I have loosely profiled the spam users, at least the ones I have been aware of, for the past couple of weeks.

There was an important difference tonight from the past couple of weeks in that the posting rate (posts per user per hour) was similar, but the maximum number of posts per spam user was fixed at a much lower level. Either the spammers were profiling and stopped at a fixed number, or there is some new limit in place which cut them off - I hope it was the latter. If so, it is still high enough to allow much more room for downward adjustment before affecting legitimate users I think.

The lower number of posts per user greatly reduced length of time and overall visibility of the spam quite a bit from the previous week. I hope that trend continues, whatever the source!
 
Old 02-01-2016, 09:26 PM   #89
timl
Member
 
Registered: Jan 2009
Location: Sydney, Australia
Distribution: Fedora,CentOS
Posts: 711

Rep: Reputation: 152Reputation: 152
looks like it is starting again. I noticed a strange message at the top of the "new posts" list
 
Old 02-02-2016, 11:05 PM   #90
astrogeek
Moderator
 
Registered: Oct 2008
Distribution: Slackware [64]-X.{0|1|2|37|-current} ::12<=X<=14, FreeBSD_12{.0|.1}
Posts: 5,616
Blog Entries: 11

Rep: Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655Reputation: 3655
Wall of SPAM, Tuesday evening...

*** Update to the Update
First post was at 9:30PM.
It is now about 2:30AM and there has been no letup.
So as of now, 5-1/2 hours and counting few "customers" have been served.

Eight pages deep in the Newbie forum to get past the spam...

This one appears more aggressive than previous instances, with greater number of user names and faster delivery rate per user too. Most are staying below 50 posts per user, but some are now above 160 posts, likely 200+ but I am too tired to track them any more tonight.

My sympathies to the admins who I am sure are dealing with it all.

Last edited by astrogeek; 02-03-2016 at 03:21 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Auto deleting spam assasins spam box via cronjob and Roundcube Junk Folder osmy Linux - Newbie 8 01-23-2012 04:22 PM
Move SA Marked Spam to Junk/Spam Folder Using Procmail, Postfix, and Virtual Users alden_pease Linux - Server 0 01-05-2012 12:29 AM
some threads are become unnoticed because of large number of continious threads deepak_cucek LQ Suggestions & Feedback 9 08-20-2009 11:21 PM
spam filter that puts spam into spam folder? paul_mat Linux - Software 3 03-31-2009 04:18 AM
Java threads listed using kill -3 does not contain all threads found using ps -auxww coneheed Programming 2 11-14-2005 08:57 AM

LinuxQuestions.org > Forums > LinuxQuestions.org > LQ Suggestions & Feedback

All times are GMT -5. The time now is 11:54 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration