vBulletin, spammy user stuff, and deleting accounts

[TheNewOne]

http://www.vbulletin.org/forum/showthread.php?t=268208

[Joe Siegler]

Here's what I do to keep spammers from registering.

https://www.vbulletin.com/forum/show...-on-your-forum

I've done all that. I'm not a neophyte here, which is why I posted in the first place. Was something NEW to me.

[Andy]

Here's what I do to keep spammers from registering.

https://www.vbulletin.com/forum/showthread.php/377906-How-to-prevent-spammers-from-registering-on-your-forum

[Joe Siegler]

Not sure. Only thing I can come up with is the connection to there was broken at the time they registered, or their IP simply wasn't in the database. It happens.

[Ace]

I already use stopforumspam - which stops most stuff, but if you look at the kind of user accounts these are, they would mostly bypass auto spam things like that.

How'd they manage to bypass that? Their IP address should have been in the SFS database..

[Joe Siegler]

I already use stopforumspam - which stops most stuff, but if you look at the kind of user accounts these are, they would mostly bypass auto spam things like that.

[TheNewOne]

use spam o matic from vbulletin.org it will stop them from registering

[Joe Siegler]

This morning I ran into a new kind of spammy account I had never run into before. I wanted to report on it so others could be aware of it. Additionally, my dealing with the cleaning up exposed a fault in the vBulletin admin area. Not that it's a bug, but a failing of the system that would have MUCH easily let me deal with this.

I had a user report a couple of user accounts saying they looked like they could cause trouble. See if you can detect the smiliarity:

Blossomseo
Butterflyseo
Canaceseo
Damaraseo
Emmaseo
Farrahseo
Gamilaseo
Hadaraseo
Malinaseo
Nabilaseo
Olatheseo
Sarahgolfseo
Tabithaseo
Tallulahseo
Yasminseo
Zerlindaseo
Zsuzsaseo

They all were registered from the same IP (119.85.207.249), and all had some sort of "golf" theme in their info. But that's the key. Most spammy accounts flood the forums with posts. They get reported by users and then removed. But these "seo" ones don't do that. They put their spammy info in their profile. So it's seen on their profile page "About Me" info. Additionally these accounts posted "visitor messages" on each other's accounts with addtl spammy links and whatnot.

That's deceptive as the majority of people never bother looking at other's "about me" info or their visitor messages, so it would go undetected. In fact, that batch of names above was only discovered because one of my forums regulars noticed a bunch of new accounts all ending in "seo", and looked into it.

Once I started looking in the back end, I saw they all had the same IP, had ZERO posts, and they all had the same text on their profiles. I decided to look for addtl accounts, and searched my userbase for any name that had "seo" in it. Annoyingly there was about 100 or so that matched it. I looked at the majority of them, and all but ONE had zero posts. The one that did have posts was already banned for posting spammy msgs. But all the rest were active accounts, and all of them had similar kind of setups. Spammy stuff of a similar nature to the golf posts, but about different subjects. Given the info was spread out in a few places in their accounts, I opted not to just ban then, but outright delete them. Mostly because I didn't want to spend the addtl time banning all the relevant spammy links too. Was way easier in this regard to just nuke the accounts. Some of these accounts went back to 2009, but most were in 2011. It annoys me that my forums had spammy links in their harvested data by Google. I'm usually pretty on top of this stuff, but going through the user profile stuff and not drawing attention to themselves by posting spammy msgs is a new track for me.

This brings me to the problem with vBulletin. There's no way I could find to tell vB to search for a user name (in this case, seo), show me the results, and then allow me to bulk delete them. I had to delete them all one by one. This is epic fail in terms of dealing with stuff like this. There is ways to bulk delete users sure, but they have to be part of an existing usergroup. You could create a dummy usergroup, move these users into it, and delete that way, but if you have to manually edit each profile to do that, you might as well just delete them there, as you're creating more work for yourself. It's pretty stupid that the back end doesn't have the ability to "search for any user account that has ceo in the user name and delete it" (presumably after giving me a confirmation screen showing me who matches that search). This needs to be added. If it IS in there, it's horribly hidden and needs to be brought out to the light.

Finally, there was no user in my userbase that had "seo" in their name for a legit purpose, so I stuck "seo" (without quotes) in my list of things for usernames that is unacceptable.

Wanted to pass this on so some others could be aware of this kind of thing and check their own forums.