MAINTENANCE NOTICE

[mystic]

Yesterday it was a face to face battle with spammers. They found the way to break into the forum. Nobody noticed it, because there is a filter that prevents posts before 5 posts are approved. But behind the lines, against the 5 or so usual registrations, there were about a 100 registrations. If the database increases everyday of 100 users, it will soon become unusable and the forum will experience again the old known issues. So, it was mandatory to intervene quickly.

After a few hours of work, I think we reached the most stable configuration ever. A new module was installed that far surpasses my old checks (which were abandoned). The module works like a charm, and in 12 hours it caught and purged about 200 fake accounts. If we continue at this pace, in a couple of months the database will be completely clean of spammers.

I attach a screenshot of a log where you can get an idea of the attacks we get daily, and how the new module works. You can even see that some people tried to register multiple times from the same IP address, after they realized they were caught. And they were caught again
So, end of spam, guys!

jade.JPG (88.63 KiB) Viewed 11868 times

[mystic]

The attack to the site continues and, despite the spammers are halted successfully, this creates a big overhead on the server and problems with the other sites hosted on the same server. Thus, we need to further optimize the forum, so that it responds promptly to attacks and causes less overhead.

Thus, we will put a new rule: All zombie and dormant accounts that never showed activity (i.e. posts) will be automatically deleted after 15 days. So, for the new accounts, you just need to get one post approved within the first 15 days.

This rule does not affect the ability to read posts, etc. It only affect the typical activity of a registered user, which should be to participate, post, send messages, etc. But if a registered user was never active, there is really no need for registration.

Users who posted at least once will not be affected. The database will be updated in next 24 hours.

[Edwin]

The spammers will not give up easily, huh? They really cause a lot of problems not only for the forum, but for effected servers, huh? I am really happy that you have figured out how to stop them, and also how to make the forum work better by not having accounts on the forum when those people have never done anything except register! I suppose those spammers will continue to try for ever, huh?

[jadegil6]

Yes they do cause problems. Because this last time (in the past 24 hours), my hosting company did not just take the forum off the net, they took my entire website offline. After exchanging numerous emails with mystic, and getting his suggestions, I made a call to my hosting company, and they did agree to reinstate the site, but said that if the problems continue that they would not allow the forum in the future. It is a big problem, as you can see.

[Edwin]

I for one would really miss this forum if anything happened to it! I think it is terrible when people are able to do such damage, and make it so difficult for us! You and mystic are working hard, and we need to pray hard as well! I knew it was serious, but it is worse than I realized!

[mystic]

I thought it was curious to give the list of top 20 spammers in ascending order in the last 2 days by IP address. The first loaded a wealth of over 33,000 pages and holds the absolute record. The lowest stayed just a little above 1,000 pages. This means they keep launching their robots thousand of times against the same webpages in the forum (in particular, the page ucp.php, which accounts for about 46% of traffic of the entire site). They try to break in from there, and we keep deleting them.
You will notice that some addresses come from the same block (only the last numbers change). Those are the same person who is on a dynamic connection. They try, see that they fail, connect again and try again, thinking that their IP was blacklisted. But we catch them anyways, because we use another way to blacklist them.

31.131.76.202
176.9.9.9
199.59.62.88
42.201.197.210
188.64.170.188
42.201.197.211
42.201.197.213
199.59.62.84
199.59.62.86
113.212.70.35
61.147.99.103
31.131.77.198
23.19.79.218
178.93.159.193
69.162.67.42
46.4.181.244
87.98.175.179
87.98.177.27
37.59.66.100
87.98.254.150

[Edwin]

Wow! That many pages by one spammer, 33,000! I can't even imagine that! Even 1000 seems like a lot! That is nice that you have another way of blacklisting them than by IP address! With that kind of traffic it is easy to see why the forum has trouble and the hosting company threatens to shut us down! Thanks for letting us know, mystic, how you are progressing with this, and what is happening!

[mystic]

In the following days we will reach the final cleanup of spammers from the database. All the zombie accounts will be purged also. So, we went from 60,000 "users" to around 500. There is a big difference, but all those 500 are real users. They posted and contributed to the forum.

This cleanup makes the forum the most performing. There should be no problem anymore, except if spammers attack us all at once at the same time (this means 80+ connections in the same split second - that's what just happened last week). Well, even Yahoo went down when they do such attacks. There is no way to prevent them. But we (or the provider) can disable the site temporarily, until the attack ends, and then we are back.

The new anti-spam modules work flawlessly. As you can see, now spammer is escaping the rules. And it they camouflage themselves really well, they are purged anyways after 15 days, if they don't post something relevant that is manually verified and approved.

I will have to add a note on the registration page, because there is no need to register if one does not want to participate. The forum is completely accessible and readable online without the need of registering. If one wants to register, it means he wants to say something.

I was also thinking to add a module that sends automatically birthday wishes to our real subscribers, now that the database is clean.

[jadegil6]

Thank you for all of your hard work and time spent to help jaderune.com

[Edwin]

Yes, Sir Michael we are all thankful for the work that mystic has been doing to improve the forum and protect it. It is sad that we have to protect ourselves from people who have no conscience, and are happy to harm other people for a little gain that they might get. People have no respect and they are ruthless finding ways to get in and do the damage. Well, I am thankful that mystic is helping us to win!