Spambot taxonomy

[dvandom]

In moderating the Monsterpocalypse boards, I've noticed that spambots tend to be groupable into three bins based on how they set up accounts.

1. Bare minimum. Just a username, a fake email, and whatever other information the board requires.

2. Spam the mods. Any fields that are open, like interests or location, will be filled with more spam messages.

3. "No, I'm a human, really!" These actually recognize what the fields are for, presumably because they're tuned for the defaults of a particular board code. The fields are filled in with random elements from some list, but usually end up looking fake anyway (i.e. since when is "customer" an occupation any real person lists?) and they don't seem to realize that listing your location as Nigeria or Russia is itself a red flag.

Additionally, the postings fall into three basic categories as well.

1. One post per disposable ID, on whatever the default board is (usually a General Discussion one).

2. One post per accessible board per disposable ID, never return to that ID on the assumption it'll be deleted and it's easier to just generate a new one.

3. As per 1 or 2, but check back a few hours later to see if the mods have noticed. If not, repeat posting.

I've never seen any that just spam until some circuit breaker kicks in, I guess they assume that excessive posting will be noticed faster. One or two per board are more likely to reel in suckers before a mod notices the spammer.

Comments

[zqadams.livejournal.com]

The Death Valley Driver board (which started off as a wrestling site, though personally I find myself talking video games and books there most often) has had a really weird history of spambots that ONLY post to the comics-and-lit section, but do so two to three times a day. It's not the default section of the site (its "showforum" number is 42), and moving it down the list or taking out any reference in the name to "books" or "literature" seems to temporarily stop the spam without redirecting it.

Damnedest thing I've seen, as far as spambots go.

[the-s-guy.livejournal.com]

I suppose there are advantages in having the first board post of any new member delayed for approval by an admin.

[dvandom.livejournal.com]

We tried having that on the MonPoc board initially, but there was a huge bottleneck. And since it's as much an advertising tool as anything else, the priority is getting people in, not keeping them out.