You are not logged in.

#1 2017-12-23 12:28 am

Greenlake
Member
Registered: 2017-07-13
Posts: 6

Short term (fly-by?) spam

On a forum I moderate, I have users report spam to me that I then can't find.

Is it a thing now that spammers make dozens of posts that they then remove within less than 24h?

Needless to say, that makes it hard to collect evidence.

Offline

#2 2017-12-23 12:57 am

Papa Parrot
Member
From: Mexico
Registered: 2011-08-19
Posts: 1,826
Website

Re: Short term (fly-by?) spam

Not that I know of, my guess is a admin or other moderator is deleting them before you see them, and the reports are still there.

Offline

#3 2017-12-23 1:21 am

Greenlake
Member
Registered: 2017-07-13
Posts: 6

Re: Short term (fly-by?) spam

It's a small forum and I'm not prone to multiple personality disorder smile

More importantly, there are no log entries of any moderator or admin actions. We don't seem to have logs for user-initiated deletions.

Last edited by Greenlake (2017-12-23 1:30 am)

Offline

#4 2017-12-23 1:38 am

sklerder
Member
Registered: 2012-10-11
Posts: 336
Website

Re: Short term (fly-by?) spam

Hi !

From my point of view :
- A well managed forum should have rules within the staff to handle post deletion (usually, they are moved to a bin where members don't see them).
- A member shouldn't have rights to delete its own posts (only the staff should be able to delete posts). Don't forget that "traces" of web activity could be required in case of police inquiry, and posts are posted by the HTTP POST method, method which doesn't leave much traces in the logs.

Offline

#5 2017-12-23 2:20 am

Papa Parrot
Member
From: Mexico
Registered: 2011-08-19
Posts: 1,826
Website

Re: Short term (fly-by?) spam

Ok, and I agree with sklerder, You should be able to at least see who deleted the post, some of this would depend on the forum software, but most have options to control who can delete posts, including members, I have seen many forums that do not allow new members to delete their posts.  There should be a option you can set, so that members can't delete their post, but then that is a inconvenience at times, ... My guess on this is that who ever posted the spam, also saw that the post was reported, so they
delete the posts. 
This would indicate also that the spammer is not just your average bot, but probably a human.

I have never seen this, and it would seem rather pointless to post spam, and then come back later and delete it, but the reasoning
and logic of spammers is difficult to understand,  a amoeba has more logic and intelligence.
Another thing, maybe there is a malfunction in the "report" option, ? Could it be removing the posts when they get reported ?

Are you using any kind of automated spam removal, or submission pluggins or mods,.. ?

Offline

#6 2017-12-23 6:33 pm

zero-tolerance
Member
Registered: 2013-02-25
Posts: 339

Re: Short term (fly-by?) spam

Another idea: check the web server logs. Search for the text of the forum action for 'delete post'. This should at least tell you who's doing it.

Offline

#7 2017-12-23 7:33 pm

Greenlake
Member
Registered: 2017-07-13
Posts: 6

Re: Short term (fly-by?) spam

Web server logs - something to follow up on. Should allow me to confirm whether the spammers took down their own posts, and how often that occurs without someone noticing.

Multiple admins - not a concern in this case, and we do have logs for admin actions

We haven't had issues with ordinary users being able to delete posts or edit them forever. Not something that's been abused - except for this apparent new strategy for some spammers.

Checked again, am seing no way to enable tracking of additional actions beyond what the software logs today.

Most pomising avenue will be a look at the server logs.

Offline

#8 2017-12-23 7:46 pm

kpatz
Member
Registered: 2008-10-09
Posts: 1,437

Re: Short term (fly-by?) spam

What forum software are you using?

Some software, such as vBulletin, can be set up so that users (or moderators) can only "soft-delete" posts, meaning they are hidden from view but still accessible by the administrative staff.  That allows mods to remove spam but leave the evidence available.

Or just not allow users to delete their own posts... most forums do not.


Spam happens when greed meets stupidity.

Offline

#9 2017-12-23 10:52 pm

zero-tolerance
Member
Registered: 2013-02-25
Posts: 339

Re: Short term (fly-by?) spam

Well, I wouldn't advocate locking down those functions if you don't have to. It depends on your situation.

Offline

#10 2017-12-24 7:36 am

Greenlake
Member
Registered: 2017-07-13
Posts: 6

Re: Short term (fly-by?) spam

The facility for "soft-delete" sounds interesting, and if I did end up establishing that this kind of fly-by spam was a regular thing something like it would be a cool tool to address an issue. However, not using vBulletin, but phpBB.

Offline

#11 2017-12-24 8:04 am

Greenlake
Member
Registered: 2017-07-13
Posts: 6

Re: Short term (fly-by?) spam

About the server logs. I can find a small number of delete requests. One or two posts, one gallery image, for the last month. That does not explain the here today/gone tomorrow report of "lots" of posts that more than one (trusted) user sent me.

Used the IP address to find the user(s) who issued these delete commands and confirmed it was moderator action.

Offline

#12 2017-12-24 12:49 pm

zero-tolerance
Member
Registered: 2013-02-25
Posts: 339

Re: Short term (fly-by?) spam

Sounds like you still have a mystery to solve.

I'd be contacting the trusted reporting users and asking them to send more details if it happens again - ask them to just cut and paste the post, including the avatar/username, unless they're already sending that.

When faced with a mystery I usually start with the more plausible explanations and work back toward the more unlikely ones.

Spammers have been known to send spam via the post reporting mechanism occasionally, for example.

Have you checked whether they're actually reporting forum posts, or are they reporting Private Messages sent to them? Some spammers send PMs, and some forums allow you to report those, and it might not be that clear what kind of report you're looking at.

Are the board permissions set properly so you can see the forum areas being spammed? You'd think for a global moderator this would be a given, but it doesn't always work that way on all forums. Permission systems are sometimes intricate and unintuitive, so they may be set up wrongly.

Other possibilities include: someone larking about, someone's account being hacked, the whole site having been hacked. Generally these don't happen a lot, so I would exhaust other possibilities before seriously considering them, unless there's other evidence.

Offline

#13 2017-12-24 1:36 pm

Greenlake
Member
Registered: 2017-07-13
Posts: 6

Re: Short term (fly-by?) spam

The reports came via e-mail as the trusted users keep in touch outside the forum. I've already asked them to keep an eye peeled for repeated instances. And the reports clearly describe forum posts, not PMs. The specific complaint was for posts full of gibberish all over a certain sub-section of the forum. The forum is small and focused and moderately active and there are no hidden areas; in addition the complaints were about a specific sub-forum that I definitely have access to.

I appreciate the suggested approach of eliminating the less arcane possibilities first.

The reported posts that later could not be found supposedly were "gibberish" and "all over the forum" and I was told belonged to a particular account. When I logged on, they had all disappeared and a single "normal" forum spam post was left (for the same account).

We did have someone hack the forum a few years ago with an interesting hack that made certain content visible only to search engines (and hidden from any users or admins). Really clever php hack, but it may be time to check for a repeat.

Thanks for all the suggestions so far; will need to work through them one by one.

Offline

#14 2017-12-24 1:55 pm

sklerder
Member
Registered: 2012-10-11
Posts: 336
Website

Re: Short term (fly-by?) spam

Hello !

Used the IP address to find the user(s) who issued these delete commands and confirmed it was moderator action.

Did you discuss about it with other moderators ?
My feeling it's the first thing to clarify.
The idea is not to find "who" did it, but "why" he did it ...
Another idea would be to have a "super moderator", only one allowed to destroy messages, others authorized only to move posts/topics in a safe area ...
I think this is possible with phpBB without tweaking.

I don't know how it works with phpBB, but with FluxBB (and PunBB), if you delete the first post of a topic, the topic vanishes completely (though posts are already in the database, but none of them referenced by the topic, none of them referencing the topic).
I had a mod, on my FluxBB forum, that forgot to maintain the link between the topic and the first post of the topic when moving posts.
All seemed to be OK, until I deleted the first post (on several topics), and then, no reference to the topic, no topic, and thus, all posts disappeared neutral
It took much time to identify why this was happening ...
Maybe your issue is something like this ?

Offline

Board footer

Powered by FluxBB

Close
Close