Please help us crush SPAM

Post by **matthew1** » 20 Aug 2011, 10:18

Want to help keep this forum clean? Here's a quick tutorial on how you can help spot and flag spam postings.

This one was very good because the content was believable. But there are always telltale signs of a spam post:

links in the signature*, but more telling when combined with...
a low post count
no Volvo model, only a year

If you see something that you think meets the criteria to be spam, please click the "Report post" button and one of our Moderators or I will look at it.

Thanks guys.

* not always a spam post (I have links in my signature, for instance)

Post by **matthew1** » 15 Sep 2011, 07:41

Here's another one:

Same tricky methods, but plenty of clues. I give him a 6/10.

User has only one post, ever
No city listed, just "USA" (common spam trait)
Link in the text (common spam trait)
No Volvo model, just year (common spam trait)

If you spot one, help us out by clicking the "Report Post" button. You are NOT identified, it's anonymous to the board users. Also, it doesn't kill the post, it just "flags" it for us moderators to inspect and decide to kill it or not. So don't worry that you're flagging something that may be legit. We'll always check it for validity.

^ That's the Report Post button.

Thank you!

FCPEURO · Post by **FCPEURO** » 21 Oct 2011, 17:28

I have to say, they are getting a lot better at hiding there spam.

Post by **mikealder** » 22 Oct 2011, 06:39

Don't you have the ability to block IP addresses in ranges within the back-end server controls, most spam originates from three or four specific countries and can be traced to regions within countries, for example three I have delt with earlier today on a different board, three locations with twelve new members spread between them:

Guangzhou, Guangdong, China
Putian, Fajian, China
Dhaka, Bangladesh

I very much doubt you would be getting true Volvo owners posting from countries such as these so blocking IP range can be quite effective - Mike

Post by **matthew1** » 27 Oct 2011, 09:39

Thanks for the comment, Mike. We do ban IPs and blocks of IPs.

Here is our list, which we add to weekly if not more frequently. If you have a way to find a set of IP blocks associated with those regions, please share.

109.230.220.24
110.36.*.*
112.14.131.220
112.213.107.60
113.22.9.*
113.97.*.*
114.127.*.*
114.143.120.98
115.108.*.*
117.198.157.166
117.205.144.7
117.207.70.68
117.5.*.*
118.250.175.66
118.70.*.*
118.71.153.2
119.152.*.*
119.152.151.94
119.155.34.185
120.28.64.85
120.28.64.94
120.33.239.219
121.205.*.*
122.163.128.108
122.168.*.*
122.169.*.*
122.173.*.*
122.173.80.222
122.173.86.*
122.174.72.49
123.129.*.*
123.145.*.*
123.237.156.32
123.27.*.*
124.6.181.174
125.83.36.151
125.85.21.77
173.234.242.185
174.34.150.11
175.100.172.*
178.150.*.*
178.22.218.222
180.174.196.212
180.191.*.*
180.191.37.12
180.194.242.210
180.215.59.174
180.72.30.125
182.177.*.*
183.81.*.*
188.92.*.*
193.105.*.*
193.188.*.*
195.177.75.67
195.54.*.*
196.45.*.*
200.65.127.161
202.44.4.85
204.15.72.226
207.176.6.64
207.62.217.252
208.78.60.174
208.78.62.152
209.107.217.6
210.4.*.*
213.5.*.*
213.5.66.16
217.20.118.170
217.31.51.77
219.136.*.*
219.136.86.144
219.136.86.246
220.161.138.74
220.249.*.*
221.221.*.*
222.127.*.*
223.224.21.113
23.19.34.211
41.113.*.*
41.138.182.8
41.138.183.63
41.155.109.***
41.155.60.*
41.155.82.98
41.155.82.98
41.184.*.*
41.189.*.*
41.191.*.*
41.211.*.*
41.219.*.*
41.219.201.156
41.26.*.*
58.187.143.21
58.187.143.21
58.251.125.53
59.58.*.*
59.90.247.70
59.92.*.*
64.20.61.210
65.49.68.160
66.178.*.*
72.27.194.5
72.27.24.59
74.117.62.27
75.101.194.108
77.78.*.*
77.78.8.*
77.87.32.102
77.92.*.*
79.101.75.118
81.91.*.*
82.128.212.54
83.138.136.92
84.19.165.217
85.175.*.*
85.222.36.134
89.131.122.124
89.44.*.*
91.196.*.*
91.197.146.54
91.197.146.54
91.201.*.*
91.210.*.*
92.112.*.*
94.142.130.122
95.31.30.179
95.31.30.179
95.82.245.33
96.43.88.37
98.64.222.139

I know some are covered by others via asterisk, but the system has no function to normalize them.

Post by **matthew1** » 27 Oct 2011, 09:42

Additionally I occasionally do get Contact Page messages to open up an IP in a spammy country, usually by ex-pats (Americans, English, Australians, Germans, Swedes) working wherever, and I can and do "poke holes" in that list for them.

In other words, there is an allow/override list.

frankelf · Post by **frankelf** » 16 Sep 2012, 15:33

I am confused a bit. The posts had a link with FCP Euro in it. Was that SPAM or not? I got a good reply to my first questioning post with that link in it too!
Frank Fitzpatrick, frankelf

Post by **matthew1** » 17 Sep 2012, 00:00

No, FCP is a trusted Volvo parts store, and highly regarded as a knowledgable source for repair information.

If a response is intelligible, it's not spam.

Post by **regent** » 17 Sep 2012, 07:00

Thanks Matt. SPAM filtering can sometimes be tricky.
Just my humble opinion here (I have, too, noticed a considerable count of irrelevant posts that may have nothing to do with our forums or just seem to advertise stuff):

I think that SPAM is the least of all evils. It is not uncommon to get hit with some type of malicious code just by clicking an active link and ending up in the wrong place (ouch).

As a safety practice, active links should always be treated with caution. It is better to copy and paste links into a separate browser, and even better to disallow usage of active links in our posts.

Thanks