Spam link spotter
Snitz™ Forums 2000https://forum.snitz.com/forumTopic/Posts/69816?pagenum=1
05 November 2025, 03:32
Topic
kyodai
Spam link spotter
04 February 2011, 14:47
Spam link spotter
04 February 2011, 14:47
This is a small script i made to be able to identify possible spam "bots". Well not the classic spam bots that post viagra links to be precise, i lately had loads of bots register that didnt post but had a link in like all custom fields to promote their site and get up in google ranks. Actually not all are really bots i think, at least some persons prolly were human it seems, but they all try to put a link to their site in either their signature , link 1 or otehr user defined fields.
Here's an example of how such a users profile can look like - 0 posts but links to his site in the profile:
http://forum.snitz.com/forum/pop_profile.asp?mode=display&id=34119
The reason they do that is to make links to their site more popular around the web to fool google and other search engines for better rankings. The search engines count all sites where a link to them appears, so more links out there makes the ranking going up. Or something like that. It became popular lately, i already have over 300 such link spammers.
So here is the first script, all it does is checking the signature field for containing http and making sure that it is NOT containing jpg, gif or png images (As such are usually legit signatures) or your forum name. In my example it checks for hiddenbelow.com which is my forum url, replace that with your forum url or any other keywords that you are sure dont appear in common link spam. It also weeds out results that have youtube in their signature as this is offsite but should only be used by "normal" users. Some people might be legit and have a link in their signature (If your forum rules allow that), maybe also add a condition like "AND M_POSTS < 5" to catch only people that have less than 5 posts (Spammers usually dont post much, at least not the link placing bots. If they post its usually only 1 or 2 posts. If they post a hundred times and you dont notice you have another problem anyways i guess).
Ideas for improvements and critics are welcome.
Edit: Already fixed a few bugs, working like a charm for me now
http://www.tankraider.com/userup/1296861674.zip
Here's an example of how such a users profile can look like - 0 posts but links to his site in the profile:
http://forum.snitz.com/forum/pop_profile.asp?mode=display&id=34119
The reason they do that is to make links to their site more popular around the web to fool google and other search engines for better rankings. The search engines count all sites where a link to them appears, so more links out there makes the ranking going up. Or something like that. It became popular lately, i already have over 300 such link spammers.
So here is the first script, all it does is checking the signature field for containing http and making sure that it is NOT containing jpg, gif or png images (As such are usually legit signatures) or your forum name. In my example it checks for hiddenbelow.com which is my forum url, replace that with your forum url or any other keywords that you are sure dont appear in common link spam. It also weeds out results that have youtube in their signature as this is offsite but should only be used by "normal" users. Some people might be legit and have a link in their signature (If your forum rules allow that), maybe also add a condition like "AND M_POSTS < 5" to catch only people that have less than 5 posts (Spammers usually dont post much, at least not the link placing bots. If they post its usually only 1 or 2 posts. If they post a hundred times and you dont notice you have another problem anyways i guess).
Ideas for improvements and critics are welcome.
Edit: Already fixed a few bugs, working like a charm for me now
http://www.tankraider.com/userup/1296861674.zip
Replies ...
MaD2ko0l
04 February 2011, 17:30
04 February 2011, 17:30
hi,
i havnt tried this but sounds good, however, if you are not logged in, you cannot see a persons profile, so if a bot was to index your site, it wouldnt actually see any of those links because the bot doesnt have an account to log in to see the profile.
therefore in my undstanding, this wouldnt really stop that problem
i havnt tried this but sounds good, however, if you are not logged in, you cannot see a persons profile, so if a bot was to index your site, it wouldnt actually see any of those links because the bot doesnt have an account to log in to see the profile.
therefore in my undstanding, this wouldnt really stop that problem
Etymon
04 February 2011, 17:40
04 February 2011, 17:40
Thankyou for both of your new MODs, kyodai! 
[^]
[^]
Etymon
04 February 2011, 17:42
04 February 2011, 17:42
This may work for me because I am working on a site that allows public profiles.
kyodai
04 February 2011, 18:12
04 February 2011, 18:12
Well yeah if you're hiding profiles this for sure got lower impact unless you allowed search engines to view profiles. However as it is looking at signatures it might still be delivering interesting results if you don't allow advertising in signatures or just wanna get an impression about how many of such bots registered (But will not be successful). I guess it can still be helpfull if you wanna clean up the DB and search for such "worthless" bot-alike users... It's not really a killer app, but it helped me identifying such accounts. it doesn't really stop the problem as it has no direct actions (But view the suspected offenders profile), i kinda wanted to get an overview of how many users fall into that category. Luckily it's not as many as i expected, but from the member numbers (Highest = last registered one) i can see that these became drastically more within the past months.
MarcelG
05 February 2011, 08:06
05 February 2011, 08:06
Good work Kyodai! I was planning on creating something similar my self, but I'll have a look at your work instead.
Carefree
06 February 2011, 10:15
06 February 2011, 10:15
I converted the hard-coded stuff to variables (and put it into default Snitz "Response.Write" format so this won't need to be edited by anyone wishing to use it.
Code:
<%
'###############################################################################
'##
'## Snitz Forums 2000 v3.4.07
'##
'###############################################################################
'##
'## Copyright © 2000-06 Michael Anderson, Pierre Gorissen,
'## Huw Reddick and Richard Kinser
'##
'## This program is free. You can redistribute and/or modify it under the
'## terms of the GNU General Public License as published by the Free Software
'## Foundation; either version 2 or (at your option) any later version.
'##
'## All copyright notices regarding Snitz Forums 2000 must remain intact in
'## the scripts and in the HTML output. The "powered by" text/logo with a
'## link back to http://forum.snitz.com in the footer of the pages MUST
'## remain visible when the pages are viewed on the internet or intranet.
'##
'## This program is distributed in the hope that it will be useful but
'## WITHOUT ANY WARRANTY; without even an implied warranty of MERCHANTABILITY
'## or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
'## for more details.
'##
'## You should have received a copy of the GNU General Public License along
'## with this program; if not, write to:
'##
'## Free Software Foundation, Inc.
'## 59 Temple Place, Suite 330
'## Boston, MA 02111-1307
'##
'## Support can be obtained from our support forums at:
'##
'## http://forum.snitz.com
'##
'## Correspondence and marketing questions can be sent to:
'##
'## manderson@snitz.com
'##
'###############################################################################
'##
'## 'find spambots by signature. By kyodai
'##
'###############################################################################
%>
<!--#INCLUDE FILE="config.asp"-->
<!--#INCLUDE FILE="inc_func_common.asp" -->
<!--#INCLUDE FILE="inc_sha256.asp"-->
<!--#INCLUDE FILE="inc_header.asp" -->
<!--#INCLUDE FILE="inc_func_secure.asp" -->
<!--#INCLUDE FILE="inc_func_member.asp" -->
<%
Dim inti
if mLev < 3 then
Response.Write "<meta http-equiv=""Refresh"" content=""2; URL=default.asp"">" & vbNewLine
WriteFooter
Response.End
end if
Response.Write "<table border=""1"" bgcolor=""" & strTableBorderColor & """ width=""100%"" align=""center"" style=""border-collapse:collapse"" cellpadding=""9"" cellspacing=""1"">" & vbNewLine & _
" <tr height=""60"" vAlign=""middle"">" & vbNewLIne & _
" <td style=""background-image: url(" & strCategoryCellBGImage & "); background-repeat:no-repeat; background-position:left;"" bgcolor=""" & strPopupTableColor & """ colspan=""6"" align=""center"">" & vbNewLine & _
" <font size=""" & strHeaderFontSize+2 & """ color=""" & strCategoryFontColor & """ face=""" & strDefaultFontFace & """><b>" & strForumTitle & " Signature Spam Surveillance Monitor</b>" & vbNewLine & _
" </font>" & vbNewLine & _
" </td>" & vbNewLine & _
" </tr>" & vbNewLine & _
" <tr vAlign=""middle"">" & vbNewLine & _
" <td bgcolor=""" & strHeadCellColor & """ width=""2%"" align=""center""><font size=""" & strHeaderFontSize+1 & """ color=""" & strForumFontColor & """><b>ID</b></font></td>" & vbNewLine & _
" <td bgcolor=""" & strHeadCellColor & """ width=""2%"" align=""center""><font size=""" & strHeaderFontSize+1 & """ color=""" & strForumFontColor & """><b>NAME</b></font></td>" & vbNewLine & _
" <td bgcolor=""" & strHeadCellColor & """ width=""2%"" align=""center""><font size=""" & strHeaderFontSize+1 & """ color=""" & strForumFontColor & """><b>POSTS</b></font></td>" & vbNewLine & _
" <td bgcolor=""" & strHeadCellColor & """ width=""2%"" align=""center""><font size=""" & strHeaderFontSize+1 & """ color=""" & strForumFontColor & """><b>SIGNATURE</b></font></td>" & vbNewLine & _
" <td bgcolor=""" & strHeadCellColor & """ width=""2%"" align=""center""><font size=""" & strHeaderFontSize+1 & """ color=""" & strForumFontColor & """><b>LINK 1</b></font></td>" & vbNewLine & _
" <td bgcolor=""" & strHeadCellColor & """ width=""2%"" align=""center""><font size=""" & strHeaderFontSize+1 & """ color=""" & strForumFontColor & """><b>LINK 2</b></font></td>" & vbNewLine & _
" </tr>" & vbNewLine
Set rsTopic = Server.CreateObject("ADODB.RecordSet")
strSQL = "SELECT MEMBER_ID, M_STATUS, M_NAME, M_SIG, M_POSTS, M_LINK1, M_LINK2 FROM forum_members where instr(M_SIG,'http') > 0 AND instr(M_SIG,'" & strForumURL & "') = 0 AND instr(M_SIG,'.jpg') = 0 AND instr(M_SIG,'.gif') = 0 AND instr(M_SIG,'.png') = 0 AND instr(M_SIG,'youtube') = 0"
set rsTopic = my_Conn.Execute(strSql)
if rsTopic.EOF then
Response.Write "<tr><td width=""2%""> </td><td width=""8%""> </td><td width=""5%""> </td><td width=""55%""> </td><td width=""15%""> </td><td width=""15%""> </td></tr>"
else
thisloop = "5555555555"
lastloop = "8888888888"
c=1
inti=0
Do while not rsTopic.EOF
c=1-c
CColor = strForumCellColor
if c=1 then CColor = strForumFirstCellColor
inti=inti+1
'put current row in the variable
if rsTopic("M_STATUS") > 0 then
Response.Write " <tr><td bgcolor=""" & CColor & """ width=""2%""><a target=""_new"" href=""pop_profile.asp?mode=display&id=" & rsTopic("member_id") & """>" & rsTopic("member_id") & "</a></td><td bgcolor=""" & CColor & """ width=""8%"">" & rsTopic("M_NAME") & "</td><td bgcolor=""" & CColor & """ width=""5%"">" & rsTopic("m_posts") & "</td><td bgcolor=""" & CColor & """ width=""55%"">" & FormatStr(rsTopic("M_SIG")) & "</td><td bgcolor=""" & CColor & """ width=""15%"">" & rsTopic("m_link1") & "</td><td bgcolor=""" & CColor & """ width=""15%"">" & rsTopic("m_link2") & "</td></tr>"
end if
rsTopic.MoveNext
Loop
end if
rsTopic.Close
Set rsTopic = Nothing
Response.Write " <tr valign=""middle"">" & vbNewLine & _
" <td colspan=""6"" align=""center"" bgcolor=""" & strpopuptablecolor & """>" & vbNewLine & _
" <font face=""" & strDefaultFontFace & """ size=""" & strForumFontSize & """ color=""" & strForumFontSize & """><br>There were <b>" & inti & "</b> potential spam users found in the database.</br>" & vbNewLine & _
" </font>" & vbNewLine & _
" </td>" & vbNewLine & _
" </tr>" & vbNewLine & _
"</table>" & vbNewLine
WriteFooter
%>