I am an assistant admin on one forum and admin on a forum on one of my sites. Some time back I was directed to the Stop Forum Spam Service as an aid in checking registrants to the forums. I have found it to be an invaluable tool in weeding out spammers before they have opportunity to leave their graffiti on these forums.
I have made some observations about the use of the tool and about forum spammers in general that I will share with you. The service maintains a database including IP addresses, email addresses, and user names of people (or bots) that have been reported to the service by forum admin teams. This list is quite useful in identifying at least the more prolific forum spammers.
Some Thoughts about Forum Spammers
In my experience forum spammers are mostly creatures of habit. Probably part of this is due to being in a hurry to sign up for membership in as many forums as possible. They tend to reuse the user names and email addresses. They do not have control of the IP addresses. Some are on dynamic addresses that change frequently within a block of addresses but many are on high speed connections that tend to change less frequently. In the past many used Yahoo or Hotmail email addresses, but the current most common email service is Gmail. (I don’t believe that new Hotmail addresses are being issued.)
Telling the Good Guys from the Bad Guys
Aside from using the service there are some clues that raise red flags for me when I am going through new applications. If the country listed is different than the country from which the applicant registered I have to wonder if they are being honest or sneaky. Some registrants living in other countries will list their home country, so this is not a firm clue, but it does raise a red flag.
Usually if the email address contains a sensible name, particularly if the email address and the user name show some relationship, you have a good candidate. The major ISPs do a fairly good job of policing spammers, so if the email is from a major ISP and the IP address agrees you probably have a good guy.
I try to always check the IP address to confirm location. PhpBB contains a database of IP addresses and in most cases some information can be found by clicking on the IP address in the admin panel. In cases where the database has no information I usually turn to DNSstuff.com or GeekTools for whois lookup. There are many whois tools available and any will do the job. This is useful in determining if they registered from their claimed country of origin and sometimes will indicate their ISP as well.
The bad guys often use a throw away email address. There will often be no visible or sensible connection between the email address and user name. This lack of connection is much more prevalent among the bad guys, but is only an indicator that the applicant should be checked a bit more closely.
Observations on the Tool
The IP address search is straight forward, but you must keep in mind that many IP addresses are dynamically assigned, so a good registration could come from an IP address that had previously been assigned to a spammer. If there is a return on the IP address I look over the results to see if the same user name or email address has been used. If the registrants claimed national origin does not agree with the location of the IP address this is a further red flag.
The user name and email searches are simple string searched. They will find and return a sequence of characters in both email adresses and user names. If there is a common series of characters in the email address and user name only one search will locate all instances of that string in the database. Knowing this allows you to make one search instead of two in some instances.
Because it is a simple string search short or common strings are likely to produce many hits from the database. I like to see longer user names or a mixture of letters and numbers because these will produce fewer false positives. If I do get a list of returns from the database I first look to the flags in the right column to find returns from the same country. These lists can be up to 500 lines, so manually checking each return could be time consuming. I also give more weight to the top of the list as these will be the most recent reports.
Other Hints
I look at the email addresses. If the email address is not from one of the webmail providers or from a major ISP I often copy just the part to the right of the @ symbol and use that in the search box. I then open a new tab and paste the address in the address bar to check on the site. Sometimes I will end up at a regional ISP’s home page and sometimes I will find a website. In either case I will have a bit more information about my applicant.
There are a couple of types of forum spammers. Some are sellers of link building services. Some are users that are attempting Internet Marketing. The second group has seen that forums are a good place to plant links but have not paid close attention to the advice. In nearly all cases that I have come across where forum posting is recommended the advice has also included that you need to take part in the conversation on the forum and not merely produce a spam post to get your link seen.
Keeping your forum free of spam posts is a service to your forum users. The Stop Forum Spam Service is a great aid to identifying known forum spammers and preventing them from desecrating your forum. It is free to use and will save you time in checking registrants if you wish to run a clean ship.