PM Flood Control for New Members

Has anything like this been suggested before? I think a stricter form of flood control for private messages that only apply to newly registered members would impede those joining with the intent to spam via the private message system. Preferably, the setting would remove the ability for new members to add multiple recipients to a single PM and limit the number of individual PMs that can be sent within a set amount of time.







This would differ from the Flood Control setting currently found under Security Administration as this suggested setting would apply only to new members sending PMs, temporarily allowing for much longer than normally desired wait times and removing the multiple-recipient function.

I don’t advocate eliminating the multiple-recipient function for all members as it can still be useful, but it is mostly being abused by same-day registration spammers. I’d rather not extend the minimum post limit past 5 posts as there are times new members need to legitimately contact me, a moderator, or another member. The spammers quickly zip through the 5 post limit with spam or nonsense posts anyway.

You can set it where you have to have a certain number of posts before you can use the PM system. I believe that is a good way since you then see if the new members are exactly joining to participate.

Unfortunately these spammers tend to hit in the overnight hours or when I'm at work, so they'll have a good hour or two to post their nonsense out on the forum and increase their post count before me or a moderator can step in. I've had my forum for 11 years now and I haven't had too many problems with PM spamming until we had a few hit last year. We haven't had any problems this year until we had two within the past week or so. I have a lot of members of older ages who become concerned that the forum was "hacked" and think they should change their passwords, email addresses, etc... after those kinds of events.

Increasing the minimum post count and increasing the current flood control even more would just be inconveniencing legitimate members. I'm not as concerned about spam posted out on a public forum as I am with spam being sent to members via private messages, as I don't always know about it until someone reports it.

The flood control suggestion wouldn't be a replacement for the minimum number of posts required, but could be used together.

I do like the sound of this BUT there would be one problem it could make problems for the Contact us system.

But if they could do that then it does sound good to me you have my vote

This would differ from the Flood Control setting currently found under Security Administration as this suggested setting would apply only to new members sending PMs, temporarily allowing for much longer than normally desired wait times and removing the multiple-recipient function.

You may allow them to register without activating any email, right? If No, please Enable that function in Admin Control Panel -> Users & Groups -> Users options -> New account activation -> User

Second, temporarily removing the multiple-recipient function need to have a custom-complex script

SarkZKalie wrote:You may allow them to register without activating any email, right? If No, please Enable that function in Admin Control Panel -> Users & Groups -> Users options -> New account activation -> User

Yes, I require all new members to activate their accounts through the confirmation email.

The one feature I used for a number of years but rolled back was the "Unauthorize members with less than a week registration to post external links and emails". It was a good feature that I'm sure shut some spammers down early, but It was becoming more of a hassle explaining to new members why they couldn't post pictures and having them email the pictures to me or a mod to post for them. We occasionally have new members join who would like help identifying a particular model airplane engine or part they recently found or need help troubleshooting something, so being able to have the ability to post a picture right away is nice. Although, if these PM spammers start becoming more of an issue, I might have to reconsider that feature.

Fortunately, overall we haven't had too many problems with spammers. When they do get through, they normally don't last long.

I just thought maybe a special flood control feature would keep PM spammers from being able to send spam to 100+ members, hopefully they'd give up sooner once they notice it will take them ~5 minutes to send out each one.

Do you have 100 members complaining about spam PM's?

SLGray wrote:Do you have 100 members complaining about spam PM's?

I can't say exactly how many PMs they were able to send. I'd have to say a good 35 or so members contacted me about the spam PMs when you count everyone who sent me a PM, emailed me directly, and posted about them on some threads. The spammers even hit my Admin account and a test account that I was on a day or so before. We also saw a bunch of members log on that day who possibly received an email notification about a new PM. I deleted the users (likely the same person), which I believe is the only way to delete all the PMs they sent... so I had some users come on later wondering why they received an email notification about a PM that wasn't in their inbox. The IP and email addresses were added to the ban list after deleting the accounts.

https://www.coxengineforum.com/t15368-another-scam

https://www.coxengineforum.com/t15348-possible-scam#200143

https://www.coxengineforum.com/t15354-spam-has-arrived-even-here

https://www.coxengineforum.com/t15356-message-question

Considering the different send times between everyone's scam PMs (as seen in screenshots sent to me, and on my own accounts), my assumption was that they simply rolled down the member list and opened a new tab for each PM. Copy and pasted their spam message in each individual PM and sent one after another (waiting through the rather short 10 second, then later 30 second flood control). I could extend the flood control to perhaps 60 seconds or 90 seconds, however I think 5 minutes or maybe even longer would quickly shut these folks down.