Suspicious new forum members

[DevonDamo]

Some of you will have seen me commenting where I'm suspicious about threads started by new members. The standard I'm using for 'suspicious' is where somebody has taken the trouble to join this forum to post a banal question which they could have had answered in seconds via a Google search and is typically their one and only post. I've noticed a few recent comments from others who're also becoming suspicious of this activity, but I've also had a few 'disgraceful way to welcome a new member' comments - primarily from those who have been indulging these new posters with pages and pages of responses, despite the fact that they never return to acknowledge them.

I've now got an example of why it's not necessarily a bad thing to be a bit more wary of strangers online than when you're meeting them on a whist-drive down the Darby and Joan club. I recently looked at the posting history of one of these new members who'd started a series of new threads and failed to acknowledge any of their responses. What I discovered was:

1. If you type a fragment of the text of their post (in quotes) into a Google search, you'll find they've cut and pasted their comments, either from other posts either on this forum or from other decidedly-dodgy-looking websites.

2. They have posted two 'waves' of new threads. One was yesterday, and the other was around 2 weeks ago. At some point since posting the first wave of threads, they have gone back and edited them to include some very dodgy-looking URLs. (I know this was done as a subsequent edit because none of the people who originally responded to their posts have commented on the URLs and there are no URLs on the second 'wave' of threads.)

Here's a link to one of the offending threads so you can see for yourself. Needless to say: don't click on the URLs:

viewtopic.php?f=16&t=144680&p=1588922#p1588922

I've reported the poster along with the above findings, so hopefully their account will be deleted soon, but there's no reason to believe they, and others, won't immediately set up a new account and carry on. This suspicious activity may simply be trolling but as this example shows: it could be something far more malicious and potentially damaging. That's why my view is: if someone's first activity on here is to start a new thread, you should be asking yourself: "is it credible that anyone would set up an account to ask this, rather than just get an answer in seconds via a Google search?'

[Jdsk]

Thank you.

It took me a bit of time to spot the pattern, but I agree.

When I see these now I:

1 Welcome the new poster.

2 Put something to help others spot what might be happening.

3 Link to previous similar threads started by the same poster in the same way.

Would it be wise to notify the Moderators as well?

Jonathan

[Mick F]

Yes, alert the mods and explain why you are suspicious.

[thirdcrank]

I think I've posted quite recently that this tactic is a way - probably the only way - to have any hope of circumventing the various checks devised and implemented by graham over the years to ensure new members are bona fide

As MickF says, anybody spotting it happening would do us all a service by reporting it.

I doubt if there's a way round this, even if it's technically possible to stop somebody going back to add a link. Most of us have posted at some time intending to include a link, forgotten to do so and gone back to correct the error - often prompted by somebody who has noticed the lapse.

[Psamathe]

One other forum I'm a member on has a automated system where you links in your profile do not appear anywhere until you've posted a threshold number of posts (>150). No idea if similar functionality is available in the new php system just installed or is a manual rule would be practical.

Ian

[markjohnobrien]

Agree with this thread and I actually commented on a thread that the new member in question was another one of these who pops up, doesn’t reply, and then disappears.

Sadly, a trend in life that demands instant answers.

Even more problematic if there are inserting dangerous links into posts.

I’m sure that CycleChat has safeguards: must have posted x number of times before links can be inserted and/or PM’s sent.

[al_yrpal]

I wonder if some of these characters are new identities of folk who have flounced off the forum in a fit of pique. I have been sneaking a look at some of their profiles and its easy to see that some of them are visiting several times a day for a quick look...they stopped posting but cant resist the temptation to follow favourite threads. A new identity makes it impossible to see if they are a new member or a flouncer?

Al

[Paulatic]

A few days ago something prompted me to look at the member list. Latterly there are some interesting URL’s there.

[thirdcrank]

If you look at the members list in reverse order of post count, ie so all those with 0 posts are at the top, on the first page there are at least three with blatant advertising. I'd not want to add work for anybody, but at some stage IIRC, it was explained that only graham (Now Vorpal?) had the power to delete an account. Sledgehammer nutshell.

If a post seems dodgy it can be reported quickly for consideration but there doesn't seem to be a system for highlighting dormant advertisers like this. Does any of this matter?

[KTHSullivan]

I posted a reply to a "first poster" a week or so ago enquiring over primus spares. I did however receive a thank you a few days later. Similar to any open forum we are subject to the occasional buffoon but I do consider that perhaps being too restrictive may not be the way to go. We are after all endeavouring to encourage participation.

My £0.02

K

[Bonefishblues]

I joined specifically to pose a question to what I believed (correctly) was an informed audience and stayed around.

[mikeymo]

Here's a link to one of the offending threads so you can see for yourself. Needless to say: don't click on the URLs:

That's a bit like "DON'T PRESS THIS BUTTON".

https://www.youtube.com/watch?v=O3WqBFPhdKM

Some users may assume that the links are just to some "dodgy" web site, wink wink, know what I mean squire etc. etc. And so be tempted to follow them.

They aren't. Those IP addresses are from a private address range. 192.168.0.1 is often/usually used as the IP address for the router. It's clearly an attempt to hack the user's system. I've asked the mods to remove the link, if not the whole post.

[DevonDamo]

...I've asked the mods to remove the link, if not the whole post.

Beaten you to it. Even though I started this thread today, I reported the post yesterday - hence it now having been closed and (I'm assuming) the user's account deleted. It's true that in doing this, I drew these URLs to the attention of a wider audience, but that was a calculated decision - the situation prior to yesterday was that these URLs were still waiting for the unwary on several recent forum posts, and the malicious poster was continuing to generate content. I made the decision to flag up this post in a public thread because some people definitely need a wake-up call when it comes to dealing with potentially malicious users. As we've even seen in some of the comments above, people are still failing to understand that the normal real-life protocols about friendly welcomes should not be applied online when there is suspicion of malicious intent - the stakes are too high.

It's true that a genuine new member may inadvertently be given an unfriendly reception, but that sort of thing can easily be settled if they ever return to the thread - I got an angry PM from someone who I'd wrongly suggested was one of these 'fire and forget' posters, but we sorted it out via PM and ended up on good terms, comparing notes about tours around Glasgow. It's a little unfortunate when something like that happens, but nowhere near as unfortunate as one of your fellow forum users being hacked or scammed.

As well as my suggestion for how to decide whether a new poster is suspicious, there have been two excellent suggestions above - i.e. (1) reply to any first-time poster's question with a request for further info, and do not interact further until they respond and (2) just report users if they don't look legit. It would be absolutely possible to do all of these things without new members being put off. And surely helping to prevent malicious users from potentially harming genuine forum users has to be more important than providing a hearty welcome to an anonymous entity who's just popped up on a forum to ask a suspiciously-banal question?

[markjohnobrien]

...I've asked the mods to remove the link, if not the whole post.

Beaten you to it. Even though I started this thread today, I reported the post yesterday - hence it now having been closed and (I'm assuming) the user's account deleted. It's true that in doing this, I drew these URLs to the attention of a wider audience, but that was a calculated decision - the situation prior to yesterday was that these URLs were still waiting for the unwary on several recent forum posts, and the malicious poster was continuing to generate content. I made the decision to flag up this post in a public thread because some people definitely need a wake-up call when it comes to dealing with potentially malicious users. As we've even seen in some of the comments above, people are still failing to understand that the normal real-life protocols about friendly welcomes should not be applied online when there is suspicion of malicious intent - the stakes are too high.

It's true that a genuine new member may inadvertently be given an unfriendly reception, but that sort of thing can easily be settled if they ever return to the thread - I got an angry PM from someone who I'd wrongly suggested was one of these 'fire and forget' posters, but we sorted it out via PM and ended up on good terms, comparing notes about tours around Glasgow. It's a little unfortunate when something like that happens, but nowhere near as unfortunate as one of your fellow forum users being hacked or scammed.

As well as my suggestion for how to decide whether a new poster is suspicious, there have been two excellent suggestions above - i.e. (1) reply to any first-time poster's question with a request for further info, and do not interact further until they respond and (2) just report users if they don't look legit. It would be absolutely possible to do all of these things without new members being put off. And surely helping to prevent malicious users from potentially harming genuine forum users has to be more important than providing a hearty welcome to an anonymous entity who's just popped up on a forum to ask a suspiciously-banal question?

In answer to your last sentence: yes.

[drossall]

I've been involved in running forums for work for many years. Seen this tactic from time to time. It's really hard to combat, except by forum members being careful and reporting instances.