none
Technet Group Policy forum filled with SPAM threads.

    Question

  • am observing lot threads pouring in GP forum in different language format. is everyone observing the same ??? looks like a spam.

    Devaraj G | Technical solution architect

    Thursday, May 5, 2016 4:16 PM

Answers

  • During the first 1 and 1/2 weeks of March, I reported all spam in all TechNet forums as abusive. I spent 3 or 4 hours per day doing this. All spam was deleted, and the users were banned. I find no spam now before March 11, 2016.

    It was easy to spot. I went to the TechNet forums home page, and did not select any forums. I filtered on all posts with no reply. I saw almost nothing but spam. I estimate there were 30 to 40 different users per day. I probably averaged reporting 30 posts per user. Sometimes they got banned at once, other times after a few hours. Each post required 8 clicks to report. So about 300 clicks per day, plus scrolling and waiting for pages to refresh. An admin could have banned all of the users in perhaps 5 clicks per user (which would delete all their posts in bulk at once). I decided it was a waste of time and stopped.

    I periodically check and estimate how much spam remains. It only takes a few minutes. On the list of all posts with no reply I count the spam on every 10th page (you can specify the page number in the url), then every 100th page, etc. Today I repeated this and most pages had 18 to 20 spam posts back to page 2200 (20 posts per page). I estimate that 40,000 spam posts remain in the TechNet forum, going back to March 11, 2016, when I quit. I state that it is a waste of time for anyone to deal with this, except perhaps in the forums they frequent. Even then, some forums have had to be abandoned. For exaxmple:

    https://social.technet.microsoft.com/Forums/en-US/home?forum=TechnetSandboxForum

    https://social.technet.microsoft.com/Forums/en-US/home?forum=fastlegacy

    forum=fastlegacyhttps://social.technet.microsoft.com/Forums/en-US/home?forum=SCMDM

    https://social.technet.microsoft.com/Forums/en-US/home?forum=winphonegeneral

    https://social.technet.microsoft.com/Forums/en-US/home?forum=TechNetEvents

    https://social.technet.microsoft.com/Forums/en-US/home?forum=biztalkhis

    Yes, the administrators should deal with this. But they are trying to do it with software, a spam filter. This will not work. If they ever get it to work, it would require constant update. They would spend more time on the filter, and fixing the false positives that result, then banning the users. I have suggested several times that the fix is for the forum administrators to do one of two things. Either:

    1. Periodically look at the forums home page and filter on posts with no reply (all forums). Select each user, look at their profile activity tab, and scan the list. No need to open any posts, just look at the titles. They are obviously spam. Then ban the user. Or,

    2. Automatically ban any user with 0 recognition points that submits more than 10 posts in, say, 15 minutes. The odds are 99.999% this is a spammer. If that is too risky, at least have the admins alerted whenever this happens. Then they can review the user activity and ban the user.


    Richard Mueller - MVP Enterprise Mobility (Identity and Access)

    Friday, May 6, 2016 9:14 PM
    Moderator
  • Please mark a few of them as SPAM and send a link to that forum to fissues at microsoft dot com notifying them about the SPAM. I normally do that when I notice such SPAM.

    For every expert, there is an equal and opposite expert. - Becker's Law


    My blog


    My TechNet articles

    Thursday, May 5, 2016 4:40 PM
    Moderator

All replies

  • Please mark a few of them as SPAM and send a link to that forum to fissues at microsoft dot com notifying them about the SPAM. I normally do that when I notice such SPAM.

    For every expert, there is an equal and opposite expert. - Becker's Law


    My blog


    My TechNet articles

    Thursday, May 5, 2016 4:40 PM
    Moderator
  • Here you go. I have marked few as SPAM.

    https://social.technet.microsoft.com/Forums/windowsserver/en-US/0534c2f8-cb56-4d9f-8d59-9290e5dccc43/-?forum=winserverGP

    https://social.technet.microsoft.com/Forums/windowsserver/en-US/d3214d92-48c6-411d-acdf-290c1462896b/-?forum=winserverGP


    Devaraj G | Technical solution architect

    Thursday, May 5, 2016 4:45 PM
  • Did you also email to fissues at microsoft dot com for good measure?

    For every expert, there is an equal and opposite expert. - Becker's Law


    My blog


    My TechNet articles

    Thursday, May 5, 2016 5:18 PM
    Moderator
  • No Naomi, not yet. should I now ? to fissues@microsoft.com

    Devaraj G | Technical solution architect


    • Edited by Devaraj G Thursday, May 5, 2016 5:37 PM
    Thursday, May 5, 2016 5:29 PM
  • Yes, if the SPAM messages are still there.

    For every expert, there is an equal and opposite expert. - Becker's Law


    My blog


    My TechNet articles

    Thursday, May 5, 2016 5:46 PM
    Moderator
  • The ones you reported abusive are gone, but they only ban the user that posted the spam you reported. There are still spam posts by other users in that forum. You need to report a few (maybe 10) posts by each separate user.

    I know this seems stupid, but that is the only way the forum admins deal with this. They only deal with spam that is reported, by banning the users (which deletes all their posts in bulk). They never seem to look for spam. That is why the last time I checked (a few weeks ago), there were still more than 30,000 spam posts remaining the forums. Several forums are no longer used because of this. I personally only deal with spam in the forums I moderate.


    Richard Mueller - MVP Enterprise Mobility (Identity and Access)

    Thursday, May 5, 2016 6:00 PM
    Moderator
  • I have reported SPAM for 10+ Threads.

    Below is the use creating the SPAM threads - "barbienam05"

    Indeed Richard, am unable to work on Group policy forums at all due to this SPAM. :(


    Devaraj G | Technical solution architect

    Friday, May 6, 2016 11:18 AM
  • Again I have reported few more from user GFJGHJ.


    Devaraj G | Technical solution architect

    Friday, May 6, 2016 4:25 PM
  • As I suggested, please report the forum to fissues at microsoft dot com. Let them work through all the SPAM in that forum. You can also report a few users.

    For every expert, there is an equal and opposite expert. - Becker's Law


    My blog


    My TechNet articles

    Friday, May 6, 2016 5:11 PM
    Moderator
  • For some reason there is still one spam post by barbienam05 in the GP forum. It may have been posted after you reported this posts as spam. The admins should have banned the user, which removes all posts in bulk at once. Strange, the profile shows no activity at all, so I guess the user is banned. The remaining post must be an anomoly.

    I see nothing by GFJGHI, so I guess that user was banned.

    If we report enough posts by each user, the admins seem to ban the users. Sometimes it can take them a few hours. It just seems a waste of our time. The admins can find them as easily as us, and deal with them in much less time than it takes us to report the posts.


    Richard Mueller - MVP Enterprise Mobility (Identity and Access)

    Friday, May 6, 2016 5:19 PM
    Moderator
  • Yes Naomi, I have sent. Thanks.

    Devaraj G | Technical solution architect

    Friday, May 6, 2016 5:36 PM
  • Yes Richard. Now, SPAM threads got removed, except the one from user "barbienam05".

    Correctly said, admins have to put some measures to avoid this kind of situations.


    Devaraj G | Technical solution architect

    Friday, May 6, 2016 5:38 PM
  • During the first 1 and 1/2 weeks of March, I reported all spam in all TechNet forums as abusive. I spent 3 or 4 hours per day doing this. All spam was deleted, and the users were banned. I find no spam now before March 11, 2016.

    It was easy to spot. I went to the TechNet forums home page, and did not select any forums. I filtered on all posts with no reply. I saw almost nothing but spam. I estimate there were 30 to 40 different users per day. I probably averaged reporting 30 posts per user. Sometimes they got banned at once, other times after a few hours. Each post required 8 clicks to report. So about 300 clicks per day, plus scrolling and waiting for pages to refresh. An admin could have banned all of the users in perhaps 5 clicks per user (which would delete all their posts in bulk at once). I decided it was a waste of time and stopped.

    I periodically check and estimate how much spam remains. It only takes a few minutes. On the list of all posts with no reply I count the spam on every 10th page (you can specify the page number in the url), then every 100th page, etc. Today I repeated this and most pages had 18 to 20 spam posts back to page 2200 (20 posts per page). I estimate that 40,000 spam posts remain in the TechNet forum, going back to March 11, 2016, when I quit. I state that it is a waste of time for anyone to deal with this, except perhaps in the forums they frequent. Even then, some forums have had to be abandoned. For exaxmple:

    https://social.technet.microsoft.com/Forums/en-US/home?forum=TechnetSandboxForum

    https://social.technet.microsoft.com/Forums/en-US/home?forum=fastlegacy

    forum=fastlegacyhttps://social.technet.microsoft.com/Forums/en-US/home?forum=SCMDM

    https://social.technet.microsoft.com/Forums/en-US/home?forum=winphonegeneral

    https://social.technet.microsoft.com/Forums/en-US/home?forum=TechNetEvents

    https://social.technet.microsoft.com/Forums/en-US/home?forum=biztalkhis

    Yes, the administrators should deal with this. But they are trying to do it with software, a spam filter. This will not work. If they ever get it to work, it would require constant update. They would spend more time on the filter, and fixing the false positives that result, then banning the users. I have suggested several times that the fix is for the forum administrators to do one of two things. Either:

    1. Periodically look at the forums home page and filter on posts with no reply (all forums). Select each user, look at their profile activity tab, and scan the list. No need to open any posts, just look at the titles. They are obviously spam. Then ban the user. Or,

    2. Automatically ban any user with 0 recognition points that submits more than 10 posts in, say, 15 minutes. The odds are 99.999% this is a spammer. If that is too risky, at least have the admins alerted whenever this happens. Then they can review the user activity and ban the user.


    Richard Mueller - MVP Enterprise Mobility (Identity and Access)

    Friday, May 6, 2016 9:14 PM
    Moderator
  • #2 is very reasonable thing and should have been implemented long time ago. Perhaps you can email this thread to fissues with these suggestions one more time.

    For every expert, there is an equal and opposite expert. - Becker's Law


    My blog


    My TechNet articles

    Friday, May 6, 2016 9:32 PM
    Moderator
  • Naomi,

    I just emailed them again. Will see what they reply. The last time their reply was essentially, don't worry, we are working on a spam filter. That was late March.


    Richard Mueller - MVP Enterprise Mobility (Identity and Access)

    Friday, May 6, 2016 10:12 PM
    Moderator
  • Wow, a better response than I expected:

    ====== quote ========

    Thank you for your valuable feedback and appreciate for your support in terms of helping to mark the SPAM.

    In fact our engineering team is actively working on this to implement the CAPTCHA within the forums to stop the bulk spamming. We will let you know as soon as we get the update from them.

    However, we will consider your below mail given guidelines and work accordingly to clean the SPAM .

    ====== end quote =======

    There seems to be hope. I thought they used CAPTCHA already when someone creates an account. I guess not. But I don't believe the account creation is automated. It could be that real people create the accounts.


    Richard Mueller - MVP Enterprise Mobility (Identity and Access)

    Friday, May 6, 2016 10:59 PM
    Moderator
  • Captcha?? So will we all be taxed every time when posting and replying, because of these mysterious "spammers"?

    Complicated captchas are annoying, simple captchas are easy to crack.

    Note that all posters have registered MS accounts and have agreed to the user agreement.

    Meanwhile, be careful when you report spam posts. They can be booby trapped.

    Many vulnerabilities were published recently in rendering exotic character sets.

    Open suspicious posts in fully patched browsers, be safe.

    This does not look like spam (advertisement) at all -  simply because it is silly to post ads in abandoned forums that no one reads. So what this can be? Botnet control or... communication channel for bad guys?

    Regards,

    -- pa



    • Edited by Pavel A Saturday, May 7, 2016 12:43 AM
    Saturday, May 7, 2016 12:12 AM
  • I just got an "update" to my email of 5 days ago. The issue has been escalated to the engineering team, who are actively working on "another option". Sounds encouraging. Of course, it is important that they not reveal too much about their "option", as it would assist the spammers.

    Richard Mueller - MVP Enterprise Mobility (Identity and Access)

    Wednesday, May 11, 2016 1:07 PM
    Moderator
  • I just got an "update" to my email of 5 days ago. The issue has been escalated to the engineering team, who are actively working on "another option". Sounds encouraging. Of course, it is important that they not reveal too much about their "option", as it would assist the spammers.

    Richard Mueller - MVP Enterprise Mobility (Identity and Access)


    Excellent. Thanks for the update Richard :)

    Devaraj G | Technical solution architect

    Wednesday, May 11, 2016 1:33 PM