can someone please explain what forum spam you are talking about? What type of posts? What should i look for ?

It tends to be Indonesian-language spam, usually advertising call centers for "customer service." Often the sort of thing that would lead to scams involving gift cards or "refunds you're owed."

StackonClown wrote: »

can someone please explain what forum spam you are talking about? What type of posts? What should i look for ?

That's been going on for a while now, in the early EU morning, (3-9ish UTC) some abandoned forum accounts suddenly log in again and fill the forum with spam in indonesian(?) promoting a phone number. Likely to convince search engine crawlers that this must be a really great number, when it's such a hot topic.

@ZOS_Kevin - Front page is pretty flooded again this morning.

These are all over the General Discussion front page again, lol

New user registration needs strengthened as well.

Syldras wrote: »

They aren't new, they're hacked.

I notice one word they used in every post during the last 2 spam attacks is not used anymore, so that probably went on a spam list? Sadly they seem to be flexible enough to adjust their posts accordingly to still go through.

I guess in the end, the only thing that works would be time-restricting the number of new threads a user can open.

Even requiring re-activation for accounts not used for a longer time wouldn't work, as one of today's accounts has still posted normally in February, just half a year ago.

Yes, but some initial account had to be made to inject the bots.
Requiring 2 factor identification on every login while a pain in the ass helped on my forums.

Vanilla while not being the best, does have tools.
https://success.vanillaforums.com/kb/articles/29-spam-prevention-detection

virtus753 wrote: »

joergino wrote: »

But there is one excellent and very effective counter measure in place. The spam "protection" prevents the second hacked account from being reported for ten minutes.

Doesn’t that only kick in when you’ve tried to post a second time within 60 seconds? (I guess flags can do that too.)

If you allow one full minute between your posts/flags, you shouldn’t incur the 10-minute spam penalty, unless they changed it in the past day or so.

Yes, I'm sure it does. But I attempted to report both accounts and obviously didn't need a minute to see and (attempt to) flag that more than one account had been compromised.

I was neither aware nor did I expect such a measure to be in place in the report function of all places! I thought forum spam is intended to be avoided, not reporting said spam.

Syldras wrote: »

I've seen the forum spam on 3 different days now, and each time I reported both accounts one right after the other, and the reports went through (indicated by that small text that shows up in the box afterwards). No error or anti-spam message showed up.

On the previous round, I hit a limit for the number of reports submitted, but maybe those were all spam from the same account? While checking my support page the other day, I also discovered that a bunch of reports had been deleted as duplicates, which is unsurprising.

Syldras wrote: »

LootAllTheStuff wrote: »

On the previous round, I hit a limit for the number of reports submitted, but maybe those were all spam from the same account? While checking my support page the other day, I also discovered that a bunch of reports had been deleted as duplicates, which is unsurprising.

It's always just two spam accounts at once. I only report each of them once and put a note to check their post history in the text box.

Yeah, typically 2 accounts each posting links for the other to clicky to generate SEO credit.

katanagirl1 wrote: »

More concerning than the spam is the fact that our accounts can be hacked.

The ones I've looked at in the past were typically someone creating an account to post a single question multiple years ago and then nothing since. (Or maybe a couple of early posts, but rapidly drying up.). At that age, anyone who was using something like hotmail, yahoo, etc. for their account has likely had their email address on hacker's lists for a long time - long enough for someone to crack/reset the password and sell on whatever is there.

That then gives access to the ESO account along with anything else tied to the same email. And if someone seriously hasn't used their forum account in that long, they probably haven't been checking that email either, so the account takeover may well go unnoticed. The owner might even have been locked out of their own email already.

I suspect this may also be contributing to the occasional spate of "I returned to ESO after n years only to find I'd been banned" posts we've seen. Even MFA is unlikely to help since some of those accounts may not have had it enabled before the owner simply stopped using them.

Short version: yes, it is scary that accounts can be hacked, which makes it all the more important to monitor your accounts regularly even if not actively playing. It sucks, but that's where we've got to. Adding passkeys as an authentication option would be welcome, though.

LootAllTheStuff wrote: »

Syldras wrote: »

I've seen the forum spam on 3 different days now, and each time I reported both accounts one right after the other, and the reports went through (indicated by that small text that shows up in the box afterwards). No error or anti-spam message showed up.

On the previous round, I hit a limit for the number of reports submitted, but maybe those were all spam from the same account? While checking my support page the other day, I also discovered that a bunch of reports had been deleted as duplicates, which is unsurprising.

I filed one report for the first account I saw, then a second for the next account and it said I had to wait 600 seconds (10 minutes) between reports.

@ZOS_Kevin it starts again

Another one on the front page already, lol