Spammers: Difference between revisions

From Freegle Wiki
Caroline (talk | contribs)
No edit summary
Wiki revamp: restructure & modernise
 
(53 intermediate revisions by 6 users not shown)
Line 1: Line 1:
Spam is the Internet equivalent of junk mail - email you didn't ask for, and probably don't want. It's sent by spammers, usually using automated tools (aka: spam bots). Freegle members will often have their own spam filters to detect and remove spam. The following just covers what you can do as a moderator to reduce the chance of your Freegle group being used for spam.
Spam is the internet equivalent of junk mail - email you didn't ask for and probably don't want. Freegle members often have their own spam filters to detect and remove it.


Spammers attack Freegle either by sending spam to the group, or by collecting members email addresses from the posts they have made to the groups and using them to send spam.
With Freegle Direct Version 3, filters intercept most spam.


Sending spam to the group.
Suspect messages and email addresses (members) can be reported in ModTools, using the Spam and Spammer buttons respectively.


There are three ways this can be done:
Full details on possible spam posts and spamming are below. See also https://discourse.ilovefreegle.org/t/spam-run/5438/10 for an explanation of the different treatment for spam messages and spammers.


1.  Spammer joins the group and sends spam.
==ModTools main menu==


You can combat this by:
===Options when posts are displayed===
[[File:newspam1.jpg|200px]]


* Moderating new members until they have posted a valid OFFER. Many spammers join a group and immediately send a message - if you moderate new members then the spam will show up in your Pending queue. Don't reply to it, just delete it - replying to spam just tells the spammer that they've reached a human, which is what they're trying to do. Most spammers either aren't clued-up enough to send a valid OFFER to get off moderation before sending their spam.
====Messages: Pending====
[[File:newspam2.jpg|799px]]


* Requiring applications for membership to be approved. This means more work for you, but again, spammers generally aren't astute enough to provide a valid reason for joining. (link to 'pre-approving members' pros and cons here -not that i've written it yet or anything!) "This is labour intensive, but it's easy to make it happen automatically."
Automated system checks may result in a message being shown under Pending messages, with the reason it was flagged for review shown. Make your own judgement about whether it's a genuine, valid post. If not, clicking the red Delete as Spam button deletes the post and feeds information to our spam filters.


* Keeping an eye on the FCModSpammers group - report spammers to it, and actively remove reported spammers from your list.     FCMODSpammers@yahoogroups.com  Checking this manually is quite labour intensive, but it's easy to make happen automatically. Here is the relevant entry in the plug-in wiki: http://wiki.modplugin.org/index.php/Spammer_List
To report the sender as a spammer, see [[#SPAM checking before submission|SPAM checking before submission]] below. If reporting the member, don't delete the post - hold it for the Spam team to review.


2. Spammer impersonates ("spoofs") an existing member, and sends spam which appears to come from that member.  
====Messages: Approved====
[[File:newspam3.jpg|606px]]


There's basically nothing you can do about this - it's quite easy to forge email and make it appear to come from a valid user (it doesn't require their Yahoo password). So if you see an existing user send spam, don't assume that they've done this personally -it may be that someone is impersonating them. Look at the members posting history to verify this, often very active members and even moderators are targeted by this kind of spammer. Place the user on moderation for a while, to allow you to catch any other such messages, and contact them gently to check.
Again, make your own judgement about whether it's genuine and valid. If not, clicking the red Delete as Spam button deletes the post, and that information is used behind the scenes to train our spam filters.


3. Spammer hacks into a members email account and sends spam to the group.  In this instance you will see when the email arrives in your inbox that their whole address book has been cc-ed. Again, put the member on moderation. You could contact them and let them know gently that their email account may have been hacked, there is an 'automated vacation reply' being sent out that they should switch off and they may wish to consider changing their password and running a full security scan on their computer.
===Options when members are displayed===
[[File:newspam5.jpg|200px]]


=Harvesting member addresses and using them to send spam=
====Members: Approved====
[[File:newspam6.jpg|605px]]


A spammer joins the group, and then extracts email addresses from the message archive, or from emails that get sent to the group. They can then send spam directly to those addresses, without passing through your group. This requires quite a persistent spammer, so it's rare, but because it doesn't go via the group there's little you can do about it. The advice above for dealing with spammers who impersonate or hack into member’s accounts can help identify the culprits who might be doing this. There is also a feature on the plug-in called the Membership crosscheck, <---hyperlink here: http://wiki.modplugin.org/index.php/Membership_Crosscheck With this feature you can check your membership list against that of a group that is nowhere near your own. Someone who is a member of multiple groups that are not close together might well be a spammer.
If, after thorough checking, you're certain someone is a spammer, use the Report Spammer button on their details under Members > Approved to submit a report for review. See [[#SPAM checking before submission|SPAM checking before submission]] for guidance.


The Remove and Ban buttons only apply to your community.


Check recently joined members<---hyperink here: http://wiki.modplugin.org/index.php/Check_Recently_Joined_Members This feature allows you to identify people who've probably joined multiple groups at once, and who therefore need extra investigation to show that they're not spammers.
====Chat Review====
:''See also: [[Member Chat#Chat Review in Modtools]]''
 
[[File:newspam8.jpg]]
 
Chat Review button options:
 
[[File:newspam9.jpg]]
 
Click View Chat to see why the system flagged it. A member may have included a phone number, email address, or website link for illustration, which is fine. An offer to pay petrol money for an item is not suspicious, and is a local community decision - you can approve the chat.
 
If you'd rather the recipient not see the chat, click Delete. If it's definitely spam, click Spam - this deletes the message and trains the spam filter (it doesn't generate a report to the spammer list team; to do that, report the member from their member page). Use Approve and Whitelist the same way as the Whitelist button on Approved members.
 
We're legally allowed to do this (confirmed with the regulator) for detecting spam and scams. If we find other rule violations while doing so, we're allowed to act on them.
 
You'll see chat messages here for review if the recipient is a member of one of your communities. You might see some where the conversation is about a post on another community, since the system can't reliably tell whether a message relates to a specific post, multiple posts, or no post at all - it's fine to act on it if you see it.
 
Communities can opt in (via ModTools Settings) to "Quicker Chat Review", where held messages are also shown to volunteers on other communities for review. If a message is fine, they can release it promptly; otherwise it's left for local volunteers to act on.
 
If there are multiple messages for review, you may see a "Delete All" button at the end, introduced to deal with mass spam - it stops all displayed messages from being sent. For messages shown to other communities' volunteers via "Quicker Chat Review", this button does nothing.
 
==Spammer details held by the system==
Accessed via the ModTools menu on the left:
 
[[File:newspam10.jpg]]
 
This shows the options:
 
[[File:newspam11.jpg]]
 
'''Confirmed Spammers''' - members confirmed as spammers. Reports are reviewed before a member appears on this list. Once listed, they're banned from all Freegle communities, and warning messages are sent to anyone who's corresponded with them. If you're certain someone isn't a spammer, submit a removal request at https://discourse.ilovefreegle.org/c/tech/3, with good reasons - your request will be reviewed.
 
'''Pending Add''' - members reported as spammers by a moderator, pending review before being added to the list. Remember people may not be spammers even when reported - for example:
*Members may join many communities because they're over-enthusiastic, or have relatives in different places
*Mail can be spoofed, or accounts hacked, so a member can appear to send spam without being a spammer
 
To be added to the list, someone needs clear intent to deliberately spam or scam, or be a serious multi-joiner. Only a limited number of people can confirm or reject someone as a spammer.
 
'''Whitelisted''' - members exempted from the spammer list, generally because they have legitimate reasons to join many communities.
 
'''Pending Remove''' - members on the spammer list where someone has requested their removal.
 
==SPAM checking before submission==
Before clicking the white Spammer button, do some investigation:
*You may get a post from a new member offering one of the known scammer items
*You may spot something in Chat, or by other means, that looks highly suspect - e.g. "I have now moved to <some distant location> but courier fees to send it to you would not be expensive"
*Check the member's past posting and chat history, and how they use the community
 
If they make regular offer and wanted posts, they're unlikely to be spammers. Check a few chats - are they sending spam or scam-type replies, or genuinely arranging collections? If they're chatting normally, don't report them. No member should be reported without checking their past activity.
 
An isolated doubtful incident should be resolved with the member, or locally within your community - check whether their account has been hacked or spoofed.
 
For a suspicious new member, search their email address (or just the part before "@") to see if anything shows up. If a picture on a post looks like it's not from a domestic setting, search the image. A website link in a post may just be a useful illustration, so check it out.
 
Only report genuine spammers or scammers, and - rarely - someone you think could be a danger to other members. Even apparently odd people can be checked out to see what they're saying to members before being reported.
 
After this investigation, if you consider the person a serious risk to Freegle, use the white Spammer button on the Member Details page to submit your report, including as much helpful evidence as possible.
 
==Outcome of reporting spammers==
Your report is reviewed, and if the person is considered a real scammer, they're added to the Confirmed Spammer List. They're then banned from all Freegle communities, with warning messages sent to anyone who's corresponded with them - signed as coming from volunteers on the local community, so you may get unexpected replies.
 
If new facts come to light showing it was a false alarm, the person can be removed from the Confirmed Spammer List, but would then need to rejoin a Freegle community.
 
The Spammer Team can be contacted directly at spammerlist@ilovefreegle.org for further queries.
 
==ModTools settings for spam detection==
In ModTools > Settings > Community, there's a Spam Settings section, where you can switch on spam detection for your community, choose a distance, and add worry words relevant to your community. With these on, likely worrying messages are sent to you for review.
 
Communities vary in how they use this - many leave it entirely to members to decide how far away someone comes from. In London, where public transport is very good, some mods think this opens their community up to exploitation from "outside", while others think it's reasonable that people travel for work or pleasure. Some mods don't want their messages counted towards what they see as over-zealous distance restrictions in other communities with different views. Overall, experience shows members can be trusted to self-regulate distances, and restrictions are more likely to create onerous moderation duties and dissatisfied members than to stop exploitation.
 
==Procedure for the Support Team when reviewing spammer submissions==
We can't always rely completely on what mods report - reports aren't always accurate, and some are exaggerated or vague, so they need proper checking to avoid adding someone innocent. Approving everything on another mod's say-so would make the checking role pointless, so we need an agreed checking procedure.
 
When a spam report comes in, hold it first, so nobody else deals with it while you're checking it out.
 
Copy the reported member's email address or member number and go to Support Tools. In 'Find member', paste the email or number, and their membership pops up with details of how they use the community.
 
If they make regular offer and wanted posts, they're unlikely to be spammers. Check a few chats - are they sending spammy or scam-type replies, or genuinely arranging collections? If they're chatting normally, don't add them to spam. No member should be added without checking their past activity. If they're not spammers, reject the report and email the reporting mod to explain why, copying in Support.
 
Only add genuine spammers or scammers, and - rarely - someone who could be a danger to other members (there have been a couple of cases added for member safety). Even odd people can be checked out to see what they're saying to members before being added.
 
*If a member is NOT to be added to the spammer list, email an explanation to the reporting moderator, copying spammerlist@ilovefreegle.org
*If a member IS to be added, email an explanation containing the spamming member's email and the reason to spammerlist@ilovefreegle.org
 
That's the fairest way to handle it for the member concerned - there's nothing worse than losing all your communities and chats mid-way through arranging collections.
 
==Links==
*Email address for the Spammers Team: spammerlist@ilovefreegle.org
*[[Specific Problems]]
*[[How To Deal With]]
*[[ModTools#Messages]] - marking an Offer/Wanted message as spam
*[[Spam]] - responding to complaints about Freegle emails
 
[[Category:Moderating with ModTools]]

Latest revision as of 12:00, 17 July 2026

Spam is the internet equivalent of junk mail - email you didn't ask for and probably don't want. Freegle members often have their own spam filters to detect and remove it.

With Freegle Direct Version 3, filters intercept most spam.

Suspect messages and email addresses (members) can be reported in ModTools, using the Spam and Spammer buttons respectively.

Full details on possible spam posts and spamming are below. See also https://discourse.ilovefreegle.org/t/spam-run/5438/10 for an explanation of the different treatment for spam messages and spammers.

ModTools main menu

Options when posts are displayed

Messages: Pending

Automated system checks may result in a message being shown under Pending messages, with the reason it was flagged for review shown. Make your own judgement about whether it's a genuine, valid post. If not, clicking the red Delete as Spam button deletes the post and feeds information to our spam filters.

To report the sender as a spammer, see SPAM checking before submission below. If reporting the member, don't delete the post - hold it for the Spam team to review.

Messages: Approved

Again, make your own judgement about whether it's genuine and valid. If not, clicking the red Delete as Spam button deletes the post, and that information is used behind the scenes to train our spam filters.

Options when members are displayed

Members: Approved

If, after thorough checking, you're certain someone is a spammer, use the Report Spammer button on their details under Members > Approved to submit a report for review. See SPAM checking before submission for guidance.

The Remove and Ban buttons only apply to your community.

Chat Review

See also: Member Chat#Chat Review in Modtools

Chat Review button options:

Click View Chat to see why the system flagged it. A member may have included a phone number, email address, or website link for illustration, which is fine. An offer to pay petrol money for an item is not suspicious, and is a local community decision - you can approve the chat.

If you'd rather the recipient not see the chat, click Delete. If it's definitely spam, click Spam - this deletes the message and trains the spam filter (it doesn't generate a report to the spammer list team; to do that, report the member from their member page). Use Approve and Whitelist the same way as the Whitelist button on Approved members.

We're legally allowed to do this (confirmed with the regulator) for detecting spam and scams. If we find other rule violations while doing so, we're allowed to act on them.

You'll see chat messages here for review if the recipient is a member of one of your communities. You might see some where the conversation is about a post on another community, since the system can't reliably tell whether a message relates to a specific post, multiple posts, or no post at all - it's fine to act on it if you see it.

Communities can opt in (via ModTools Settings) to "Quicker Chat Review", where held messages are also shown to volunteers on other communities for review. If a message is fine, they can release it promptly; otherwise it's left for local volunteers to act on.

If there are multiple messages for review, you may see a "Delete All" button at the end, introduced to deal with mass spam - it stops all displayed messages from being sent. For messages shown to other communities' volunteers via "Quicker Chat Review", this button does nothing.

Spammer details held by the system

Accessed via the ModTools menu on the left:

This shows the options:

Confirmed Spammers - members confirmed as spammers. Reports are reviewed before a member appears on this list. Once listed, they're banned from all Freegle communities, and warning messages are sent to anyone who's corresponded with them. If you're certain someone isn't a spammer, submit a removal request at https://discourse.ilovefreegle.org/c/tech/3, with good reasons - your request will be reviewed.

Pending Add - members reported as spammers by a moderator, pending review before being added to the list. Remember people may not be spammers even when reported - for example:

  • Members may join many communities because they're over-enthusiastic, or have relatives in different places
  • Mail can be spoofed, or accounts hacked, so a member can appear to send spam without being a spammer

To be added to the list, someone needs clear intent to deliberately spam or scam, or be a serious multi-joiner. Only a limited number of people can confirm or reject someone as a spammer.

Whitelisted - members exempted from the spammer list, generally because they have legitimate reasons to join many communities.

Pending Remove - members on the spammer list where someone has requested their removal.

SPAM checking before submission

Before clicking the white Spammer button, do some investigation:

  • You may get a post from a new member offering one of the known scammer items
  • You may spot something in Chat, or by other means, that looks highly suspect - e.g. "I have now moved to <some distant location> but courier fees to send it to you would not be expensive"
  • Check the member's past posting and chat history, and how they use the community

If they make regular offer and wanted posts, they're unlikely to be spammers. Check a few chats - are they sending spam or scam-type replies, or genuinely arranging collections? If they're chatting normally, don't report them. No member should be reported without checking their past activity.

An isolated doubtful incident should be resolved with the member, or locally within your community - check whether their account has been hacked or spoofed.

For a suspicious new member, search their email address (or just the part before "@") to see if anything shows up. If a picture on a post looks like it's not from a domestic setting, search the image. A website link in a post may just be a useful illustration, so check it out.

Only report genuine spammers or scammers, and - rarely - someone you think could be a danger to other members. Even apparently odd people can be checked out to see what they're saying to members before being reported.

After this investigation, if you consider the person a serious risk to Freegle, use the white Spammer button on the Member Details page to submit your report, including as much helpful evidence as possible.

Outcome of reporting spammers

Your report is reviewed, and if the person is considered a real scammer, they're added to the Confirmed Spammer List. They're then banned from all Freegle communities, with warning messages sent to anyone who's corresponded with them - signed as coming from volunteers on the local community, so you may get unexpected replies.

If new facts come to light showing it was a false alarm, the person can be removed from the Confirmed Spammer List, but would then need to rejoin a Freegle community.

The Spammer Team can be contacted directly at spammerlist@ilovefreegle.org for further queries.

ModTools settings for spam detection

In ModTools > Settings > Community, there's a Spam Settings section, where you can switch on spam detection for your community, choose a distance, and add worry words relevant to your community. With these on, likely worrying messages are sent to you for review.

Communities vary in how they use this - many leave it entirely to members to decide how far away someone comes from. In London, where public transport is very good, some mods think this opens their community up to exploitation from "outside", while others think it's reasonable that people travel for work or pleasure. Some mods don't want their messages counted towards what they see as over-zealous distance restrictions in other communities with different views. Overall, experience shows members can be trusted to self-regulate distances, and restrictions are more likely to create onerous moderation duties and dissatisfied members than to stop exploitation.

Procedure for the Support Team when reviewing spammer submissions

We can't always rely completely on what mods report - reports aren't always accurate, and some are exaggerated or vague, so they need proper checking to avoid adding someone innocent. Approving everything on another mod's say-so would make the checking role pointless, so we need an agreed checking procedure.

When a spam report comes in, hold it first, so nobody else deals with it while you're checking it out.

Copy the reported member's email address or member number and go to Support Tools. In 'Find member', paste the email or number, and their membership pops up with details of how they use the community.

If they make regular offer and wanted posts, they're unlikely to be spammers. Check a few chats - are they sending spammy or scam-type replies, or genuinely arranging collections? If they're chatting normally, don't add them to spam. No member should be added without checking their past activity. If they're not spammers, reject the report and email the reporting mod to explain why, copying in Support.

Only add genuine spammers or scammers, and - rarely - someone who could be a danger to other members (there have been a couple of cases added for member safety). Even odd people can be checked out to see what they're saying to members before being added.

  • If a member is NOT to be added to the spammer list, email an explanation to the reporting moderator, copying spammerlist@ilovefreegle.org
  • If a member IS to be added, email an explanation containing the spamming member's email and the reason to spammerlist@ilovefreegle.org

That's the fairest way to handle it for the member concerned - there's nothing worse than losing all your communities and chats mid-way through arranging collections.

Links