A heads up on spam prevention measures

[denise]

Due to recent increases in spam account registration (over and above the already-high baseline levels of spam account registration!) and the amount of our administrative time that dealing with spam is costing us, it's highly likely we will need to start playing around with more aggressive measures to block spammers in the next few weeks. We already use quite a few spam account creation prevention techniques, but there's been a worldwide increase in the amount of abusive/spam traffic over the last six months or so, and we're at the point where we need to start getting much more aggressive about filtering it.

Generally speaking, we try to use the least restrictive measures of spam blocking that we can, because any form of spam blocking can impact legitimate use of the site. If you start getting 403 errors when accessing the site, or you are asked to solve a captcha from our hosting provider (the graphical captcha that shows on a separate page, not the text-based one that shows on the same page) before proceeding to the page you're trying to load, and you are not using a VPN service, please email support@dreamwidth.org with your IP address and let us know. If you don't know your IP address, you can look it up at whatismyip.com.

If you are using a VPN provider and you get these errors, I am incredibly sorry, but we probably won't be able to help. We know that many of our actual-person users use VPNs for privacy and security reasons or to circumvent government restrictions on accessing the site, and we are trying our very best to keep those services able to access Dreamwidth. Unfortunately, VPN services are also a major source of our abusive traffic, especially the free ones, and it's impossible for us to distinguish legitimate traffic from abusive traffic automatically. You are less likely to have problems with paid VPN services, but even those are the source of a lot of spam: our two main VPN sources of abusive traffic are NordVPN and Proton VPN. We're trying very, very hard to not have to block VPN services entirely, but the problem is getting much worse. If you subscribe to either, you may want to contact them and tell them that you've been having problems accessing sites you regularly use because of the amount of abusive traffic that comes from their network.

We will continue to tweak our spam prevention measures as much as we can to avoid interfering with legitimate traffic, and I apologize in advance if we wind up temporarily interfering with your use of the site as we try to stop the garbage we're drowning in.

Comments

[the_broken_tower]

Completely understandable and unfortunate the abusive traffic is becoming such a problem. Thanks for the heads up!

- Ellie (she/her)

[havocthecat]

Can you give us a heads up if you plan on blocking any of the VPN services? I use a paid VPN for my own reasons and I totally support your spam-blocking measures! But I would like to know if I need to alter my Dreamwidth access processes if I have to. Which I will do in order to keep supporting you.

And I'll try letting them know, but uh, you know. Idk how much it'll work.

[denise]

An outright block on accessing the site entirely would be the absolute last resort -- we have a lot of steps we can take before that.

[ninetydegrees]

Thanks for the heads-up! That explains the captcha I get :)

[vesper_evensong]

Thank you for your efforts in these areas. It has made DW a very decent place to be. I migrated from LJ because it's hard to use for Americans now, and as I've used DW I have appreciated the regular updates on things, and how hard you all work to keep things up and running smoothly.

[nerakrose]

Ah that confirms why I was getting 403 error messages when I had my VPN on the other day (I use NordVPN). I did figure it was a VPN thing as I’ve run into similar on other sites so didn’t log an error message. It’s not a big deal for me, though I understand it might be more of an issue for others.

I was wondering, and this may not be viable at all, is it possible to flag and exempt logged in accounts that use VPNs so this doesn’t happen for them? As in, my user account at fanlore has that kind of account flag (I reached out to them about it) so that I can access and edit entries even when my VPN is on, that was something they were able to do. The infrastructure here may be completely different though so this may not be a helpful suggestion at all!

[devilc]

I would just like to echo this suggestion.

[morrow]

Fair enough!

[watersword]

Thanks, I hate it! (I don't hate you, D. I hate that spam is still a problem.)

[denise]

My rant about the economics of spam and the diffusion of responsibility for handling it is about 45 minutes long and involves a lot of uses of the word "fuck".

[house_wren]

Thank you for all your work!

[scissorsevered]

Maybe some sort of invitation system would work for curbing spam accounts, similar to how AO3 runs their signups? I know it would place a damper on the number of people signing up at a time but it would seriously reduce the number of accounts being made just to spam.

This isn't me trying to say what you're doing isn't good, because we all really do appreciate the hard work you put into running this site! I'm sure trying to block spam and ensure user privacy at the same time is a pain in the ass lol. But we have faith in you :D

[medusahealing]

Funny enough, DW actually started with an invitation system. You had to have an invite to set up your account.

Dam spam!

[elderwitty]

Thank you for fighting the scourge that is spam!

Is this why I've needed to login two days in a row? It's usually only a couple of times a month or so.

(I'm not upset, just curious.)

Re: Dam spam!

[denise]

Nope, that should be unrelated! make sure you don't have any extensions installed that are interfering with your cookies -- we especially find that any of the login juggler extensions are really prone to causing login problems.

[kore]

BOO SPAM. I was followed by at least twenty empty pornbots on Tumblr last week. I've given up playing whack-a-mole with them. I am so glad DW fights spam with a fury!

[innitmarvelous_og]

Aren't the p*rnbots on Tumblr awful? I am soooooooooo sick of them too, especially the ones that are not an empty account!

[vriddy]

Sorry to hear spam is becoming an even worse problem. Thank you for all the good work!

[ex_flameandsong751]

Thank you for staying on top of the spam, which sounds super annoying to deal with.



Since other people brought up that DW used to have invite codes [and Ao3 still does], might it be possible to re-implement this? Would it have at least some impact on the amount of spam account registrations?

[tessitura]

While I am not trying to speak for them, my best guess as to why they don't use invite codes now is the large amount of roleplayers on the site.

[murphys_lawyer]

Another vote for some sort of other check if you have a VPN. I use one of the ones you've mentioned, and while I'm resigned to always being "randomly selected" to take a Captcha every time I visit here, I absolutely loathe them, especially when I'm one pixel out on selecting something.

[denise]

I know it's annoying, and I'm really sorry. But 80% of our account creation is spam on a bad day (a good day is only 40%), and of that, easily a third of it comes from those two VPN services -- and we're not the only ones who have that problem. (The visual captcha comes from our hosting provider, who uses data about abusive behavior across all the sites they host: if you're getting the captcha from them, it means you're on an IP that has been demonstrating sustained, consistent bad behavior.) We're trying very hard to use the least restrictive means possible to handle things, because we absolutely know that VPNs are an important privacy and security tool, but we're absolutely drowning here and we're not the only ones. Those two providers in particular are the source of so much garbage, internet-wide, that it really is important that they keep hearing from their customers that more and more sites are restricting their IPs and they really need to start removing abusive customers.

[groovesinorbit]

Thank you for all your hard work!

[filialucis]

Hmm, thanks for this detailed explanation of the issues. I use a different VPN and have been considering switching to either NordVPN or ProtonVPN when my subscription expires later this year. I'm less likely to do so now that I know that they're known sources of spam!

[denise]

Every VPN is going to be a source of spam and other abusive traffic -- the free VPNs more so, but even the paid VPNs, because spamming is so profitable that the cost of the VPN subscription is almost nothing in comparison -- but those two are currently the worst, yeah. There are a few other paid services that are bad-but-not-as-bad, but those two are the bane of my existence. (Which sucks, because from the user end they're both really good services and I'd love to be able to recommend them to people who ask me what VPN to use! But unfortunately, people also recommended them to the spammers.)

[mdlbear]

Thanks for the heads-up, and for your good work. I'm not having any problems so far, but it probably explains the persistent CAPTCHAs I've been seeing on other sites.

[chicklet_chatter]

Thank you for the update. I was seriously considering going to VPN soon. This is a major point against that option. Thank you very much for informing us!

Chicklet - They/Them

[arkessian]

Can I steal some of these words for a site I moderate where VPN users are getting annoyed (nay, abusive) because they're being blocked by our spam filtering service.

[denise]

Feel free!

[lovingboth]

Yep, sympathy. I do consultancy for a message board and what used to be a problem with Tor exit nodes is now a problem with VPNs... as well.

[denise]

Yeah. Spammers fucking ruin it for everyone, part 824934.

[albedinous]

Thank you, Denise! I'm not affected by VPN issues, but appreciate the heads up; four hours is SO much spam-detection, my goodness.

I'm going to go renew my paid account, because you guys seriously deserve a coffee after all this.

[pritkiy_kaban]

Yup, browser plugins and Proton tend to trigger (almost) blanket 403 when using free plans.

Knowing how deeply spam and ad industries metastased into current Web economy, I hate them filters much like I hate lying in dentist's chair for costly treatment of acute pulpitis.

[omnicat]

I remember you mentioned an unusually steep, internet-wide uptick in spam this year in an earlier Maintenance post too. Do you peeps in the business have any indication of the reason this is happening?

[denise]

Everybody's got their own pet theories, and it's hard to know which one is correct! My pet theory is that it's a combination of multiple factors: Google being less committed/less able to block "this URL has been heavily spamvertised and so should get a search engine penalty", various economic factors in terms of income/purchasing power disparity making backlink spamming a more lucrative career for people in the countries most of the spam is coming from, and the prevalence of ChatGPT making it easier/cheaper/faster to generate both the backlink spam and the sites being spamvertised are all things I think play into it. (I am virtually positive that I'm missing a few factors in the analysis.) I also have a massive grudge against Fiverr, which is where most of the people doing this get hired. (99% of "digital marketing experts" on Fiverr are fronts for the spam factories.)

[cellio]

Thank you, as always, for your thoughtful and transparent communication, and for the great service. I was wondering why I was getting those captchas (I just started using AdBlock VPN). I can disconnect when using DW, and don't mind that minor hassle to help the spam monster from expanding even more. Grr, spammers ruining things for all the rest of us...

[denise]

It is just so exhausting trying to keep up.

[redwolf]

Huh. I wonder if this is the same bullshit I'm being inundated with on a corporate mailing list.