As to how this spammer is getting into moderator only areas and posting, It's probably a security hole in your bulletin board software. If at all possible, you may want to look at a newer version of the software you are using...
I'd have to pull up some of my IT security notes, but there are hundreds of ways he could be getting this ... stuff ... through. It sounds like he's bouncing them off of randomly chosen 'zombie' machines around the world...
Steve
(Former USENET Mod, current spam cleaner on the GO Ars Board).
When I delete spam (as I just deleted a half dozen this morning), I also delete the accounts posting it. Most of the time they only post one message. Our volunter de-spaminators don't have full admin privs, so they only delete messages, which leaves the spammer accounts accumulating -- but at least removes the spam from sight right away.
Some of what we are doing is blocking top-level domains. We've already blocked all of .info and .biz (since as far as we can tell only spammers have ever registered with those suffixes). I am checking .ua -- it looks like only Spammers use that too. Unfortunately a lot of spammers register with .pl addresses as well -- though I know we have customers in Poland (including a lot of translated sales of Dungeoneer), so I'm not quite ready to blacklist that whole country.
Anyhow, there's still a lot of deleting that needs to be done manually, but we'll hope that this continues to cut down on the volume a bit.
Y'all might notice that the number of registered users is now a lot smaller. I manually deleted about 1000 users today. I'm reasonably certain they were all spam. I added more top-level domains to the banned list, as examination showed that every person registered from them was pretty certainly a spammer. At a minimum, I know that we need to purge at least another 400+ .info "users" from our database, since as far as I can tell every single one of them was a spam registration.
I have also done some research on other options we might implement to cut down on the spam. One step will be to remove the "website" option for user profiles. A lot of spammers want to register an account just to put their website in that field, so that web-crawling bots will use it to rank their spam sites higher in search engines, etc. I know some people put their actual websites in that field, so this may be a minor inconvenience, but if it sticks it to the spammers it seems like a good idea.
If anyone had a REAL user account that I deleted by accident, please re-register, and accept my apologies. I tried hard not to delete people who had an actual history of posting, but it's been pretty mind-numbing work and I certainly may have made mistakes.
Just don't block out .il, I know for a fact there is at least one poster from Israel
I'm very surprised there aren't bots, filters, phBB add-ons, and so on to handle these things. You obviously spending a lot of time and effort on these things, so thanks !
In some cases there are such things that I've learned about. Unfortunately, I don't know anything about the back end of this place -- so I don't even know if there's a way to delete all accounts of a given domain (more than 400 of the remaining accounts are .info for example, and I believe they are all spam accounts), or delete all accounts that have zero postings (most of which are spammers, etc.); all I can find in the admin interface are much more labor-intensive ways of doing things.
I can tell you one interesting thing: 2/3 of the user registrations on our boards have come in the last 4 1/2 months. So it seems fair to say that the bulletin board spam problem has gotten sharply worse recently, on a quantitative level. Clearly something needs to be done about it, since it sucks up not only our time, but our resources, server capacity, etc.
