I have emailstoryloginrequired = 1 on my site. I had to do this because some spammer figured out how to use my site as a spam relay by hitting it with a network of bots running a script to mail stories from my site with their spam added to the front in the comment area.

With loginrequired, the user never sees the option to email a story unless he logs in. It would be nicer if the option was visible to anonymous users, and then they would be required to log in if they clicked it, the way some other features (like comments) work if login is required.

This would be nicer for casual users who stumble into the site and see something interesting. Now, they don't even know the email option is available. Most new users don't register or login until they do something that requires them to, and if they don't know the option is there, they'll never see it. Especially now that Remote Authentication makes logging in an easier option for casual visitors, it would be nice if the email story option was there to entice them to login, rather than being invisible unless they do.

I`d like to know if this is this a serious spam problem. Again I feel it would be helpful to have Capchas. One could use it for comments and for sending the stories. At least this would keep spam bot at bay.

On theo other hand you`d be astonisched who little use is being made of this email to a friend here on geeklog.net http://www.geeklog.net/stats.php

The maximum is 20 with one story. So I suppose people copy the browser position rather than noticing and using the email to a friend function.

It was a serious problem at one point. Last August, the infamous "Bulgarians" (who have been written about here, pumped a lot of spam through my site by using the "email this story" link. After I changed to require login, they kept pounding on it for a while before they gave up. Since then, I don't think I've seen any similar attempts, so it may be safe to allow anonymous users to mail stories again.

Hmm, I haven't heard about them doing email spam. Are you sure it was them?

bye, Dirk

Yeah ... because they were killing two birds with one stone. In addition to using my site to email their spam, they were also plugging their own spamsites into the referrer tag when they did it, to try to get links in my site stats.

Here's a sample log entry:

62.97.72.76.es.colt.net - - [06/Sep/2005:11:30:00 -0400] "GET /blog/profiles.php?sid=20041012110630334&what=emailstory HTTP/1.1" 301 354 "http://online-poker.quality-poker.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)"


Doesn't that "referrer" look familiar?

Yep, that's one of their domains. But that request only calls up the email form. Do you have a corresponding POST request?

Their spambot usually just referrer-spams each and every URL on a site, no matter what it actually does.

bye, Dirk

63.239.116.254.orlandotelco.net - - [30/Aug/2005:04:22:40 -0400] "GET /blog/profiles.php?sid=20030814220810812&what=emailstory HTTP/1.0" 200 13073 "http://www.antiquejunkyard.com/pacific-poker-room.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Hotbar 3.0)"
63.105.207.38.ns.uu.net - - [30/Aug/2005:04:22:46 -0400] "GET /blog/article.php?story=20031114221612496 HTTP/1.1" 200 17166 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"
64.76.142.170.impsat.cl - - [30/Aug/2005:04:22:48 -0400] "POST /blog/profiles.php HTTP/1.1" 200 129 "http://jmatt.net/blog/profiles.php?sid=20030814220810812&what=emailstory" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; KITV4.7 Wanadoo)"
wg-vm-zus.inext.cz - - [30/Aug/2005:04:22:52 -0400] "GET /blog/article.php?story=20030814220810812 HTTP/1.1" 200 17165 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"


I know the spam got sent, because I saw it in my qmail logs, and I got a lot of bounces.