bringing this back up, seeing as spambots still come roaming around here from time to time
I think it's best to not allow new accounts to post links unless it's from pastebin, until they've reached a minimum of 5 posts
Forums don't work like that out of the box, and if you wrote in the necessary stuff to do just this (bar minus whitelist) on the URL tag it would significantly increase the overhead of queries made each time a post is displayed (the actual parser runs when a post is displayed, not when it's input; doing it the other way presents other... complications, let's leave it at that. It's possible to write a filter at post time, but what it could break would be... interesting). The average URL density on threads like the Modded Minecraft News thread would really take the parser for a spin each time somebody opened the page. I personally don't like seeing the Cloudflare offline screen that much, but this week has been pretty choppy in general since I've been forced into using Twit Warble for my internet so I'm just grumpy on that count in general.
Now, barring the URL bbcode entirely until X post count? Much less overhead, but no doubt somebody just registering and going straight to Bug Reports would have a flip-out or some other edge case would irritate somebody. A great deal of folks don't register an account here until they have an issue to report. I actually happen to use this solution on other forums I administrate (although I peg the number at 15 posts), but they don't have the same requirements for providing URL links.
that should stop pretty much most of the spambots that come through seeing as they're all new members with no posts including a link in their first post
If the bots were rational human actors you'd have a point. They aren't. Other than the occasional really really weird witch doctor voodoo-type ads (which were some actual true
spam bots and within 3 minutes would be slamming away at providing URLs if the above solution were applied), these bots are posting a single advertisement and not logging in ever again anyway. The people writing and running these bots know they're expendable and don't really care and don't even check (for example, look at how many of them include HTML code, which the forum never allows to be parsed). Their strategy isn't just hitting poor little ol' FTB, it's to blanket every forum en masse that they can manage to get a registration ping on (and FTB, being a site with a very significant younger audience, tends to have straighter human verification to navigate for them to do so).
Now, what I
am tired of seeing is waking up to having had one or two such posts and seeing people
replying to the damn things who didn't hit the Report button (a couple I've even seen just posting "I've reported you!" and
they didn't actually hit send on the Report. The bot isn't reading and quaking in it's boots so why bother replying with anything?!). You're going to lose your internet points for snark the moment we spamhammer the original poster, so why are you people bothering? Report and move on, it'll get clicked when a human being can get to it.
TL;DR: The only solution on the planet that's 100% effective vs. spambots is to not have a site at all. Report and move on.