Spambots on the rise.

[DarkGizmo]

I'm getting bombarded by spambots, they seem to be 'legit' users but if you look further you can tell they're spambots. I have a question at registration and they all use the same nearly identical answer. They also use a slew of weird email addresses.

What can be done to prevent this going forward? I have a slew of email addresses/IP addresses banned, I have bot protection turned on in cloudflare.....

 

[Sim]

In addition to using Turnstile and having bot protection turned on and blocking a bunch of email domains that look randomly generated, I block registrations from a lot of countries using my addon:

Geoblock Registration

Nov 28, 2019

Ban or moderate users from specific countries when registering using Maxmind's GeoLite2 Database

• Sim
• geoblocking geoip geolite2 maxmind registration
• Add-ons [2.x]

... doesn't stop everyone, but has slowed the rate down substantially.

I also block registrations from various data centres at the ASN level using Cloudflare - although you need to be careful you aren't blocking legitimate bots when doing this.

I get probably 4-8 registrations per day that are not legit users, the vast majority of which are held for moderation and never get to post - it's fairly rare that we get actual spam posted on our forums.

 

[Matthew H]

What can be done to prevent this going forward?

I don't use Cloudflare, but...

• I have four pages worth of banned email domains and variations on legit domains commonly used by spammers
• I use an invisible hCaptcha
• And I use OzzModz' Registration Spaminator.

The last time a spammer successfully completed my registration form was 3 days ago.

 

[Max Taxable]

I thought you were a Spaminator customer?

 

[DarkGizmo]

I thought you were a Spaminator customer?

I am. Still getting some it would seem, could be real people signing up, but with the emails and places they're coming from, they appear to be very sketchy, plus their initial posts read in a very.....spammy matter.

I have a question on my registration asking what their purpose for joining is, and all 4 of them pretty much copy/pasted their responses, which gave away they're probably bots.

 

[Suzanne O]

Try @Xon's sign up an abuse and standard library add ons.
It might be the fact you need a combination of addons from a couple of people.

 

[Forsaken]

I am. Still getting some it would seem, could be real people signing up, but with the emails and places they're coming from, they appear to be very sketchy, plus their initial posts read in a very.....spammy matter.

I have a question on my registration asking what their purpose for joining is, and all 4 of them pretty much copy/pasted their responses, which gave away they're probably bots.

With how easy it is to integrate an LLM model into any basic bot, that type of question is not really going to stop much.

 

[FTL]

I use nothing more than XF's built in spam catcher with the parameters turned up to max and that's enough to catch everything, for me. I've got a whole slew of rejected accounts sitting there in the ACP which I was advised on here not to delete as they're used to prevent further spam registrations, which indeed they do. Pretty annoying to have my members list cluttered up like this, but I see zero spam and I don't have to go through a manual approval process to reject them either, which was previously a pita in itself.

 

[woody]

I get 700-1000 registrations a month. Maybe one spammer gets thru.

X

Signup abuse detection and blocking

Nov 20, 2018

Provides a toolkit to reduce signup spam

• Xon
• Add-ons [2.x]

I get about 6-7 'approval que" catches a day, if their timestamp and last online stamp are within 3 minutes, they sit in the que for a week and then get Rejected. Others trip the Timezone trigger (easy catch) or fit into email patterns I've tracked over the years ie: mynameisalex316 @ gmail.com (the 3 numbers is common)

Pay attention to the patterns, they are there.

 

[DarkGizmo]

With how easy it is to integrate an LLM model into any basic bot, that type of question is not really going to stop much.

Right, that's more for my own curiosity, not for spambot prevention

I do use Registration Spaminator from OzzModz, works well enough but I think the ones that are getting through are from actual people creating them.

 

[Ozzy47]

I do use Registration Spaminator from OzzModz, works well enough but I think the ones that are getting through are from actual people creating them.

That is most likely true. A human registers because they can fill everything correctly, then they hand it off to the bot program to post, or they do it themselves.

 

[DarkGizmo]

That is most likely true. A human registers because they can fill everything correctly, then they hand it off to the bot program to post, or they do it themselves.

Exactly, one guy literally joined as his hosting company with the sole purpose to advertise it across my forum. I banned them and did some googling, seems they've done that across a few other larger forums too. I'm all for people making money but there's better ways to go about promoting your product, especially if you're claiming to be a professional webhosting company......

 

[CedricV]

Exactly, one guy literally joined as his hosting company with the sole purpose to advertise it across my forum. I banned them and did some googling, seems they've done that across a few other larger forums too. I'm all for people making money but there's better ways to go about promoting your product, especially if you're claiming to be a professional webhosting company......

Some are legitimate people trying to advertise. Their method isn't tactful but I often think of it this way: If it doesn't benefit my members, it's out.

Being an admin forum, a webhosting company does fit our general interest. As long as it's appropriate.

 

[DarkGizmo]

Some are legitimate people trying to advertise. Their method isn't tactful but I often think of it this way: If it doesn't benefit my members, it's out.

Being an admin forum, a webhosting company does fit our general interest. As long as it's appropriate.

While we have a large promotion section......it just felt.....super forced. It would be like if I registered to a forum like IGN or virtualpetlist as "Revillution.net" There's just a way of going about doing things. I'm sure it was a legitimate person but still, there's a way to do things. I could unban the account but.....I dunno.

 

[CedricV]

I understand completely. It all depends what you like to allow and what not. That's entirely up to you.