A slight change.

[Mr. Hankey]

I think spammers have been using our contact us link on the forum to create spam as I have been seeing a large uptake in bad email bounces targeting the contact us link. I have disabled non-registered users from using the contact us email link. To help users who are having registration issues I have opened up the guest forum to posting for non-registered users. While I expect that this forum will be hit by spam posters, I would rather that we deal with that on our terms rather than having people user our contact email form to spam others.

I think it would be helpful to have some moderators assigned to this guest forum. Would anyone be willing to help out doing that?

[STMahlberg]

I think spammers have been using our contact us link on the forum to create spam as I have been seeing a large uptake in bad email bounces targeting the contact us link. I have disabled non-registered users from using the contact us email link. To help users who are having registration issues I have opened up the guest forum to posting for non-registered users. While I expect that this forum will be hit by spam posters, I would rather that we deal with that on our terms rather than having people user our contact email form to spam others.

I think it would be helpful to have some moderators assigned to this guest forum. Would anyone be willing to help out doing that?

I'm willing to help a bit with that. I assume that helping would entail getting information to those who are trying to get registered and to weed out and delete SPAM posts?

[Mr. Hankey]

I'm willing to help a bit with that. I assume that helping would entail getting information to those who are trying to get registered and to weed out and delete SPAM posts?

That is correct, thanks for volunteering.


You should be setup....

[Mr. Hankey]

Hmm looks like I have a bigger problem.... there seems to be bots mass creating accounts. For now I have changed the image verification setting to be more difficult. If that doesn't work I will probably need to change the registration process to moderated.

[STMahlberg]

Hmm looks like I have a bigger problem.... there seems to be bots mass creating accounts. For now I have changed the image verification setting to be more difficult. If that doesn't work I will probably need to change the registration process to moderated.

I guess that would explain why it seems there is always someone registering no matter what time of day or night...

[Bok]

I get that at the Free-DC forums too, very common problem. I had to switch the registration there to be moderated. It's a fairly simple process to accept or delete new accounts and most spam ones are quite obvious.

[Mr. Hankey]

I switched to moderated last night as I had 3 fraudulent registrations around 2am after I had made changes. I deleted about 200 false registrations last night 1:1 through the UI (which sucks by the way as there is no way to do it bulk based on a search criteria) I think I have identified another 150 or so that need to go..... :mad: I even deleted some of the bastards while they were "editing their profiles"

[trigggl]

I switched to moderated last night as I had 3 fraudulent registrations around 2am after I had made changes. I deleted about 200 false registrations last night 1:1 through the UI (which sucks by the way as there is no way to do it bulk based on a search criteria) I think I have identified another 150 or so that need to go..... :mad: I even deleted some of the bastards while they were "editing their profiles"

Did you get SUncleSamA while you were at it? :-"

[STMahlberg]

Thought this was interesting...

Guest 05:26 PM Viewing Error Message Unknown Location WOLPATH 91.201.66.60

What is WOLPATH? And why is he sitting there so long???

Also, I thought Guests could only view the Guest Forum.

[Mr. Hankey]

Thought this was interesting...

Guest 05:26 PM Viewing Error Message Unknown Location WOLPATH 91.201.66.60

What is WOLPATH? And why is he sitting there so long???

Also, I thought Guests could only view the Guest Forum.

I saw that as well... People try to modify the html path to find unsecured php files or gain other methods to access the site....

[STMahlberg]

I saw that as well... People try to modify the html path to find unsecured php files or gain other methods to access the site....

Can you lock out IP addresses?

I know 2 of the Guests on now are Spammers... I looked up their IP.

[Mr. Hankey]

Can you lock out IP addresses?

I know 2 of the Guests on now are Spammers... I looked up their IP.

Yes I can block by IP. In fact when I have noticed a huge number of the fake registrations coming from the same IP ranges I have in fact blocked those large ranges. Unfortunately the IP ranges tend to be everywhere. I wouldn't be surprised if this was being done via a botnet. Some of the ranges I was unable to block because some of our legitimate users fit into the range.

Thankfully with the moderation setting I can select and delete large numbers of accounts all at once. The sad thing it looks like we are getting 25-50 / day so this will be a never ending process.

[Bok]

On a number of occasions Free-DC will see a botnet attack where I've seen upwards of 300 users (guests) attempting to register at the same time. I get quite a lot of attacks on the stats site too, often with sql injection attempts. Unfortunately it's part of the modern internet. In our forum, I don't delete the users which are spammers but ban them permanently instead, that way their email address and id are at least taken up and can't be re-used ;)

I can ban IP's on the firewall which is cleaner and faster than the filtering done in the forums, just let me know which ones.

[Fire$torm]

Question. Are these botnet attacks coming from for-profit enterprises like mass marketing and the like? Or are they coming from jackasses that like giving site admins and moderators headaches?

[Slicker]

On a number of occasions Free-DC will see a botnet attack where I've seen upwards of 300 users (guests) attempting to register at the same time. I get quite a lot of attacks on the stats site too, often with sql injection attempts. Unfortunately it's part of the modern internet. In our forum, I don't delete the users which are spammers but ban them permanently instead, that way their email address and id are at least taken up and can't be re-used ;)

I can ban IP's on the firewall which is cleaner and faster than the filtering done in the forums, just let me know which ones.

Ever thought of using the scrambled text within images to register? I forget what they call it in BOINC, but it was pretty easy to set up for the Collatz profile editing.

[Bok]

Ever thought of using the scrambled text within images to register? I forget what they call it in BOINC, but it was pretty easy to set up for the Collatz profile editing.

We are using that too. It's an option within vBulletin to set Human Verification on and I set it to use Random Font/Size/Slant/Color.

If it's not on here, I would definitely put it on. It stops most bots, but I find users still get through. Likely these are real users paid to join up in order to make basic posts with url links in to try and get people to various sites.

Difficult to stop this automatically, though there is a new option in vBulletin I have not tried which scans posts for spam and removes it, only when the users have less than a set amount of posts. Looks promising and I've been meaning to try it out.

[Teratoma]

I think there is the option to add an additional question as well. This can deter lazy spammers...or ones who can't answer simple questions like what is 1+1?

[Mr. Hankey]

These are definitely bots at least in a large number of cases as they have a pattern to the registrations. We are using the maximum complexity graphical imagery for the registration process.

On a good note, it has been almost 24hrs without a spam signup.