Facing A Horde Of Spammers

[Divvens]

Hi, I'm not sure why but we're being hit hard by spammers. Maybe our site was submitted somewhere or bots/spammers are just not giving up/concentrating too hard.

Using all the anti-spam measures XenForo has to offer, including Akismet, and thankfully the spam is never publicly visible but the amount of spammers registering everyday is troubling me.

With Googles new ReCaptcha (NoCaptcha) we used to get around 3o to 40 spammers a day being registered, one of my global moderators used the spam cleaner 60 times in a span of 36 hours.

I disabled ReCaptcha and went for Q&A's, specific to our niche, the number of bots making it through has dropped but there is still around 5 to 8 making it in everyday.

Just how do I fight this menace, there are approximately 465+ bots/spam profiles I have banned. Am I just worrying over something that is normal or are these figures abnormal and our forum is attracting bots for some reason?

 

[Xon]

It sounds like your forum is being targetted by human spammers. Automatic methods which target bots aren't going to help much.

I use @W1zzard's TPU: Detect and Block Spam Registrations to block problematic ISPs and proxies (rather than blocking by IP).

The spam signups are very likely from the same set of ISPs, regardless of their actual IP. It will be up to you to determine if the ISP using for spamming is one you want to accept signups from.

 

[tajhay]

I find that custom captcha questions referencing your niche is the best method of defence.

Another thing i have implemented is, once someone registers, and validates their email address, they only have access to post a reply, not create a thread. After they have posted a reply, they get promoted to the usergroup that allows creating threads too. Since i have implemented this i had ZERO spam at my site. This is useful as spammers generally create threads, not post in existing ones. You might want to try that too.

 

[DragonFlames]

...as another stop em in their tracks option you can add new Custom User Field questions to registration.

We ask for real first and last name for example... and have this check setup on what is entered: ^[a-zA-Z]+\s[a-zA-Z]+$ We want that info anyway of course.

Bots do not expect the question, nor the need to answer with 2 words, and seem mostly unable to get past it. Spamming humans from foreign lands also seem to struggle and tend not to understand that 2 parts of a name are needed.

So, Users > Custom User Fields > and set them to be shown during registration and as always required. You can set whatever added questions you want there of course.

If you try this do check whatever you do doesn't block anyone normal as it is easy to setup something nobody can get past. I find this much more powerful than a fixed set of anti bot question and answers, as those seem to be overcome in no time on my system...perhaps because a human can add the answers to their bot with little effort.. where every first/last name needs a different answer.

Hope the thoughts help...

Steve

 

[Jawsh]

I find that custom captcha questions referencing your niche is the best method of defence.

^^^ This is the right answer.

I have ran a board for 2 years and after adding Q&A I have received 3 bots in that time. Make it something simple that anyone joining would know, but not general knowledge. Your spammer is going to be a boy in Sri Lanka who doesn't speak English well and only knows how to use a computer. They can still google your question, and know math. "1+1" doesn't work. "Capital of Turkey" doesn't work. Be creative.

 

[Divvens]

After having revamped our Q&A's, it seems in a long time for over 24 hours not even one spammer registered *crosses fingers* let's hope it stays this way!

We went for questions which could be answered by people who were interested in our community, even those who are very new to the niche, but questions that bots/spammers would have to look up and take more of their time to get through.

Currently we are aiming to continue adding new questions to make our pool of questions quite big and sort this issue once and for all. Hopefully when they start failing to register they will stop bothering

Thank you for all your inputs!

 

[Paul B]

I would just go with a single question, then change it once the spammers start getting through again.

If you have multiple questions you have no way of knowing which ones are effective and which aren't.

 

[tajhay]

I would just go with a single question, then change it once the spammers start getting through again.

If you have multiple questions you have no way of knowing which ones are effective and which aren't.

Thats a good point. I noticed that spammers could get through certain questions when i had a huge list of questions. When i removed all the ones that they were getting through with, it shut then down completely. Try to not to over complicate the process.

 

[Divvens]

I see, thanks.

I'll enable only two questions at once then, I don't want to run on just one question as if it gets cracked and I'm unable to change the question soon we may just see a major influx in spam registrations. So two for just being safe.

However seeing that they are really very niche oriented, I expect good results which last longer

 

[m1ne]

Do this:

Most notably http://*
Anyone trying to post links, use them in about me, profile posts, etc, will get blocked. Spam will never happen again, guaranteed. You'll just have to manually delete spambots yourself, a worthy tradeoff for an easier and quicker registration.
It's also a good idea to display a notice to members with less than 3 posts, I did this:

And that's it. No addons need. I've had 0 spam since doing this and no users complain or ask questions about why they can't post/fill in about me section.