XF 1.1 My Forum's Getting Lots Of Spam

System0

System0

Active member
edit by jake - I just posted a resource that consolidates all of the information from this thread into one guide:
http://xenforo.com/community/resources/dealing-with-forum-spam.980/

I've never had any problems with spam before but when I checked my forum today I saw lots of spam threads. Some were in Russian though many were in English.

I checked some users and they had fully validated their account using Gmail. The spam is undoubtedly automated though.

Some users have signed up using the domain andasio.com.

At the moment I am getting a new thread every few minutes and the IP addresses are all different so there doesn't seem to be any way to stop it

(note: I haven't installed any new add ons or mods in a while so I don't think that's the issue)

I used to have this problem with vBulletin though this is the first time I've ever had a problem with XenForo. It's kind of taken me by surprise to be honest.

Any idea how this is happening and how I can stop it?

Thanks,
Kevin
 
Sort by date Sort by votes
Upvote 0 Downvote
Looks like my forum is on that list!

I've installed XenUtiles and followed other tips posted.

Have had 2000 attempts since Sunday (started on the weekend), a few got past today which meant 1000+ spam messages!

A few had Amazon AWS ip addresses!
 
Upvote 0 Downvote
Cleaning up the spammers a while ago. Most recent one had IP from Kazakhstan...couldn't help but laugh.

A lot of them get to register despite the three anti-spam checks in XenUtilities but only one posted so far. It was complete gibberish. I don't get why it is worth their while to post gibberish. Surely no one is paying them to post this stuff. What is the point?
 
Upvote 0 Downvote
Jeremy P said:
If you have XenUtiles: ACP > Tools > Registration Log
Click to expand...

Thanks!

I switched challenge questions over the weekend but had left registration turned off.

I installed XenUtiles and the country blocker in the three smaller forums that had been hit and turned registration back on about 2 a.m. Basically these are very special-purpose forums with membership counts in the negligible to small (< 50) range. This afternoon I dealt with 4 spam registrations that made it through, and there is one questionable one that passed all tests, but I'm keeping an eye on "her".

The number of registration attempts in the first 18 hours in these three forums that see almost zero activity other than an occasional surfer via Google or Bing: 120, 200, 294.

In my two larger forums (typically 40-100+ users) registration is still turned off but there are areas where non-registered users can post. These are protected only by the challenge questions and country blocker. I only had to deal with 2 spam posts today, down from a 10-20 (don't know exactly how many the other mods deleted) yesterday.

Since I last tweaked the challenge questions, no spam users or spam unregistered posts have made it through.

My experience thus pretty much mirrors what others have been doing: XenUtiles + blocking major national spam sources (CN/IN/RU/UA) + challenge questions, and keep tweaking the challenge questions.

My use of the country blocker (Deny/Moderate County): Russia, Ukraine, India, China are banned. I have no use for them. The country lists provided with the add-on is way out of date, so the first thing to do is do download & update new zone files. These are still outdate, but not nearly as badly outdated.

I then created two virtual countries -- ZY & ZZ - that I also block.

ZY is for zones that I discover are missing from the CN/IN/RU/UA zone files, and IP blocks in other countries where I decide to ban the entire block of addresses.

ZZ is for individual IP addresses in countries (e.g. the U.S. & Western Europe) where I don't want to cut a wide swath by banning entire IP blocks. ZZ also contains the IP addresses off 300+ anon proxies that I know about and new proxies that aren't otherwise banned are added here, e.g. proxies in Sweden & the U.S. that were used successfully end up in ZZ.
 
Upvote 0 Downvote
Adam Howard said:
I personally block YAHOO (yahoo, rocket mail, ymail)

You'd be surprised on how many spammers that stops. But more importantly, Yahoo is completely unreliable for e-mail delivery. I had a user point that out to me. Signed up for a few Yahoo accounts and waited for my e-mail conformation to my site. Some came and some came really, really, really later than expected... ie... Between 3 days to 4 months. 2 others never came at all.


*@rocketmail.*
*@rocketmail.*.*
*@yahoo.*
*@yahoo.*.*
*@ymail.*
*@ymail.*.*
Click to expand...

I have just added to my addon "Stop Spam Here" a feature "Point Check System" that I call Risk Indicator, with this feature, you could set point for: email domain, username and IP.

In your case, if you see that email from yahoo is higher risk than the another, you could set higher point for this domain (such as: yahoo.com=>50). The same for IP, if you see that IP from Russia is higher risk than the another, you could set IPs from this country with a point (eg: 20.45.14.0/24=>30).

So users from Russia and using yahoo mail would get 80 points and you could configure how we would process for this point from option: Block, Discourage, Moderate, Allow.

I think this would help you rather than block whole IPs or Email Domains
 
Upvote 0 Downvote
You must log in or register to reply here.

Similar threads

S
Learnings: Identifying and getting rid of unwanted traffic
2
Replies
26
Views
502
smallwheels
S
R
  • Question Question
XF 2.1 5,000+ of my forum's 6,800 users are spambots - How to delete them?
Replies
6
Views
544
jeb35
J
Stuart Wright
  • Question Question
XF 2.1 404 Page not found on lots of links after migration. Leading and trailing slashes needed.
Replies
4
Views
723
Stuart Wright
Stuart Wright
jr777
  • Question Question
XF 2.0 Lots of trouble with email system, and not just with 2.0
2
Replies
20
Views
1K
jr777
jr777
shinyidol
Upgraded to 1.4 and still getting lots of spam
Replies
1
Views
742
Paul B
P
Back
Top Bottom