XF 1.1 My Forum's Getting Lots Of Spam

[System0]

edit by jake - I just posted a resource that consolidates all of the information from this thread into one guide:
http://xenforo.com/community/resources/dealing-with-forum-spam.980/

I've never had any problems with spam before but when I checked my forum today I saw lots of spam threads. Some were in Russian though many were in English.

I checked some users and they had fully validated their account using Gmail. The spam is undoubtedly automated though.

Some users have signed up using the domain andasio.com.

At the moment I am getting a new thread every few minutes and the IP addresses are all different so there doesn't seem to be any way to stop it

(note: I haven't installed any new add ons or mods in a while so I don't think that's the issue)

I used to have this problem with vBulletin though this is the first time I've ever had a problem with XenForo. It's kind of taken me by surprise to be honest.

Any idea how this is happening and how I can stop it?

Thanks,
Kevin

 

[HWS]

I just switched from captcha to Q/A - and now I get this error when trying to click on 'who's online' list:

It is LNBlog related. Try to disable that addon.

 

[hellreturn]

Let's not blame Xenforo. My other IPB forum is under spam attack too. I believe ReCaptcha is cracked again? Not sure.

 

[Andy.N]

The solution is easy, install free XenUtiles addon, turn on Q&A.
I just check my registration log and today there are 300+ attempts to sign up but ZERO got in, they are all turned down by SFS checker (from XenUtiles).
I also use Sonb addon and it can only help.

 

[MikeMpls]

I was getting hammered on 2 of my forums. Saw one of Jakes posts about blocking country's. Installed it on one site, blocked RU, no spam since... other site, still getting hammered. Installing and blocking RU on 2nd site Thanks Jake!

ru & ukraine.....

Referring to this addon I assume:

http://xenforo.com/community/threads/deny-countries-from-registering.6176/

Posting link for other people.

That will help a lot. I have very few legitimate members (probably zero) from certain countries.

Until the onslaught overwhelmed me last night, I was checking IP & the StopForumSpan DB manually. StopForumSpam will catch most of these. For the current problem being able to block Russia & Ukraine should deal with most of what's left.

The IP addresses that I checked last night were predominately in Russia, with Ukraine coming a strong second, but they were also in western Europe, U.S. and South America. They appear to be using their own computers at home and also using proxies and hijacked computers elsewhere.

 

[estranged]

I have q&a captcha turned on and I have xen utilities installed but I had my first spam today. How could they even pass the questions? They were not English or Russian Username of the bot is: Maxpaynbh It was spamming a Russian site.

 

[James33]

Okay , I had to disable new registrations

 

[Mario Gil]

Same here. Where is the XenForo team? I'd like to here something "official"

 

[ArnyVee]

Same here. Where is the XenForo team? I'd like to here something "official"

There wouldn't be anything "official" for trying to avoid spam. Spammers (both human and bots) is a normal thing that webmasters/admins have to deal with. Nothing that would be a 'security concern' or anything of the sort. Therefore, an official statement would not be needed.

 

[erich37]

The solution is easy, install free XenUtiles addon, turn on Q&A.
I just check my registration log and today there are 300+ attempts to sign up but ZERO got in, they are all turned down by SFS checker (from XenUtiles).
I also use Sonb addon and it can only help.

Link for XenUtiles:

http://xenforo.com/community/resources/8wayrun-com-xenutiles-tools.104/

 

[Jeff Fuqua]

I use XenUtiles and Deny Country and none have gotten in so far.

140 blocks in the last 17 hours.

 

[System0]

How is it possible that the spammers know exactly all the sites using XF ?

I imagine they've did a search for '

Forum software by XenForo™ ©2010-2012 XenForo Ltd.​

' via search engines and generated a list of sites to attack from that. Maybe it's time for us to pay for the credit removal

 

[RobinHood]

<conspiracy theory>It's an inside job to get everyone to buy branding removal!</conspiracy theory>

 

[System0]

Now that you mention it, Kier is based in Russia isn't he?

 

[Keith]

I'm here to add to the list also, looks like Xenforo has become popular enough to get spambots

 

[yoghurtfarmer]

Any strategies that have worked in mitigating these new bots? Switching to a custom Q&A should work but does anyone have first hand experience?

More info on why we are being hit hard:
http://www.blackhatworld.com/blackhat-seo/black-hat-seo/473380-xrumer-7-5-28-elite-released.html

+ The program is trained to new engines:

XenForo (footprint "Forum software by XenForo")
WR-Forum (footprint "Powered by WR-Forum")
mvnForum (footprint "Powered by mvnForum" and inurl:/mvnforum/registermember)
Directory Script (footprint "Directory Script by PHP Link Directory")
FluxBB (footprint "Powered by FluxBB")
Bitrix (adding comments to)
FireBoard (footprint "Powered by FireBoard")

+ same as:

To recourses with protections like “enter numbers, on yellow background”
To recourses which footprints are "Spam-Schutz" "1. Die Zahl"

+ Increased success rate on already known engines:

VBulletin, IPB
phpBB (modification forumactif.com)
DLE (should be used through DLE_Spider.exe)
Drupal (first should be run in mode "Registration only" next run "post on behalf registered user")
php-Fusion
Amiro CMS
Phoca Guestbook
Ucoz
PunBB
*.jun.pl

+ added several new databases:

• LinksList Drupal.txt
• LinksList fireboard.txt
• LinksList FluxBB.txt
• LinksList mvnForum.txt
• LinksList phocaguestbook.txt
• LinksList PHP-Fusion.txt
• LinksList VBulletin.txt
• LinksList WR-Forum.txt
• LinksList XenForo.txt
• ReCaptcha_Profiles.txt


+ Type of database of links was changed. Now it’s possible to use any text file, and not only LinksList id*.txt as file name.
+ Automatic registration on Mail.ru and Gmail.com was fixed
+ In report file on Mass-PM mode was added information, what kind of nickname was used in specific resource
+ Adjusted mechanism of uploading DLL
+ Added an universal recognition algorithm of arithmetical text captcha
+ SelfLearning system was significantly improved, same as tool for training to new text captcha
+ Success rate of working with blogs *.insanejournal.com was increased
+ Critical sections of code was optimized
+ Improved work of “CHECK” flag in xmessages.txt
+ Success rate at working with guestbooks with footprint inurl:/entry/add was increased
+ Bug "link-circling" at ReCaptcha recognition was fixed
+ Processing of checkbox marked as “required” was improved
+ Processing of registration form, especially on vBulletin was improved
+ Handling of "502 Proxy Error" error was implemented
+ At enabling SelfLearning system in \FieldsForAI\Log.txt now are saved ALL textcaptcha, no matter if there is textarea or not.
+ Auto filling of unknown and random fields in the registration forms was improved
+ Was significantly improved recognition of captcha type like "Please click the image above that is ..."
+ Algorithm of checking of checkbox “I agree with rules” was improved
+ Automatic saving of unknown fields of forms like “multipart/form-data” was improved
+ Improved posting in LiveStreet blogs (in “Behalf of registered user” mode)
+ Increased success rate on DLE engine
+ Improved work with field types “radio” and “select”
+ Improved work with ReCaptcha frames
+ Improved work of flags FORCE_TEXTAREA and FORCE_SUBJECT
+ Program trained to bypass Ajax version of ReCaptcha (recaptcha_ajax_api_container), as example on Drupal blogs
+ Added support of Unicode text (now Asian, Chinese etc… language can be used directly in project)
Type of encoding is selected in project window in top via drop-down menu
+ Optimized convert of default site encoding
+ Now link generated by Secure.exe (for secure usage of XRumer on servers/VPS) is encoded in xuser.ini
+ Improved processing of xas_near.txt
+ Now in XAS files are used as symbols of separator "|", instead of ";"
+ Processing of file xas_near.txt improved
+ Now in Self-learning the text in front of the field is displayed in any language of the world
+ Algorithm of saving of unknown fields from SeflLearning system was adjusted. Now in Log.txt file are saved really unknown field, and not all fields which have empty value
+ Fixed the work of menu "Update"
+ In SelfLearning system is implemented automatic recognition of values of field after processing through Google Translate (from drop-down menu)
+ In tool “Database filter” added the possibility of visualization of distribution of results
+ in xmessages.txt in CHECK section footprint “Preview” was deleted, because often was used in the places where this footprint entered in <input type=submit ...>
+ Algorithm of posting through R-database was significantly improved
+ реализовано автошифрование ссылок, сформированных через Secure.exe
+ устранён баг, когда в \FieldsForAI\Log.txt попадали записи с пустыми именами полей
+ In SelfLearning was fixed a bug of wrong recognition of fields value like radio, checkbox and select
+ In tool “Database of links and reports analyzer” was added additional checking for syntax of closed quotes
+ In xmessages.txt from section TEXTCAP_FAILED was deleted footprints "the solution of task you submitted was incorrect" because it refers to detection of KeyCaptcha error
+ In the Schedule system was added the possibility to save / upload file of schedules from existing folder to new subfolder in Schedules
+ Fixed incorrect processing of HTML-content, which contains tabs in HTML cod (as example: forums FluxBB)
+ Mechanism of login/password extraction from email activation links was improved
+ Processing of registration forms which contain only fields for username and email (do not contain field for password) was improved.
+ реализована обработка флага BANNED после POST-запроса
+ Implemented registration of tag <base href="...">, plays an important role in links design in content
+ Fixed bug with incorrect processing of links with UTF code
+ Fixed function of “export” current links from threads monitoring window to “Debug” folder
+ Implemented new functions in Schedule menu
+ Incorrect link conversion in https:// was fixed in Post-submitting filter
+ Processing of redirects created in JavaScript was improved
+ Fixed a bug with incorrect usage of SUBJ2 in some fields
+ Updated list of user agent
+ In Scheduler was added “Pause for (time)” option
+ Was added self-diagnostic at program starting, in case if any files were damaged.
+ Processing of xgrab.txt file was corrected
+ Bug of showing of empty pictures at Manual captcha / Anticaptcha was fixed.
+ Improved processing of text capctha in DLE
+ Software was trained to new random textual capctha like: "Die Zahl 31 minus die Zahl 4 ="
+ Bug with processing of captcha with redirect "301 Moved Permanently" и "302 Found" was fixed
+ Added new tool “Additional posting in Rest report” (should be using after posting)
+ Processing of registration forms in situation when is reported about captcha mistyped

 

[Jigsaw]

+1 for my Xenforo site getting major spam in the last 24 hours. I have maybe had 1 or 2 notable spammers before this and within the last 24 hours I have had 100 or more. Something is going on and this is not just "some normal spam that happens".

 

[Jake Bunce]

How could they even pass the questions?

By answering them correctly. Probably a human-assisted registration, where a human passes the correct answers along to the registration bot. Recaptcha and Q&A are great for stopping automated registrations, but they do nothing for human registrations.

Same here. Where is the XenForo team? I'd like to here something "official"

I'm here. I posted lots of information last night when reports of spam first started coming in. There are many tools at your disposal for dealing with spammers. See my earlier posts in this thread.

 

[Jake Bunce]

+1 for my Xenforo site getting major spam in the last 24 hours. I have maybe had 1 or 2 notable spammers before this and within the last 24 hours I have had 100 or more. Something is going on and this is not just "some normal spam that happens".

Surges in spam are normal from time to time. I have been witness to several surges on different forum platforms over the years. In this case it appears that a new spam program called XRUMER may be responsible.

 

[MagnusB]

Funny how people think this is a problem with xenforo. I might have had one beer too many, but to be honest you are responsible for stopping spam on your site. Sure, the tools xF provides by default could be a little bit better, but with a minimum of effort you can prevent it.

Me myself have just been waiting for when it starts to hit, and I had it solved within a few hours after realizing the spam was automated (though I was lucky enough to be online when I saw 3 or 4 spam profiles within one hour, and had a plan somewhat in my head prior to it). The reason why xF hasn't been hit hard yet is because the tools available haven't been able to register on the xenforo sites, now they can, and now you have to deal with it more actively.

 

[Jake Bunce]

I changed to approve manually the accounts and I just see how a bot registered, stay there like 5 minutes and nothing appears under users awaiting moderation.

How is that possible ?

Edit one of their accounts. Are they awaiting email confirmation? If so then they won't be placed into moderation until they confirm their email address.