XF 2.2 Spammers bypassing ‘Spam phrases’

[051119]

I have been badly hit every night by spammers posting Chinese characters and then including English words such as “university” and college.

These have been in my ‘Spam phrases’ for years and have never had problems.

Initially I thought they were posting ten threads (my Spam check limit is 10) and they were using that to bypass it, but someone I had last night had even his first posts containing one of my trigger words of University, with no sign it had been edited.

I did a test post of exact same phrase and it was subject to moderation.

 

[NikC]

Same here, we have Cloudflare Turnstile, StopForumSpam, DNSBL, Akismet etc all enabled and University in the spam phrases but they still are able to register and post these threads.

 

[051119]

They’re the exact kind of threads I’m getting too. Chinese characters and then random things like University added in.

I see you’re in the UK, are they appearing overnight for you too?

I don’t really get what they’re trying to achieve as they don’t post any URLs or anything.

 

[Muddy Boots]

Apart from

[OzzModz] Registration Spaminator and using @eva2000 's CMM with CSF Firewall with csf.blocklist and stopforumspam

Also use Cloudflare and ban all dodgy countries outright, that may not be possible for most but works for one of my forums which is uk and local based only. Also have jS challenge in Cloudflare. Blocks attached.

(ip.geoip.country eq "RU") or (ip.geoip.country eq "CN") or (ip.geoip.country eq "UA") or (ip.geoip.country eq "JP") or (ip.geoip.country eq "SI") or (ip.geoip.country eq "MV") or (ip.geoip.country eq "SG") or (ip.geoip.country eq "IL") or (ip.geoip.country eq "IN") or (ip.geoip.country eq "UY") or (ip.geoip.country eq "DO") or (ip.geoip.country eq "BR") or (ip.geoip.country eq "HR")

 

[051119]

Already blocking lots of countries but most of these spammers are posting from “normal” places.