SPAMBOTS - how can we stop them - read FIRST post.

[DHCook]

I just wonder why certain people get spammed and others don't?

It may have to do with the number of pages that contain links to your BB.

[Mobious]

Hi all,

I've checked the ACP on my forum this morning, and I've found 7 inactive users registered, all with usernames that look like Spambots. I've just check again, and that has increased to 10.

The number of registrations isn't in line with the normal pattern for the board either. (It's noramlly like 1 or 2 a week.)

I do have CAPTCHA enabled, but the noise settings are low to allow users to be able to read it. I did increase the background noise settings, but that's not made a difference (3 more spambots have registered since the change)

I guess it was a matter of time before the phpBB3 CAPTCHA got beaten.

I upgraded to version 3 probably the day of release, and have always updated to the latest version. Ever since the switch to v.3 and use of CAPTCHA, I have not had a single issue with bots. Until the last 24 hours.

This morning I read a post from one of my administrators saying that in the prior hours he had deleted 3 bots. After reading this, I checked the member list and now see another 2 have registered since his report.

Perhaps the attack on the main phpBB website is just coincidence, but something has definitely compromised the CAPTCHA security of our boards. The numerous accounts within this thread of increased bot activity within the last few days is evidence of this. Something has happened...

Edit: I increased distortion and another just registered

[howard_hopkinso]

I had exactly the same problem over last couple of days. After 12 months with hardly any spam registrations, it suddenly went through the roof. I decided to change registration settings to admin activation until I found a solution.

I then set about trying to see if there was another captcha I could install, that didn't use the normal letters and numbers and I found one called, Photo Visual Confirmation.

I installed it on my test forum first and found no problems. I then installed it on my main forums and changed registration settings back to user activation. It's been almost 24 hours now and so far not a single spambot has managed to register. So, fingers crossed, my problem is solved for now.

[darcie]

Just a really simple question. I only have access to the admin panel, nothing php/mysql on our server, etc. so, I can't perform alot of the approaches to actually eliminate spammers.

This sounds as if you are possibly running a free hosted board, or someone else manages the forum for you. If so, you should contact your host for more information on how they can assist you with this.

Whats being done, is that they aren't activated (admin activation, and we just delete the email)....... but, spammers are still appearing in members list, so when people click on their name, they are getting the info/websites, etc. etc.

I'm wondering if there is a way to set this up such that the memberlist isn't viewable by users, only by admin. I can't find the setting on the admin panel, but perhaps someone knows how to approach it.

phpBB3 is made so that only activated members display on the memberlist for this very reason. phpBB2 did display all members, activated or not, which gave the very result you mentioned of having their spam visible. If you are able to (depending on the above response to the first quote), you should upgrade to phpBB3, as phpBB2 is no longer supported.

It may have to do with the number of pages that contain links to your BB.

Not completely, as I have a test board online with NO links to it other than that Google knows it exists. It has gotten this recent wave of spam too, although most likely not in the numbers that a board with more incoming links would.

[NoDeity]

I installed Prime Anti-bot MOD last night. Normally, I would have had to delete a bunch of spambot "guest" postings this morning. However, I've seen only legitimate postings since installing it.

(And I made my CAPTCHAs easier to read, setting them to 20. They were a little too hard to read at 9. )

[Dog Cow]

It may have to do with the number of pages that contain links to your BB.

Not completely, as I have a test board online with NO links to it other than that Google knows it exists. It has gotten this recent wave of spam too, although most likely not in the numbers that a board with more incoming links would.

How do you suppose Google knows it exists?

[darcie]

Because I can search the domain name and find it on Google? Trust me, there are no other links to the site. I've double checked in light of recent events.

[tffnguy]

I have two instances of phpBB3 on one domain and one on a separate domain. The two on the same domain were setup at the release of RC1. One is a test board which is used for family only and robots.txt denies access to the test board. I'm getting pounded with spam accounts on the main board and only a few on the newest domain, but as of yet there hasn't been one new account added to the test board. So far I think only Google and Yahoo bots have visited the new domain, but there is a link to it from my main site index and in the forums where guests can get to it. I'd have to figure this is correct and it could also be that other search engines are used to find the boards also?

[mixstar]

. . . in light of recent events.

Is there some kind of coincidence going on here

Since my previous post stating "it doesn't happen to me" I have been hit by three spammers and I've not checked today. They didn't get past the approval stage I have to add but I figure the CAPTCHA was compromised.

EDIT: Just checked and the only 'non-active' registration was 'Annuaminc', two others that seem cosha joined normally this one didn't bother to check his emails.

[darcie]

. . . in light of recent events.

Is there some kind of coincidence going on here

I didn't mean that to be cryptic, and I apologize. I mean in light of the recent wave of spam registrations, I have double checked whether there are other places that the link to my board is posted that have been indexed by Google. The only instance of it is the site itself.

So far I think only Google and Yahoo bots have visited the new domain, but there is a link to it from my main site index and in the forums where guests can get to it. I'd have to figure this is correct and it could also be that other search engines are used to find the boards also?

I would tend to assume the same.