Spammer active on forum?

[locutusweb]

Hi,

I am getting russian spam in my pb. Also the site is dreadfully slow by times. For more information about the spam moderators can contact me.

[johnvick]

We are aware of the spam in the forums but are you getting personal message spam?

[WarHawk]

I'm whacking the spam as fast as I can...

I hate spammers...buncha jerks

[MichaIng]

Currently reading: https://www.phpbb.com/community/viewtop ... &t=2122696
+ https://www.phpbb.com/customise/db/mod/ ... od/faq/548

Proves that included visual CAPTCHA plugins are ineffective. Our questions obviously have landed in bot databases.
[s]UTC-12 registration block can be tested, although I guess, since the guide is several years old, it does not work anymore nowadays.[/s] EDIT: Does not work anymore since UTC-12 cannot be selected. Looks like new phpBB versions just show actually used time zones for selection, so index 0 entry (UTC-11) IS in real use an we would break real user registrations when blocking it.

Will test again: https://www.phpbb.com/customise/db/exte ... orum_spam/

[MichaIng]

NB: I enabled the "Stop Forum Spam" extension some hours ago.

[johnvick]

Thanks for this let's hope it works.

[MichaIng]

Still several spam posts, but when checking in detail, all of them have registered before I enabled the extension.

@johnvick
When checking the user logs in ACP, I see 11 blocked registers only today. I hope there not too much false alarms, lets see.

[johnvick]

I'm checking daily

[MichaIng]

Played around with ACP a bid, disabled the phpBB native spambot countermeasures now, since they seem to be without any effect anyway, as long as we do not install and maintain Q&A or some proven functional new visual or puzzle style CAPTCHAs.

All CAPTCHA extensions I could find are either known to be "cracked" by bots or not updated anymore several years, so most likely ineffective as well. Everything else needs active and regular maintaining (new questions, puzzle combinations and such), so as long as no one of your guys has fun being creative on this, I would simply fallback on the "Stop Forum Spam" (SFS) database, which seems to work VERY effective. AFAIK there was one single spammer slipping through in the last three days, while dozens were blocked every day.

I currently allowed registrations if SFS server is down, which is not default. AFAIK there were two spammers and one regular user registered without spam check. Will monitor this for a while by going through those logged cases manually. Generally I don't like to block registrations only because any 3rd party server is down, however if too many spammer slip through due to this, we have to change it.

EDIT: Enabled Cloudflare IP normalisation, so that spammers cannot be only tracked by name and mail but as well by IP.

[johnvick]

Nice work thanks.