Spammers

[jim_mich]

The computer robot spamming programs are becoming a nuisance lately. We might be noticing this more the past few days because I think Scott is away for the Thanksgiving weekend. He usually deletes them as soon as they appear.

I've been thinking... if there were a way to detect if a new member is a robot or not then these types of spam could be blocked, at least until the robots get smart enought to counter the method.

Maybe the forum software could block any new member from posting during their first 5 to 10 minutes after logging in, until they have posted a couple times? Most "real" new members would never even see any difference because they would first be reading old threads during their first few minutes after logging in, whereas the robots log in and post faster than any human can read or type.

[MrTim]

From what I've heard, there is a spamming assault going on against phpbb boards everywhere. It's not just here, if that's any comfort.
Just be patient. I'm sure ingenious minds are working on countermeasures that can be modded into a board as we speak. :)

[scott]

Hi All,
Sorry, Jim is right. I have been away for a while and not checking the site very often. Yes, there is clearly some kind of spam assault going on, and it would not surprise me if it was across all phpbbs. I actually deleted quite a few spammers and their posts over the holiday, but they still piled up. I was thinking it might be a team of people getting paid, since I do have some anti-robot technology in place already. For example, in order to register, a new member must enter a validation code that looks like this:



Now, granted, the validation scheme in place now is not very sophisticated. If this is in fact a robot attack, it was probably just a matter of time before it happened.

This keeps up, Scott will have to consider putting "Off- Topic" in a member only index. But then again that would only stop them after the first post. And then he would have to block them on a daily basis.

Only members can post anything anywhere anyway, so I don't see how this approach would help. I already have to manually delete them on a daily basis.

I would ask a random question (like what is 1+1...) about something very easy and the user must choose from a to f as an answer..

That is a good idea, if it does turn out to be robotic attack. My brother had the same idea over the holiday when I mentioned I was having this problem. Even better might be to ask a question that is easily answerable by just reading the home page, i.e "In which year did Bessler display his first wheel?"

In the meantime I will research what's going on and hopefully come up with a solution

Happy Thanksgiving, everyone!

-Scott

[LustInBlack]

Scott, I have another suggestion ..

Put a restriction before approval of a new member, so that he can't post any external link and cannot post (www. .com .org ...). At least for the first 3 messages ..

+ [optional]

The first message of any new member must start by : "I am new here and I present myself as ....."

+ [optional]

Each new member must contribute 0.01$ using paypal to the forum .
Overkill, but doable.

+ [optional]

Don't allow usernames to contain any number at all, bots often try to get usernames with numbers in them.



That, with the other proposed ideas combined should do it.

Unless it's a human attack.

In the past, when I had my BBS, the popular method to get rid of hackers and the like, was doing a callback verification by phone. But that can't be done anymore, and mailing confirmation isn't efficient anyway.

The idea is to scare potential scammers, but they are like insects, they don't care about anything...

Anyways, I am pretty sure you already have good knowledge of all this!

[scott]

Thanks for the suggestions LIB. I think 2 possibilities are equally likely; 1.) someone has written a robot that defeats my CAPTCHA technology, or 2.) someone is paying a pittance to a bunch of poor souls in a computer sweatshop somewhere to do this. If is is 2.) then I'm SOL and really have no option but to stay on top of it manually. If it is 1.) then I think my best bet is to change/improve my CAPTCHA technology. That's what I'm working on now.
-Scott

[scott]

OK, I have upgraded our captcha technology to hopefully keep out today's robots. If it is actually human sweatshops responsible, God help us all. I'm trying to remain optimistic.

The new captcha image looks like this:



Why is life so difficult? :-)

-Scott