Defeating the SpamBots

[hieronymous]

i've started to get a glut of spambots registering at my site, so they've obviously defeated the image verification system

i've put in place a question and answer system instead, but:

a) is there any way of stopping members registering using obvious spambot ids (usually just a string of numbers)? i can't simply ban people from using 1,2,3,4... etc, as many bona fide members call themselves stuff like kevin123 etc. i'd like to ban people from using purely numeric ids (not perfect, because some bots include the occasional random letter, but better than nothing)

b) the question and answer system could deter non-english-speaking members (of which we already have a fair number) from joining up. has anyone any recommendations for getting round that problem?

[biggazillakilla]

b) the question and answer system could deter non-english-speaking members (of which we already have a fair number) from joining up. has anyone any recommendations for getting round that problem?

Math question? 3 + 8 = ?

Might work.

[Steve Machol]

Even better: What is 3 + e i g h t?

[tsak76]

recaptcha still holds

[hieronymous]

Math question? 3 + 8 = ?

Might work.

yeah, good suggestion

i had been setting questions appropriate to the forum contents, but maths is a common language that would need no translation software

i can see the rationale behind mixing numbers and words in the questions too, as pure numeric formulae would be pretty easy to hack

[Jobe1986]

recaptcha still holds

I've been getting a few spam registrations past reCaptcha

Pretty sure those involve human intervention though.

[hieronymous]

I've been getting a few spam registrations past reCaptcha

Pretty sure those involve human intervention though.

i don't think there's any way of stopping human spammers (without locking the forum down entirely)

what i did some while ago (which was suggested on a thread somewhere here) is to set the "Registered" group such that a member has to have 5 posts manually approved, and then they're automatically moved into an "Approved" group which has normal posting privileges

this means that only moderators ever get to see any spam - whether it's been posted by bots or by humans. as soon as the spammers post their crap they get banned and the posts deleted, but the normal members never get to see any of it

it's not perfect, because it still requires some manual intervention, and theoretically a spammer could put up 5 or 6 normal looking posts first (although that's never happened yet), but it's better than having the forums flooded with unwanted garbage

[wptavern]

Are there any updated instructions for this post that was created in 2005?

http://www.vbulletin.com/forum/showthread.php?t=301241

The directions are hard to follow and actually confusing.

[hieronymous]

Are there any updated instructions for this post that was created in 2005?

http://www.vbulletin.com/forum/showthread.php?t=301241

The directions are hard to follow and actually confusing.

there's a better, more recent, example here:

http://www.vbulletin.com/forum/showthread.php?t=248832


i'm afraid the instructions are still a little hard to follow, but it's well worth the effort. i don't believe that it will ever be possible to completely stop spammers registering on sites, but the next best thing is to make it so that nobody ever has to see their puerile crap


a couple of little extra things i do:

1) you can usually tell from somebody's first post if they're legitimate. if they are, then i manually move them into the "Approved" group immediately, so that they don't have to have any further posts moderated

2) however, you can't always tell if they're NOT legitimate from their first post. as long as the posts don't contain any links, then i'll approve the posts, but if i'm unsure about the poster then i'll just keep setting their post count down to 1 (so they never get automatically moved into the "Approved" group), and wait and see if they reveal their true colours

both things are a lot easier to do with a smallish group, of course. we've got less than 4000 members. i would imagine it might get a bit unwieldy for larger sites

[MRGTB]

I'm currently testing the new SMF 2 RC1-2 version, and it comes with a new option to add your own Questions and Answers via the admin panel (Anti-Spam). You can add and remove as many as you wish. You can even choose how many questions will be asked of people, and the Questions and Answers you add get rotated "so bots don't only see one" Question and Answer all the time. This runs alongside the standard "Image Verification" option.

A great new feature this in SMF 2, something that should be there in vBulletin 4 for extra Spam protection.

[Wayne Luke]

I'm currently testing the new SMF 2 RC1-2 version, and it comes with a new option to add your own Questions and Answers via the admin panel (Anti-Spam). You can add and remove as many as you wish. You can even choose how many questions will be asked of people, and the Questions and Answers you add get rotated "so bots don't only see one" Question and Answer all the time. This runs alongside the standard "Image Verification" option.

A great new feature this in SMF 2, something that should be there in vBulletin 4 for extra Spam protection.

Question and Answer has been in vBulletin's human verification repertoire since 3.7.0. You can also enter multiple questions each with multiple answers that are valid and it will switch between them.

Just can't do both at the same time unless you use the No Spam! addon and image verification in vBulletin. However using multiple Human Verification modules just lowers registration rates as many would consider it to be a hassle.

i don't think there's any way of stopping human spammers (without locking the forum down entirely)

There are... I don't even run visible Human Verification on registration on my site and have only gotten one spam registrant so far. That registrant didn't even get to post before he was caught and banned.

[MRGTB]

Question and Answer has been in vBulletin's human verification repertoire since 3.7.0. You can also enter multiple questions each with multiple answers that are valid and it will switch between them.

Sorry, my bad. But I've not used vBulletin to know that.

Just can't do both at the same time unless you use the No Spam! addon and image verification in vBulletin. However using multiple Human Verification modules just lowers registration rates as many would consider it to be a hassle.

Mmm, why can't you use both together? You can in SMF 2, or even one without the other. That should be sorted-out without having to use a vB.org hack to get it so.

There are... I don't even run visible Human Verification on registration on my site and have only gotten one spam registrant so far. That registrant didn't even get to post before he was caught and banned.

Your lucky then, but wait till your forum gets a lot bigger than it is now and see if thats still the case. With more popularity, of course comes much more spam

[Wayne Luke]

Your lucky then, but wait till your forum gets a lot bigger than it is now and see if thats still the case. With more popularity, of course comes much more spam

I have other methods for keeping spambots off my forum. They have tried and have been unsuccessful. Mainly registration is tied into Stopforumspam.com and Botscout.com to see if they are illegitimate users before allowing them to proceed.