1

I have a forum that's getting a bunch of spam bot registrations.

Here's what's happened:

  • lots of spambots
  • added static logic question (as a picture), static math question, honeypot field
  • still lots of spambots
  • added a built-in CAPTCHA
  • still lots of spambots
  • banned a bunch of known spam domain emails like @spam.xxx
  • spam cut in half, but still lots of spam from spambots on other domains I don't want to block (like gmail, yahoo)

I'm really, really baffled at how spambots are still getting through my measures and registering. How is this happening?

Here's my registration page:

registration page

|improve this question
  • What CAPTCHA are you using? It sounds like the spambots targeting you have broken it. – Ben Hoffman Oct 6 '10 at 20:10
  • Try using a honeypot technique. – Virtuosi Media Oct 6 '10 at 20:14
  • I thought the 'Don't enter anything here' was a honeypot technique? (Even though technically the users can still see it?) – rlb.usa Oct 6 '10 at 21:27
  • My bad, I didn't see that field. It is indeed a honeypot. However, you might benefit by hiding it from sight through CSS or JavaScript. – Virtuosi Media Oct 6 '10 at 21:56
1

... added static logic question (as a picture), static math question ...

Is that to say that the question is always the same? It won't help, if so - consider that whomever is operating the spam bots is likely looking at your registration form and adjusting the spam bots' operations accordingly.

Without seeing the underlying code (plus your server logs and settings) it's hard to say exactly what's going on, but you might consider that whomever is operating the spam bots is aware of an exploit in the software you are using (ala PHP's register_globals) as well.

Consider looking up potential exploits for the software you are using, updating with any and all available patches (to include patches for plugins), and implementing reCAPTCHA.

|improve this answer
1

Take a look at the IPs connected to the spam posts. Secondly, filter your logs for that IP. Then you'll be able to see exactly what the bots are doing and find patterns.

It may be that the spam bots are even circumventing your anti-spam mechanisms completely. What forum software are you using? Is the software up to date?

Also, you could stop new users from posting links or URLs and enable peer moderation (or at least let users flag posts as spam). This won't keep spam out completely, but should keep spam levels down to a minimum. Also, you can use PHP to generate images from text, so you can just generate a random math problem each time.

Finally, where are you implementing the anti-bot mechanisms? Just on sign up? What is the average post count of the spam accounts? If the post counts are high, then your moderators aren't doing their job, and the spammer is able to sign up for 1 or 2 accounts manually and then spam away.

|improve this answer
  • It's invisionfree 1.3, so there are newer versions, I'll ask if we can upgrade to the latest. The anti-bot mechanisms at on the registration page. We get lots of spambots but no members get to post until their account has been 'approved' so in this way we don't actually get any spam from them.... What do you mean by circumventing the spam mechanisms completely? Can you tell me more about that? – rlb.usa Oct 8 '10 at 12:13
  • Ah, that's a good policy if you have the resources to implement it effectively. What I mean by circumventing the mechanisms completely is that, sometimes you may have a form that has a bunch of security mechanisms on it, but there's actually a way to post messages/register an account without using the form. E.g. the registration form and human-verification is the first step in the sign-up process, but if the bot knows the address of the 2nd step of the sign-up, it can just skip to that form and spoof the information that would have been passed from step 1 to step 2. – Lèse majesté Oct 8 '10 at 12:40
  • This is of course very rare and typically only happens when the programmer is a novice and hasn't thought through his security design. However, it does happen. I've seen stupid things like a login system that, after verifying the username/password, stores the user ID as a cookie. And then the system just looks for the existence of that cookie to keep the user logged in. So anyone can forge a cookie with any user ID they want and be logged in as that user without ever knowing the password. – Lèse majesté Oct 8 '10 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.