Anti spambot solution

[Dante123]

hey there,
i saw that since some time back you have problems with those spambots.
therefore i would like to share you my solution that has proven to be very effective (at least, it worked on my own forums where since the solution i have had 0 spam incidents)

how it works:
key = prevent the bot from getting registerd

1. first log in to admin panel.

2. go to the tab "users and groups"

1.PNG (1.55 KiB) Viewed 5192 times

3. in the left menu go to "custom profile fields"

2.PNG (7.16 KiB) Viewed 5192 times

4. create a new field. For example name it BotQ
from the dropdown list pick it to be a textfield

3.PNG (2.93 KiB) Viewed 5192 times

5. make the setting like in this image:


make sure you checked the visibility options as shown! it has to be a required field and therefore show up on registration page

so now it does not even matter what someone fills into the field, as long something is filled in. but the bot registration scripts dont know how to handle this field. therefore registration can not be completed (its required field).

result:

(might have to code it in manually because of the custom template but that wont be a big problem)

as sayed above, for my personal site it works perfect for a long long time like this and had 0 spam bots since than
hope you can use this info too.

[Rubidium]

The recent spam bots here are not really bots. They are just highly underpaid people making posts that look reasonable and after two weeks they change their post to include spam links. The, a bit more, naive ones just add spam in their signature and write somewhat reasonable posts.

As these "spam bots" are registering by hand they are using the same method as normal humans, i.e. a browser, and as such they won't be caught by your trick. The reason you might not get much spam might be that you got a much smaller amount of traffic/publicity, thus its less "profitable" to pay people to post spam there.

[Dante123]

The recent spam bots here are not really bots. They are just highly underpaid people making posts that look reasonable and after two weeks they change their post to include spam links. The, a bit more, naive ones just add spam in their signature and write somewhat reasonable posts.

As these "spam bots" are registering by hand they are using the same method as normal humans, i.e. a browser, and as such they won't be caught by your trick. The reason you might not get much spam might be that you got a much smaller amount of traffic/publicity, thus its less "profitable" to pay people to post spam there.

can't fully agree on that.
fact: Most advanced bots can just pass that captcha

beside that captcha, these forums have no protection against auto registration bots. so im (pretty) sure you get those here too.

about those payed humans, well the bots that i have seen here so far made 0 normal posts. if they have 5 posts all is done in just minutes/hours and all the same crap.

[Chrill]

Well, if we are really looking to prevent bots, adding any sort of existing system already has been solved, or will soon be, by the people who make these bots. They keep working on them to get around the protection. The only working way to effectively shut them off is to have moderators approve every single first post of a user. Now obviously, this won't work because I am sure quite many people post a first post on these forums...

I think the most efficient way to keep spam out is to keep it manual. Moderators do their utmost to keep it away and, let's face it, it get the spam away.

One way of solving this would be, to use Owen's favorite word, a mod. Any member using links in his first post will have to answer a captcha image or a "What is 3+4?" question, alternatively mods would have to approve said posts. This would at least narrow it down.

A way to solve the signature links thing is to make it so that you need more than X number of posts before you can put links in your signature, alternatively have a signature at all. Once again, I am aware that this would require third party mods.

[Dante123]

but if they cant register with succes, there wont be a signature, and no spam.

well i think that it wont hurt anyone and has only positive effects. and well once you see it wont work again, you just remove the question again.
well i think it is worth a shot, but the mods will have to decide here

[Kogut]

well i think that it wont hurt anyone and has only positive effects

Wasted time of people registering on forum is rather negative effect.

[Dante123]

well i think that it wont hurt anyone and has only positive effects

Wasted time of people registering on forum is rather negative effect.

how much time would it cost you to write a "yes" or a "no" i hardly doubt if you can call that time or a fraction of time
in fact it does not even matter what you fill into that field. but bots fail on it in they registration scripts.
in fact deleting spam is way more waste of time for admins wouldnt it ?

[ChillCore]

A way to solve the signature links thing is to make it so that you need more than X number of posts before you can put links in your signature, alternatively have a signature at all. Once again, I am aware that this would require third party mods.

Preventing new users to use a signature is already possible without mods. @see attachment.
Preventing specific groups to post links before x post does need a mod. @see the other topic for links.


Dante, As someone mentioned allready most of the spammers that are posting recently are human and can type as easily yes or no as any other new user.

[Dante123]

well spammers by real humans is very rare. they use that e-mail scams a lot but for forums almost never.
what they do is, they will calculate average of users per moderator.
this forum has too many moderators to be worth the effort, so i serious doubt how many real humas are the spammers on thsere forums.


but again, it aint a must, it was just a tip i wanted to share. dont use if if you dont like it as a moderator

p.s. who know, maybe orudge likes it as the admin ? ( or not )

[Badger]

well spammers by real humans is very rare.

Except they're not and post here often enough. Maybe you just don't see them before us moderators remove them.

[XeryusTC]

Or someone managed to make an algoritm that can beat the turing test and decided to make a spam bot out of it.

[Dante123]

mmm that makes me think.

you mods that delete the spam, is it always the same links they post ? variating about 4 to 5 different links. but always the same 4 to 5 ?
in that case it will be able to just write a "extended bad word" script. a bit similar to the normal "bad word" but now it does not replace it by ***** but it will not post that reply.
i dont think normal users would ever post one of those links right ?

[Hyronymus]

mmm that makes me think.

you mods that delete the spam, is it always the same links they post ? variating about 4 to 5 different links. but always the same 4 to 5 ?
in that case it will be able to just write a "extended bad word" script. a bit similar to the normal "bad word" but now it does not replace it by ***** but it will not post that reply.
i dont think normal users would ever post one of those links right ?

What do you honestly think yourself?

[Dante123]

yes, else i wouldnt suggest this wouldnt i ?

it was just a thought anyway. but looks like most get treated like i have some bad comments on the site (what i have not...)

[Hyronymus]

If that's what you think, fine.

But don't you think that if spammers spammed with the same links over and over again there wouldn't be any spam anymore as it'll would've been blocked decades ago, like you suggested?

[Dante123]

i was thinking more in the way of: they keep posting that same link aprox 1 or 2 months. not decades, i understand

but i am just thinking of ways that would rather prevent the spammers than mods having to clean up the mess.

ah well, if i come up with other ideas i might post them again if nobody minds.

[Rubidium]

but i am just thinking of ways that would rather prevent the spammers than mods having to clean up the mess.

The problem with all technical solutions is that it causes more problems to those that are not spammers than those that are spammers. It is always something reactive that happens, but has no real effect as the spammers have started using other methods.

Compare it with the whole airport security "scam". Do you really think that all those intrusive techniques help security? Even with their arbitrary limitations? I can think of several ways of bringing an aircraft down while still being able to pass all the technical "security" in place. Has it become any more secure with those things? No! Still people with exploding shoes, underwear, etc. can board a plane, just after the event they reactively extend the screening.

So yes, we can add all your anti-spam techniques but that doesn't help anything as there are just a few thousand underpaid people (maybe even slaves) registering accounts manually after which possibly a bot starts to make random posts. Thus adding things at registration just means it takes two seconds more for the humans to spam.

The maximum one new thread per X amount of time stops some flooding, but it doesn't help when spammers reply to threads. Even then, limiting the number of replies is more annoying to the normal (power) users than the spammers; the bot has time, the (power) users just get annoyed.

Ofcourse, you can let moderators start reviewing the first X posts of someone to determine they are a spammer or not, but that takes even more effort from the moderators than simply removing the occasional spam.

[Dante123]

mm i got to agree on that.

but how about this idea that just pops up. people can report bad/offending/spam posts right ?
why not make some mod that will disable a account after X reports within X time or something till a mod re-activates it ?
all readers see if someone is offending/spamming or not right ?

but maybe someone sees a limitation in this idea that i didn't think of yet ?

[Hyronymus]

What I do with newly registered users is check their email-address with the stopforumsdpam database. I've banned a few known-spammers before they actually committed their crime even though I don't really support banning people before they commited a bannable rule violation.

[orudge]

Hmm, that looks interesting - a mod of sorts that incorporates checking that database could be useful. I shall look into it.