keeping bots out. smf's features are not working.

[MacGig]

captcha is not working. questions I make don't work. the bots get past everything. how do they see the questions and enter the answers? beats me.

its safe to say the smf built in spam features don't work. bots still join the forum. there I said it. SMF anti spam features won't keep out bots.

looks like the only way (to keep bots out) is to have an admin check and approve each new account using botscout... nothing else keeps bots out. I've battled the bots for several years and they always win.

pretty sad to admit it but the bots win. lol

if theirs something that works I'm not aware of, do tell.

[mashby]

Bots suck, true. What questions are you using?

[MacGig]

I run a forum about foosball. so the questions were terms that foosball players would know the answers too. terms of the game, parts, etc.

how many men are on the 5 rod of a tornado table?

this type of questions.

[MacGig]

what questions should I use that may work the best? any ideas?

[xrunner]

I know what you are talking about - I don't think they are bots. They are people being paid to sign up and make signatures in their profile advertising some company. At least that's what some of them try to do. So, you can't keep them out because they are as smart as you or I and can answer any simple question most anyone that would join your forum can answer.

[mashby]

I'm assuming the answer to that one is five. I have a foosball table in the basement, but not sure it's Tornado. It's covered with Christmas boxes.

Hmm...if your questions are specific to your forum, that's really great. There are a few mods out there that might be of further assistance.
http://custom.simplemachines.org/mods/index.php?action=search;type=19
I've been using questions without Captcha and haven't seen any bots in a while, but my site isn't the best example though.

[MacGig]

I've done an ok job keeping them out for a decent amount of time, but just got a new wave of them in December it seems. They usually get past whatever I do eventually..

5 is the right answer. lol

if I enter their ip or email at botscout.com, that site says they are bots.

seems like the only method that would work is to have an admin manually check each new account before approving it. no other method seems to work and I've tried them all. lol

[xrunner]

I've done an ok job keeping them out for a decent amount of time, but just got a new wave of them in December it seems. They usually get past whatever I do eventually..

How does a bot answer the types of questions you are asking?

[MacGig]

well I know little about bots, I guess bots are computers and computers can only do what a person tells it to do right? so  a person sees the new questions, then programs their bot computers to answer those questions so they can create dozens of accounts?

Im guessing thats how it works?

[xrunner]

well I know little about bots, I guess bots are computers and computers can only do what a person tells it to do right? so  a person sees the new questions, then programs their bot computers to answer those questions so they can create dozens of accounts?

Im guessing thats how it works?

I don't think they are bots. They are low paid people that register, because they can get past this -

http://custom.simplemachines.org/mods/index.php?mod=2932

[MrPhil]

No matter what you do for visual puzzles (CAPTCHA) or Questions, the spammers will get through if they employ low paid Third World people to sit at a computer all day and do nothing but sign up accounts and pass on IDs and passwords to their masters. There's almost nothing that they can't look up on the Web.

SMF has concentrated too long on putting up a hard crust defense (prevent signups by bots), which does nothing once the bot is signed up. It's somewhat helpful to have challenges (CAPTCHA or Questions) for the first few postings, as it may force the spammer back to humans. To prevent automation, it's necessary to randomly vary the kinds of challenges (a letter CAPTCHA this time, a clock next time, 2 fill-in-the-blank questions the time after that, 3 multiple-choice selection-lists the time after that, etc. ). The programming of bots to overcome this kind of thing would be annoying enough to drive spammers to easier pickings for the time being. The only thing you have to be careful of is not to unduly burden the visually handicapped.

What's really needed is in-depth defense that looks at behavior of posters and content of their posts, and comes up with a probability that it's spam and either blocks the post or sets it aside for a moderator to look at.

[MacGig]

interesting. no wonder what I've done never works. lol

I had a question:

would hiding all the forum content from guests make any difference over time? I thought if non members could not see what is in the forum perhaps they would move on to another site?

currently all the content on my forum can be seen by anyone. even people without accounts.

[MrPhil]

It might help a little bit, but generally spammers don't care what a forum is about. They just want to sell V1@gra and crap like that. Anything that attracts eyeballs is fair game.

If guests can't read your forum, how do you plan to attract new members?

[MacGig]

If guests can't read your forum, how do you plan to attract new members?

great question! I guess I can't.

I have about 10 boards on my site. I disabled guest access, and the site looked blank/ugly when a guest shows up. so that is not a good solution.   Is their a mod where guests can see the board but not read the posts? I'm guessing that would not stop bots either though.

[xrunner]

It might help a little bit, but generally spammers don't care what a forum is about. They just want to sell V1@gra and crap like that. Anything that attracts eyeballs is fair game.

Yup. I had an attack once and they were putting the ads in their sigs - not posting anything at all. I changed the permissions to not allow editing of sigs until 5 posts or so and they then just left after registering. They didn't even make a post with an ad in it, even though they could have.

I feel sorry for the poor people who probably get paid 25 cents a day to do that work.

[MacGig]

I did the same with sigs and eventually disabled them to stop that problem. lol

[JohnS]

What I have done on one site is to create a duplicate set of boards only visible to guests which no one can post in, in there put a topic that explains what the real board contains and that you have to join to see it, so guests see the promotion board and the real members see the real boards.

As for sign up, I recently suffered a blast of bogus registrations at the rate of about 100 a day. The questions seem to have no effect and they were obviously able to cope with the captcha. So in the sign up terms I put details of how to get a sign up code, which can be obtained by sending an email to an auto responder that sends them the current password, then use the question facility to ask what that password is. This fools even the manual sign up 'bots' as they do not use real email addresses. It is a little extra effort for a person signing up, but so far it has held up and I am only getting real sign ups. I may now do something to incorporate this in the sign up page.

[Kindred]

that works...    As I have said before though...   I added bad behavior+httpBL and stop spammer as well as questions and have had ZERO spammer registrations completed in the last 6 months. Lots of attempts and I get 4-5 a month which are flagged by the stop spammer (1-2 of those are false positives and are actual good users) but none successfully complete registration and post

[MrPhil]

I feel sorry for the poor people who probably get paid 25 cents a day to do that work.

I doubt it's that low, but whatever they get paid, I would assume that the workers consider it a reasonably fair wage for wherever they live (and so are willing to do this work). If the alternative is heavy manual labor for the same wage... I don't condone what they're doing, but I'm trying to figure out why they would work at such a job. As for the spammers who rake in the profits, they can all rot in Hell.

[MacGig]

I always wondered why they do it. Join a forum and not post. it's all about making money I guess? They get paid for doing it.

They join my site but rarely post. They use to spam the signatures until I turned them off. So they just join and nothing else. Every so often one will post but it's rare.

I may try making one board for guests and hiding all the other boards. Hopefully if my site looks dead, perhaps they will over time move on to another site? lol Worth a try I guess.