Spam trouble

[Scratchit]

Hi

Dunno if I am posting this in the right place, if not sorry. couldn't find anything really relevant after a search. I'm getting a ton of spam into my forum. I have the registration set for email verification. Is there anyway I can stop the span messages, it comes in even thought the poster is not properly registered. I got about 200 messaged this morning. I've just been banning the member and deleting the account, I can't understand how these members show up without that email verification taking place, I created a member myself on a spare email and that Capture thing and the email things works. Any ideas?

Cheers

[Chalky]

http://wiki.simplemachines.org/smf/Spam_-_my_forum_is_flooded_with_spam,_what_can_I_do

You need verification questions and some mods as detailed in the above article.  You could also change your registration to admin approval if your forum isn't too busy.

I recommend you stop banning spammers as every ban trigger takes a performance hit on your forum, so once you are keeping them out using the above methods you might want to delete your ban list and let prevention be the best cure.  If you don't want to take my word for it see here  http://www.simplemachines.org/community/index.php?topic=509500.msg3596121#msg3596121

[Scratchit]

Hi Chalkcat

I see what you are getting at with a large Ban list. I take it it's not possible to stop a postings even though the prospective member has not completed the verification process. This to me seems strange if it so. If anyone can post to the forum in this case why bother with membership verification at all. There must be something I'm missing here as I can't make sense of it.

Cheers

[Chalky]

Sorry, I don't understand you - you think bots are posting to the forum without completing "verification"?  That is not possible, but then it depends what verification systems you have in place.  Don't bother with Captcha, bots are better at it than humans!  Email verification, well yes, bots are more than capable of clicking the verification link in an email and returning to your forum to wreak havoc.  Have you read the article I linked to?  You need to set good verification questions, ideally related to the content of your forum with answers that are not easily Google-able - bots can use Google too.  If you have a mod such as Bad Behaviour properly configured then spambots won't even be able to get to your site, let alone register.  Good verification questions should keep out the human and non-blacklisted spammers too.  Then you won't need your banlist except for abusive members that deserve the naughty step.

I have verification questions set on my forum plus Arantor's Misc Anti-Spam mod - go to ChalkCat and take a look if you like.  I can see the spambots trying to register but they can't    No registration, no email, no posts.  I have had only two spammers successfully register in 18 months and I blocked them both at admin approval.  It works.  If you have a mod like Bad Behaviour enabled as well they shouldn't even be able to try to register.  I have mine installed but not currently activated because my other defences are working just fine.

[Scratchit]

Hi Chalkcat

Thanks for your time. I've changed the verification to be approved by administrator instead of by email. I'll also try the other things you suggest then give it a couple of days so see what happens. I'll give you a feedback if I may to let you know the result.

Cheers

[Chalky]

Good luck with it and please do report back.  Also make sure you do read  http://wiki.simplemachines.org/smf/Spam_-_my_forum_is_flooded_with_spam,_what_can_I_do as it will probably answer most of your doubts and questions, but please holler if you need anything else 

[Scratchit]

Hi Chalkcat

Update on problem. Since your advice, spam has stopped. Thanks for your help.

Cheers

[Chalky]

Great news!!!  Thanks Scratchit and all the best for your forum 

[iaccountant]

One thing you can do is to create your own registration routine entirely

BUT ONLY IF YOU WANT IT TO BE A PRIVATE PLACE

It also relies on registration must be approved by an admin.

Guests would have no privileges whatever (a setting), or view only (a setting) and registration is by approval only.

You then change the registration page verbiage to instruct folks how to apply. (You can copy the verbiage it into a welcome board-read this first board etc)

I ask folks who believe they qualify to do so via a gmail account which then forwards the email to me

But my forum is restricted to credentialed professionals, so we have them supply their credentials with their email. After checking them, we tell them to register via the SMF registration routine. Because we now know their email addresses, we can spot it among the many spammers addresses who apply daily.

When no one is waiting, we simply use the mark all button on pending members and sweep them all away.

[Arantor]

I'd still suggest some of the anti-spam measures anyway, because if you don't even have to deal with spam registrations in the first place...

* Arantor is not at all biased knowing that one of the suggested mods is his, though it works happily with pretty much any other method you want to name.

[iaccountant]

In my case it's probably not as useful Arantor, and it is very easy to sweep the front door clean

Click on pending members, click on the "all" box", click on the delete applicants...and voila.

But the spam intercept would certainly get rid of one thing I noticed. Our next member number will be about 18,000 while we have about 130 members.

We like to brag that, unlike McDonalds who say "billions served", we say "thousands rejected" 

[Arantor]

Thing is, you wouldn't even need to do that - you'd save even the effort of rejecting, but each to their own, I guess.

[iaccountant]

I think that the key need approach satisfies is the verification of credentials, which must be done manually.

[Arantor]

-sigh- No, it isn't. It might be for you but seriously, having other anti spam methods means you don't even have to worry so much about the credentials verification stuff - because a decent amount of anti spam measures mean that most signups will be legitimate before you start.

I have several forums now where I just don't have any spam unless it's a human doing it... and no sepearate credential verification measures.

[iaccountant]

Sorry, Arantor, typing slower than I think

My forum comprises accounting and tax professionals and ONLY accredited professionals get to join

So it should have read the key need MY approach satisfies is the verification of their accreditation...

[Arantor]

Sure it should, but you're still saying that you have spammers. Seems to me that if you put in anti spam measures you don't have to even deal with that...

[iaccountant]

Ahhhh, sorry, still new to the club. I understand your point now.

I am actually assembling a list of mods I'd like to look at as we converse

Admin notepad, member texboxes caught my eye, as did pages, SimplePortal and EZPortal.

I also looked at the captcha mod that makes you assemble a phone

What kind of experience do you have with these?

[Arantor]

Don't know, never used any of them. Always did it myself (I've now written 3 sites that all have portal like functions but not one of them used any off the shelf portal)

Seriously, though, you could cut through the need for a CAPTCHA completely by having a good anti-spam question and some of the anti spam mods, far better than a CAPTCHA in every respect.

[iaccountant]

Will look for the. Thank you Arantor

[butchs]

My forum comprises accounting and tax professionals and ONLY accredited professionals get to join

For members like that I would suggest Bad Behavior for SMF mod.  Not that it is mine, as part of it is programmed by some Englishman.   But more or less if you read the helps it has a well established member white-list and has the ability to work with paypal and openiID.  Take advantage of the free sign up for project honey pot and you can end up with a nice simple low level forum protection plan.