Forum Spam

[Plotloss]

'Er indoors uses phpBB2 for a discussion forum on her company website.

Of late we've been getting a lot of forum spammers.

Shes loathed to have to restrict access on a signup email basis.

Anyway of stopping this?

I'm considering modifying the signup page so that if the signup country is anything other than UK (they all seem to use US as a country) then rejct but this feels like an inelegant solution.

Thoughts?

[thepassenger]

Google can be coaxed in to providing a list of the common spammer IP's, dropping those in to a .htaccess file with a "deny from" directive will stop a LOT of spam, but it will increase the number of 403 errors that appear in the logs. I've pasted mine in at the end, but you might want to double check that no new ones are needed (change ['s for <'s).

phpBB2 I belive can be strapped with an Akismet plug-in that will allow, at least when it's fully developed, you to nuke spam.

Also turning on the CAPTCHA or whatever it's called section of user validation (ya know the stuff that says 'type in the letters in the picture' thing) will stop most of the bots dead if they get past the .htaccess file.

Appleseed's .htaccess file said:

[Limit GET POST]
order deny,allow
deny from uk.ibm.com
deny from 202.71.106.121
deny from 217.160.171.20
deny from 81.181.209.3
deny from 68.190.197.172
deny from 70.162.85.46
deny from 70.132.133.30
deny from 83.19.66.122
deny from 66.176.187.129
deny from 69.232.186.155
deny from 69.109.160.202
deny from 213.164.102.68
deny from 209.112.221.17
deny from 59.93.56.73
deny from 24.182.244.131
deny from 68.87.71.183
deny from 68.157.43.60
deny from 68.18.52.131
deny from 195.8.175.8
deny from 62.253.32.8
deny from 203.200.97.181
deny from 207.177.195.196
deny from 24.205.161.39
deny from 192.153.163.63
deny from 192.153.163.63
deny from 205.250.8.172
deny from 125.23.0.253
deny from 220.186.0.0
deny from 202.47.247.117
deny from 202.47.0.0
deny from 59.40.198.47
deny from 220.186.26.58
deny from 217.160.171
deny from 65.35.112.144
deny from 24.16.124.143
deny from 61.3.200.32
deny from 210.211.255.19
deny from 24.62.47.148
deny from 58.169.92.229
deny from 58.169.93.111
deny from 58.169.101.123
deny from 58.169.128.147
deny from 58.169.129.4
deny from 58.169.140.20
deny from 66.97.174.196
deny from 66.207.210.226
deny from 69.0.96.103
deny from 69.0.97.144
deny from 69.0.99.89
deny from 69.37.24.
deny from 69.37.25.
deny from 69.37.45.99
deny from 69.37.120.75
deny from 69.37.231.131
deny from 71.196.7.135
deny from 80.57.62.146
deny from 80.178.150.85
deny from 85.31.186.61
deny from 88.1.150.47
deny from 143.238.237.102
deny from 150.101.105.107
deny from 150.101.106.
deny from 150.101.110.
deny from 150.101.111.
deny from 195.225.176.84
deny from 212.37.39.59
deny from 213.93.153.233
deny from ibm.com
deny from 202.71.106.121
allow from all
[/Limit]

[agent006]

Plotloss said:

Shes loathed to have to restrict access on a signup email basis.

It's got to be better than having unsavoury messages on her company website though? Signup process with picture based number recognition should sort it out.

[aldi]

Got something against IBM thepassenger?

[thepassenger]

aldi said:

Got something against IBM thepassenger?

and thrice

Edited by thepassenger on Friday 27th October 23:13

[aldi]

thepassenger said:

aldi said:

Got something against IBM thepassenger?

and thrice

I feel your pain, was contracted to global services for three years. shan't say more, they're probably listening, just waiting for an excuse to squash me like that Bullock bird in 'the net'

Anyway

Appologies for the thread-jack. Personally I dont mind email signups, preferably ones with links to click on. Capachas are cool too.

Edited by aldi on Friday 27th October 23:16

[thepassenger]

aldi said:

Appologies for the thread-jack. Personally I dont mind email signups, preferably ones with links to click on. Capachas are cool too.

Gut feeling is to have both but if it's a choice then Capachas would be better IMHO. A lot of spam bots are more than capable of running though an e-mail sign-up procedure using a hijack account or something like hotmail acting as their repository for the 'click here to complete sign up' stuff. But I've never even heard rumours of one that can read.. IYSWIM.

Edited by thepassenger on Friday 27th October 23:45

[jgmadkit]

They can get through the CAPTCHAs as well now. No one thing will stop them, you need a range of blockers in place, even then you may only be limiting the spam to a more manageble level rather than eliminating it. I've even gone as far as moderating sign ups until I get round to loading the next version of VB.

From my experience PHPBB is a spammers wet dream, if you can go to VB you'll cut out a great chunk of spam in one go. I've also heard that if you get rid of the version of PHPBB that you are running from the footer of the forum (where the PHPBB copyright notice is) then this will also stop a number of spamming bots as they look for this info.

John

[thepassenger]

jgmadkit said:

They can get through the CAPTCHAs as well now.

I think that depends; a lot of the early... really early versions of Captcha's would have the sting to be typed in as the file name, so QnxEwr1.gif was actually asking for QnxEwr1. Which is brilliant and nobody ever does code scrapes do that?

But yeah, he has a point about phpBB being the spammers best friend. Problem is that its the swiss army knife of forums, so many nice little hooks for things to bolt on to that it's rather hard to stop spammers from finding different ways in.
Having said that removing the version strings will help as will everything else we've suggested.