Anyone else being bombarded lately with Spammers? Suggestions?

[steven s]

keep adding deny from lines when you catch another spammer.

You guys spend way too much time at this.
Most of the spammers registered to my board all have phone, mobil or electronics in their email. I'm also checking users with less than 15 posts by comparing keywords using a plugin. It's hard to tell if this is working since I haven't had a spammer register in 48 hours with those email addresses and the one spammer I had went straight to the moderation queue.

[feldon23]

I've banned a couple of IPs who used Contact Us over and over and over.

But for the most part, it's people/bots from different IPs so you have to use other things like the Plugin that was suggested.

[DijonWolfie]

All my spammers so far have listed "Abu Graihb" as their location (the first option in the locations options), Is it possible to ban someone if they select this location? (I have since changed it to "I am a spammer" but kept it at the top, just to make it easy to reference when banning someone).

[feldon23]

I wasn't aware that Location was a drop-down box. I thought it was a text entry.

[DijonWolfie]

We have it as a drop down box for "Country" which puts the country flag on the profile.

[RedWingFan]

Chasing spammers' IP addresses aren't going to get any of us anywhere fast. I hate to say this, but there are many entire countries I would like to prevent from accessing our forum. These are the countries that have very loose spamming laws, and these are the ones that spammers operate their servers out of. I would do it by specific IP blocks, but there are not easily defined blocks per country, unfortunately. I had though of banning specific organizations, like all APNIC addresses, but that kills many legit countries for us, unfortunately.

All I can do for now is block an entire provider. I run a whois command on the IP address, find out the organization, then ban an entire block of IP addresses from that same provider. It is still shooting in the dark, but it's with a larger bullet. *sigh* I usually run one inquiry to find out which NIC they operate from, then run the second whois to find out the specific organization. This will list the netblock they are allocated, and I'll block it. I sometimes check to see if any members are using similar IPs, but when it's from China, Russia, etc., 99.9% chance it's a spammer.

This just sucks, doesn't it? *sigh*

[Tim Skellett]

Same here, all started after moving to 3.6

This is not a 3.6 issue, I mean it's not 3.6 being wonky. I have experienced exactly the same thing happening -- a flood of spammers using web.de -- but I am on 3.5.4 (just about to upgrade to 3.6.4). I suspect human spammers at work rather than spambots. Web.de is a German freemail service.

[kellym]

ban by IP address?

I see that banning IP addresses is one solution - but how does one ban an IP address in vBulletin? I can easily ban users, but have searched and searched without finding a similar option for IP addresses. Is it a plugin and not in the base 3.6.4 install?

[Steve Machol]

Admin CP -> vBulletin Options -> User Banning Options -> Ban IP Addresses

[K4L]

Hi there, anyone here cares to share blacklisted emails? eg) @fromrussia.com
cheers.

[Shane.]

I changed the validation image to a question instead. This had prevented all bots from spamming.

I like this idea. How did you do this?

[feldon23]

http://www.vbulletin.org/forum/showthread.php?p=1125201

[Cloudrunner]

A Spammer posted it on my board .......

It's called X-Rumer.

Are there any defenses against this bot and others like it?

Without encumbering the human with multitudes of guess this, what's that things while registering?

[andor]

I suspect human spammers at work rather than spambots.

Have to agree - I'm getting the same on two vBs I'm running for clients, and you can see them coming across one forum then to the next, so they are sweeping via servers. And I also agree that they must be paying people to surf and spam the forums manually.

I think I am just going to moderate all new users and be done with it . . .

[petercom]

I have been moderating all new users for some time but still find it difficult to catch all the bogus registrations as some of them look quite plausible. So I have taken to sending each applicant an e-mail requesting their reason for joining.

This stops the 'bot applications as they don't reply. But it is a huge waste of time and effort, especially as I am getting around 10 -20 bogus applicants a day.

What do these people hope to gain anyway. Of all the registrations that got through only two actually posted an advert. It made me wonder whether there was some method that they could use of accessing the member list? Maybe I'm just paranoid.

I'm off to try the picture mod now

http://www.vbulletin.org/forum/showthread.php?p=1125201

and, hopefully, save myself the time and bother of vetting new registrations.