Spambots posting on our board

Powermage

Recently we started to see a spambot registering a user and opening a topic every night.
Users need to confirm their email address, but they use different gmail addresses.

We added the reCAPTCHA plugin in the hope to fix this, but they keep registering and opening a topic every night, to make it more strange, they client IP shows as an address from Cloudflare from asia.
This morning i have blocked the complete /24 subnet (dont know if this works, maybe they use different ip addresses from now on, but it is worth a try)

But i still would like to find out more about this.
Can the bot register a user through the API (and bypass the captcha ?) that we can limit or block?
And do people see familiar behaviour on their boards?

Yalfoosh

It's probably just someone using Cloudflare to encrypt their data.

You should probably contact Cloudflare so they terminate their service. I've heard about other people having issues with spam bots. The best thing we currently have are

Approval
various anti-spam plugins
Mail Filter

Mail Filter doesn't work for you since you allow gmail registrations, unless there is a certain pattern these mails have (in which case you can write a regular expression and block mails with that email pattern, so you stop the spambot from accessing your forum in the first place).

The anti spam plugins we have are effective to an extent - I'm unsure if you could use them to get rid of all spam bots, you'd have to see if they work for you.

Lastly, approval will throttle the spam for sure (since you'll just disprove a post), but it will throttle your users as well.

clarkwinkelmann

If you are using Cloudflare proxy, make sure you have configured your server to restore original visitor IPs, otherwise you will see the IPs of the proxy servers in Flarum and other logs https://support.cloudflare.com/hc/en-us/sections/200805497-Restoring-Visitor-IPs

From a quick look at the source code of FoF reCAPTCHA, it looks like the "create user" endpoint of the API should also be protected. Or in this case, unusable, as you can't complete the challenge via an API request.

Powermage

What is normaly see in my day job in ICT is that most of the bots (like on contact forms) are blocked with the implementation of reCAPTCHA, so i was a bit supprised that these bots are able to pass reCAPTCHA in this case.
that is why i was wondering if they maybe used some kind of loophole through an API call or something to just bypass the reCAPTCHA.

We have a lot of users using gmail/hotmail etc and we dont want to limit that because the majority are valid users.

Approval for posts/new topics is not something we would like to achieve, maybe approval for a new users before they are allowed to post is something that can work for us.

At the moment we experience one spam post every night, our forum is Dutch so most of our users are dutch. we have one benefit, that one of our team members is based in the USA he spots and removes them before our users notice this most of the times but it is a bit annoying.

Also i think we will take a look at https://discuss.flarum.org/d/17846-friendsofflarum-stopforumspam

clarkwinkelmann If you are using Cloudflare proxy, make sure you have configured your server to restore original visitor IPs, otherwise you will see the IPs of the proxy servers in Flarum and other logs https://support.cloudflare.com/hc/en-us/sections/200805497-Restoring-Visitor-IPs

Nope, we dont use cloudflare as a proxy or anything.

clarkwinkelmann

On this forum we use Akismet to great success (along with other tools)

You can see the extensions we use on this forum here https://discuss.flarum.org/d/22190-extensions-of-discuss

Powermage

Small update
https://discuss.flarum.org/d/17846-friendsofflarum-stopforumspam fixed the current spam bots for us.