How to delete a large quantity of fake users?

Xavier

My website has been attacked and more than two thousands of fake users was created by the hackers. Is there a way I can easily remove all of them? Will it work if I simply delete the strings stand for these fake users(I haven't try so because I'm afraid my website will break down if I do so)? The image below shows a part of a list of fake users.
Thank you!
screenshot

luceos

Xavier so important is knowing patters, all usernames are capitals and all of them are length 7, contain letters and numbers. Can you see similarities with the email addresses? Are the users verified?

Once we understand these, we can run a sql query on the database to remove all of them.

Lumeinshin

Xavier I can't give a solution (i dealt with it manually like an insane person)
What @luceos suggested is an easy way to do that, although if you use the no-email-activation you'll have issues

I found that introducing FoF ReCaptcha prevented whomever is doing that from making more accounts. So it might be worth consisdering for your forum 🙂

Xavier

@luceos Can you help me with this? 😂 Thank you!

Xavier

luceos The email addresses are random. I doubt if it's an email list that the hackers obtained from other websites' users list. A screenshot containing some email addresses is shown below.

&& None of the fake users is verified, if there is a way that I can delete all unverified users, it would work either.

Xavier

Xavier @luceos emm, would you mind to help me with this?😂

luceos

Xavier

delete from `users` where `is_email_confirmed` = 0;

RelicSystem

removed, see below for smarter solution.

Xavier

luceos Thank you! I'll try the command. I'm planning to make a plugin that will automatically delete unverified users 30 days after their registration, I think that would be helpful.😂

Xavier

Lumeinshin Thank you for your suggestion! Emm, I have activated the HCaptcha plugin and I haven't found any ways to bypass HCaptcha when registering for a new account. However, the HCaptcha failed to stop the registration of fake accounts.😭 I couldn't figure out how the hackers bypass the HCaptcha, and I had to turn registration off.

I didn't use FoF ReCaptcha because some users (usually those from China) can't load Google ReCaptcha.😅 (p.s. I have tried FoF ReCaptcha for two months last year, but it failed to stop the fake user injections either.😅) I have blacklisted the IP addresses used for injecting fake users to my website, I hope this will work. No fake users for last two months.😂

I'm planning to make a plugin that will automatically delete unverified users 30 days after registration, I think that will solve the issue.😂