Message Board

http:BL Use/Development

http:BL suddenly letting hundreds past

Author: D.Pylant (18 Nov 12 5:31am)

After having http:BL work for us for a long time, about 3 days ago we started getting hundreds of spammers slip through the registration. I checked all the file locations and finally did a reinstall of the mod and the script. The spammers didnt even slow down.

Does anyone know what happened and is there a fix?

Thanks!

Re: http:BL suddenly letting hundreds past

Author: H.User1325 (18 Nov 12 9:35am)

Its not you its the spammers. Starting Thru/Fri the comment spammers seem to have gone on a binder. My phpBB forum have received several hundred logins and attempts to post.

Based on the notes from last night/today of 71 logins, 40 if the IPs were not listed by http:BL. Of the 31 that were listed they were all Comment spammers with threat scores as low as 8 and high as 59.

If this is typical I would think you are seeing "hundreds of spammers slip through." What other spam protections have you implemented?

My registration is fairly friendly with email verification (20 outgoing email have bounced back). I don't know how many registration attempts timed out because they didn't follow the link in the email. I have the system set so the first posting is moderated. This gives me time to double check their IP and post before it gets on my forum.

Re: http:BL suddenly letting hundreds past

Author: D.Pylant (18 Nov 12 11:00am)

I am also using questions and captcha set on the next to highest setting. I am going back and checking on some of the spammers in honeypot and they are rated high there yet getting through anyway.

Re: http:BL suddenly letting hundreds past

Author: H.User1325 (18 Nov 12 4:45pm)

How do you have the selection criteria set? It could help to lower the rejection threshold. It may also helpful to moderate new post.

Any single system to block spammers will have some "leakage." The alternative is to block valid users.

Re: http:BL suddenly letting hundreds past

Author: T.Tutor (16 Feb 13 9:41am)

It's almost always XRumer updates, they beat Question/Answers a while a go...

One of the methods XRumer used was to hold a competition for humans to complete the QA's
(XRumer uses a local TextcaptchaForums.txt and central QA database)

There are plenty of other Captcha's available (but QA captchas have lost the battle). If you carry on using QA, you're playing a game of Russian roulette.. eventually someone will human verify it, and then it's available to all XRumer users (the flood of bots come through)

Edit: okay, if the high ones are getting through, it's setting specific

Post Edited (16 Feb 13 9:43am)