Lots of spammer registrations all of a sudden

[The Phantom Lisa]

I recently moved my site over to a VPS with the same host as my shared hosting, everything is working exactly as it was before, I have the setting on, Use GD to make a more advanced CAPTCHA and Use foreground noise to make the GD based CAPTCHA harder both set to YES and I also have 2 custom profile fields on the registration screen both set to required but the little buggers are still getting through. At present I have set the registration to be approved by admin so that they can't get in a spam the board but I was just wondering if anyone has any suggestions as to why they might be getting through the cracks all of a sudden?

Cheers

[Highway of Life]

If you have the GD enabled, and registration attempts at 5 or less, you shouldn?t be getting that many... of course it won't stop human spammer registrations, but it is possible the CAPTCHA has been broken. Do your CPF's just require to be "filled" or do you have some default values such as a drop-down menu?
That might help too.

And last, there is only one sure way to really put an end to it: Anti-Spam ACP MOD by EXreaction.

[The Phantom Lisa]

Thanks for the prompt reply, CAPTCHA is working fine as far as I can see but both the CPF's are drop downs, maybe I need to add another sneaky one, if that fails I will give the mod a go

[topdown]

I've been getting hit more than usual also.
Time to get out the frying pan and burn some spam

[Highway of Life]

How recently has this been happening?

-- XRumer claims they have finally broken the GD CAPTCHA -- if this is the case, it sure did take them a while, we didn?t expect it to last quite this long.
But there are still ways to fool it.

[The Phantom Lisa]

For me it's only been the last 2 days with about 30 or so spammers, it just coincided with the change of server and I thought that this may have some how had something to do with. Havent had a chance to add another CPF but will let you know if it helps when I do

[Highway of Life]

For me it's only been the last 2 days with about 30 or so spammers, it just coincided with the change of server and I thought that this may have some how had something to do with. Havent had a chance to add another CPF but will let you know if it helps when I do

Maybe, it?s possible if you had the forum in your website field or signature, since the entire users table was dumped, I can only suspect that every "spammer" from here to China grabbed that list for email addresses and websites to try spamming.
However, why not STG? ... why should we be mostly spam-free in the last 2 days?

EDIT: Oh dang! ... I just looked and since Feb 1st, we?ve gotten a FLOOD of new users that appear to be spam accounts. Nothing has posted yet, but I can just see it. Problem is that most of them are gmail accounts, so it's hard to tell which ones to delete.
We should go to a code yellow spammer alert.

[The Phantom Lisa]

EDIT: Oh dang! ... I just looked and since Feb 1st, we?ve gotten a FLOOD of new users that appear to be spam accounts. Nothing has posted yet, but I can just see it. Problem is that most of them are gmail accounts, so it's hard to tell which ones to delete.
We should go to a code yellow spammer alert.

Yes most of mine are gmail as well, only my forum is a little bit more specific and usernames are usually pretty obvious where the spammers are rather bizarre, when I get a chance later this evening I will post the usernames that I have deleted

[topdown]

Same for me, just the last couple days I've got like 5, before that it was only like one every month or so.

[Highway of Life]

.ru and @gmail were the two that are primarily used for the spammer accounts.
I ran the following query:

Code: Select all

SELECT u.username, pf.pf_real_name, u.user_email, u.user_timezone
FROM phpbb_users u
LEFT JOIN phpbb_profile_fields_data pf
   ON (pf.user_id = u.user_id)
WHERE u.user_type = 1 AND u.user_inactive_reason = 1 AND u.user_inactive_time > 1231041600
ORDER BY u.user_inactive_time DESC

I had a thought about the pf_real_name that we use... and sure enough, the spammers fill that field out identical to the username field. Additionally, they do not change the timezones. So I can use this to confirm the following list are spammers registered since Jan 31st at 20:00 UTC

Spoiler:

Code: Select all

<?xml version="1.0"?>
<RECORDS>
<RECORD>
   <u.username>rigesipsCer</u.username>
   <pf.realname>rigesipsCer</pf.realname>
   <u.email>arelppleack@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Snavainavek</u.username>
   <pf.realname>Snavainavek</pf.realname>
   <u.email>mulligankennith1980@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Drypeenurgy</u.username>
   <pf.realname>Drypeenurgy</pf.realname>
   <u.email>ownernall@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Drealtsat</u.username>
   <pf.realname>Drealtsat</pf.realname>
   <u.email>qfsasfaesfesf@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>burotinkos</u.username>
   <pf.realname>burotinkos</pf.realname>
   <u.email>burotinkos@inmail24.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>BiGalex</u.username>
   <pf.realname>BiGalex</pf.realname>
   <u.email>big_alex_men@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>unurnsogTor</u.username>
   <pf.realname>unurnsogTor</pf.realname>
   <u.email>troskotsymn@gawab.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Blisado</u.username>
   <pf.realname>Blisado</pf.realname>
   <u.email>plove241@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Betirral</u.username>
   <pf.realname>Betirral</pf.realname>
   <u.email>mapurlsvtop@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>fixeFX</u.username>
   <pf.realname>fixeFX</pf.realname>
   <u.email>merleclaybornxtp@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>emakyUnmambbao</u.username>
   <pf.realname>emakyUnmambbao</pf.realname>
   <u.email>erurederdwets@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>freewebdirX</u.username>
   <pf.realname>freewebdirX</pf.realname>
   <u.email>freewebdirx@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>TruppyCor</u.username>
   <pf.realname>TruppyCor</pf.realname>
   <u.email>chizobarodlandkenai@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Cerniymagl</u.username>
   <pf.realname>Cerniymagl</pf.realname>
   <u.email>cherniymag@hotmail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>endorpOpert</u.username>
   <pf.realname>endorpOpert</pf.realname>
   <u.email>arcangelom1389@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>voimaBralatar</u.username>
   <pf.realname>voimaBralatar</pf.realname>
   <u.email>louispattersonn@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>depensuef</u.username>
   <pf.realname>depensuef</pf.realname>
   <u.email>martinmcknightt@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>NusePislilk</u.username>
   <pf.realname>NusePislilk</pf.realname>
   <u.email>clarawayfarmercity@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Honswineano</u.username>
   <pf.realname>Honswineano</pf.realname>
   <u.email>intellectualgerda@atlantmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>AAcaspvavaTox</u.username>
   <pf.realname>AAcaspvavaTox</pf.realname>
   <u.email>limamngaw@2008webhelp3.net</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>VetaIntibia</u.username>
   <pf.realname>VetaIntibia</pf.realname>
   <u.email>joemack.jones@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Anymnlenjam</u.username>
   <pf.realname>Anymnlenjam</pf.realname>
   <u.email>viabu@yandex.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>QAfrursuilt</u.username>
   <pf.realname>QAfrursuilt</pf.realname>
   <u.email>sealelantee@2008webhelp2.net</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Ownerincuri</u.username>
   <pf.realname>Ownerincuri</pf.realname>
   <u.email>pochta43@nonovi.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>JessicaPhelpsa</u.username>
   <pf.realname>JessicaPhelpsa</pf.realname>
   <u.email>jessaphelps@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>ALRickgoarock</u.username>
   <pf.realname>ALRickgoarock</pf.realname>
   <u.email>roorrymoirm@2008webhelp2.net</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Gennick</u.username>
   <pf.realname>Gennick</pf.realname>
   <u.email>toocuouttbiaf@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>AFUnsuroadowawn</u.username>
   <pf.realname>AFUnsuroadowawn</pf.realname>
   <u.email>jumpmampnip@2008inflash3.net</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>UTTEREBUP</u.username>
   <pf.realname>UTTEREBUP</pf.realname>
   <u.email>aquaxattins@gawab.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Asceshoth</u.username>
   <pf.realname>Asceshoth</pf.realname>
   <u.email>exorsis@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Sazonchatos</u.username>
   <pf.realname>Sazonchatos</pf.realname>
   <u.email>sazonchatos@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>pepcreardy</u.username>
   <pf.realname>pepcreardy</pf.realname>
   <u.email>austral113ru@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>CheappOemSoftwware</u.username>
   <pf.realname>CheappOemSoftwware</pf.realname>
   <u.email>oem2@accommodationmalta.info</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>clipmksd</u.username>
   <pf.realname>clipmksd</pf.realname>
   <u.email>clipmksd@cvportal.net</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>phorrock</u.username>
   <pf.realname>phorrock</pf.realname>
   <u.email>lindjenia@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Graivyofferee</u.username>
   <pf.realname>Graivyofferee</pf.realname>
   <u.email>plove243@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Effidsnon</u.username>
   <pf.realname>Effidsnon</pf.realname>
   <u.email>gorodovoyjon@yandex.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Ptedeski</u.username>
   <pf.realname>Ptedeski</pf.realname>
   <u.email>serdegkidmre@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>gulyaSertic</u.username>
   <pf.realname>gulyaSertic</pf.realname>
   <u.email>gulyasertic@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>PPWilliamR23</u.username>
   <pf.realname>PPWilliamR23</pf.realname>
   <u.email>ppwilliamp@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>vermilankosaia</u.username>
   <pf.realname>vermilankosaia</pf.realname>
   <u.email>vermilankosaia@convertor-3gp.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>FinanceAdviser</u.username>
   <pf.realname>FinanceAdviser</pf.realname>
   <u.email>spamabuse@marakesh.info</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>elonamow</u.username>
   <pf.realname>elonamow</pf.realname>
   <u.email>elonamow@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Rastorpolomralpk</u.username>
   <pf.realname>Rastorpolomralpk</pf.realname>
   <u.email>littlesmookerlovelol@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>gymmedrargo</u.username>
   <pf.realname>gymmedrargo</pf.realname>
   <u.email>darlenelopezbaq@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Isopleesolo</u.username>
   <pf.realname>Isopleesolo</pf.realname>
   <u.email>moreabel3289@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Nataluussha</u.username>
   <pf.realname>Nataluussha</pf.realname>
   <u.email>nataluussha@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>NuapeugDamp</u.username>
   <pf.realname>NuapeugDamp</pf.realname>
   <u.email>biribiska@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>reada</u.username>
   <pf.realname>reada</pf.realname>
   <u.email>sakatono@gawab.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>MerriSim</u.username>
   <pf.realname>MerriSim</pf.realname>
   <u.email>runlinux1@zadonsk.net</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>WakRailkNaw</u.username>
   <pf.realname>WakRailkNaw</pf.realname>
   <u.email>pochta35@seroum.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>xritatorik</u.username>
   <pf.realname>xritatorik</pf.realname>
   <u.email>xritator015.71@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>ocealiaLeda</u.username>
   <pf.realname>ocealiaLeda</pf.realname>
   <u.email>gf44r1ujjhghen@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>FrederickYHPL</u.username>
   <pf.realname>FrederickYHPL</pf.realname>
   <u.email>frederickpo@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>incowitatty</u.username>
   <pf.realname>incowitatty</pf.realname>
   <u.email>rafalteltyhyte@antimir.net</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Forexsistl</u.username>
   <pf.realname>Forexsistl</pf.realname>
   <u.email>forexsistl@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Ibn Hotab Ac</u.username>
   <pf.realname>Ibn Hotab Ac</pf.realname>
   <u.email>ibnhotabac@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>sekblerly</u.username>
   <pf.realname>sekblerly</pf.realname>
   <u.email>butlerovmakaq@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>CereTrealmCaf</u.username>
   <pf.realname>CereTrealmCaf</pf.realname>
   <u.email>davidpert@galazmail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>AAkahLayete</u.username>
   <pf.realname>AAkahLayete</pf.realname>
   <u.email>crerheant@2008inflash5.net</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>??????????????</u.username>
   <pf.realname>??????????????</pf.realname>
   <u.email>test@sms-shalavka.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>healison</u.username>
   <pf.realname>healison</pf.realname>
   <u.email>healison@kinozal.tv</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>WhithHese</u.username>
   <pf.realname>WhithHese</pf.realname>
   <u.email>lymnmonaironi@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>BigmanchegGBL</u.username>
   <pf.realname>BigmanchegGBL</pf.realname>
   <u.email>bigmancheg@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Onenuourn</u.username>
   <pf.realname>Onenuourn</pf.realname>
   <u.email>fachhooto@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>PoliaMiller</u.username>
   <pf.realname>PoliaMiller</pf.realname>
   <u.email>poliamiller@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>kenBreennyNom</u.username>
   <pf.realname>kenBreennyNom</pf.realname>
   <u.email>undersaher@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>henuexcenf</u.username>
   <pf.realname>henuexcenf</pf.realname>
   <u.email>ridaeffeftbitt@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>BrumBururumNum</u.username>
   <pf.realname>BrumBururumNum</pf.realname>
   <u.email>brumbururumnum@mail.ru</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>Baxyclartyrat</u.username>
   <pf.realname>Baxyclartyrat</pf.realname>
   <u.email>treo.rasolini2kt@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>auto-insurance</u.username>
   <pf.realname>auto-insurance</pf.realname>
   <u.email>finance.doorways@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
<RECORD>
   <u.username>walkaround76</u.username>
   <pf.realname>walkaround76</pf.realname>
   <u.email>irrepimbereix@gmail.com</u.email>
   <u.timezone>-12.00</u.timezone>
</RECORD>
</RECORDS>


I?m going to move this topic in a little while to a new forum.