Topic: Spam, Spam and more spam

Spam, Spam and more spam

abossola
Participant

@abossola

14 years, 11 months ago

I shouldn’t joke about spam as it is quite a problem with buddypress. I’ve tried so many things and I am out of ideas. In this Forum there are lots of suggestions but everyone still seems to be SOL or just hanging on.

Where I have failed:

BP Registration Options

This would be great if it worked. But, it still allows users to register. Worse, is that they show up under Site Wide Activity on the home page for everyone to see that you are getting spam. It would be great if there was a fix for that. For anyone with lots of spam, start here, at least you can have some options: http://webdevstudios.com/support/wordpress-plugins/buddypress-registration-options/

Not to get sidetracked here but this is a cool plugin I found for the Sitewide Activity Widget:http://buddypress.org/forums/topic/advanced-recent-site-wide-posts-widget

With BP options I get several errors, which I will share since the Forum by the Plugin’s Author seems to not get much response. http://webdevstudios.com/support/forum/buddypress-registration-options/not-working-and-have-errors/ – Maybe we can work some things out here bc I am not the only one with problems with this plugin.

SI Captcha

http://wpmu.org/si-captcha-anti-spam-wpmu-and-buddypress-plugin-contest-entry/

Well it works, or at least shows on the registration page. BUT, the crafty bots or slave laborists just fill in the codes and it’s a waste as well as an extra step for a user that is worthless.

ReCaptcha

Here is another great one.

http://buddypress.org/forums/topic/buddypress-spam-1

But it only shows on the comments and NOT on the registration page itself. It’s been “modified” to work with BP, but I can’t get it to work. Again, slave labor can overcome this one quite easily. Think I am kidding about the slave labor: http://ha.ckers.org/blog/20080311/human-captcha-breaking/

Here is an entire group for spam lovers like myself:

http://buddypress.org/groups/fighting-spam-splogs

There are some good tips in that link above here are a few swings I took:

http://wordpress-plugins.feifei.us/hashcash/

No dice for me. It seems to work for comments but not the registration page.

http://www.poradnik-webmastera.com/projekty/invisible_defender/

Same again… No dice for me. It seems to work for comments but not the registration page.

http://www.svenkubiak.de/nospamnx-en/

Giving it a whirl now… I’ll keep you posted.

http://www.hybrid6.com/webgeek/plugins/wp-spamfree

Same again… No dice for me. It seems to work for comments but not the registration page.

Here is my favorite and WAS my most hopeful option:

http://www.bp-tricks.com/tips_and_tricks/stopping-the-sploggers/

Guess what, still getting spam. Loads of it too. You would think a little core hacking would throw them off. Tsk tsk…. not these bots/humans. A little tip here for the changing of the slug and the code you add to the config files – Don’t forget to put the define statements BEFORE the STOP EDITING HERE LINE in the config.php. That had me and others scratching our heads for a while.

How about this one:

http://premium.wpmudev.org/project/signup-code

Yeah why don’t we just go ahead and give the user a puzzle via snail mail and they can can send smoke signals once they get it. Or better yet just send them a link to Facebook and save everyone some headache. This MAY work but it is too much to ask of a user.

Maybe a few checkboxes will throw the bots off:

http://premium.wpmudev.org/project/terms-of-service

Guess what? No dice.. still getting spam.

.htaccess solutions:

http://wpmututorials.com/how-to/spam-blogs-and-buddypress/

This one seemed hopeful. But no change, still getting spam.

# BEGIN ANTISPAMBLOG REGISTRATION

RewriteCond %{REQUEST_METHOD} POST

RewriteCond %{REQUEST_URI} .yourbpsignupslug*

RewriteCond %{HTTP_REFERER} !.*yourhomedomain.* [OR]

RewriteCond %{HTTP_USER_AGENT} ^$

RewriteRule (.*) http://die-spammers.com/ [R=301,L]

# END ANTISPAMBLOG REGISTRATION

You can try banning IPs but an .htaccess tidbit or by using most of the plugins above. But IPs are a dime a dozen to spammers and thats a total waste of time if you ask me.

In Summary:

Short of rewriting the registration page and my own plugin for spam I am at a loss. Any tips would be helpful. Hopefully this post will help some others with the same problem. Sorry for the sarcasm but it’s how I survive the insanity.

Site: http://hoopsjones.com

BP Version 1.1.3

WP – 2.8.6

Viewing 25 replies - 26 through 50 (of 82 total)

← 1 2 3 4 →

bbrian017
Participant

@bbrian017

14 years, 9 months ago

I added the line. as suggested.

/* That’s all, stop editing! Happy blogging. */

define( ‘BP_REGISTER_SLUG’, ‘yourregisterslug’ );

/** WordPress absolute path to the WordPress directory. */

That’s what it looks like.

Andrea_r sorry I’m in three different threads right now I feel like your chasing me around haha!

Andy Peatling
Keymaster

@apeatling

14 years, 9 months ago

Don’t add it below the “Stop Editing” line.

bbrian017
Participant

@bbrian017

14 years, 9 months ago

Alright I have added right after

define( ‘COOKIEPATH’, ‘/’ );

and right before

/* That’s all, stop editing! Happy blogging. */

What is this suppose to do anyways? I’m not sure I understand how this stops spam.

So now my wp-config is like this,

define( ‘COOKIEPATH’, ‘/’ );

define( ‘BP_REGISTER_SLUG’, ‘randomcrazyslugger’ );

/* That’s all, stop editing! Happy blogging. */

/** WordPress absolute path to the WordPress directory. */

mlovelock
Participant

@mlovelock

14 years, 9 months ago

@Bbrian017 – the register ‘slug’ is the path to your register page. So the default is yourdomain.com/register – yours would now be yourdomain.com/randomcrazyslugger

Given that, you probably don’t want your register page to be ‘randomcrazyslugger’ so you might want to change it to something that makes a little more sense to your site / your users.

bbrian017
Participant

@bbrian017

14 years, 9 months ago

Thanks for the tip mlovelock I have done what you said. Seems it has stopped some spam but 10 minute later it all starts again.

They must get error messages stating the register page doesn’t exist or something.

bbrian017
Participant

@bbrian017

14 years, 9 months ago

My spam issue is just not stopping and it’s driving me insane!!!!

bbrian017
Participant

@bbrian017

14 years, 9 months ago

Seriously no one is having spam issues like I am?

13 accounts since my last post!

please any help here would be great

stripedsquirrel
Participant

@stripedsquirrel

14 years, 9 months ago

Did you try deleting wp-signup.php?

And have you made sure that all spam users have been ‘spammed’ so they cannot just simply add/open new spam users/blogs?

still giving
Participant

@nonegiven

14 years, 9 months ago

Just a question, perhaps this should be on dev, but would it not be possible to have certain customizable elements which each and every installation of WPMU/BP had to create whilst doing an install, e.g. the name of the pages and hooks that the sploggers exploit?

Yes, they know which pages and what code to look for … but if this was having to be changed during each and every installation, would it not work to stop them?

Excuse my ignorance, we suffer sploggers but I have no idea what it is they are exploiting.

still giving
Participant

@nonegiven

14 years, 9 months ago

What recommendations are there for a captcha or a custom field creation that fits into the BP 1.2 registration process?

I have tried a few plugins but they don’t work in BP 1.2 and dont appear in the registration.

Yes, logging on and custom profiles etc are OK … but this open door approach DOES pass on a lot of janitorial work to site admins

It seems strange that there is no default to offer some basic kind of obstacle to registration in the blog registration process … it is like building a house with wide open doors.

Buddypress only adds layers on top of WPMU liabilities what with the attraction of Activity Directory and so on. It looks embarrassing to have it all advertised their by default.

foxly
Participant

@foxly

14 years, 9 months ago

Again to the two guys being relentlessly spammed: post the domain names that you are having problems with and I will try to find out what’s going on.

^F^

Andrea Rennick
Participant

@andrea_r

14 years, 9 months ago

“would it not be possible to have certain customizable elements which each and every installation of WPMU/BP had to create whilst doing an install, e.g. the name of the pages and hooks that the sploggers exploit?”

They look for the default registration slug. You already have the ability to change it.

still giving
Participant

@nonegiven

14 years, 8 months ago

Think it through … it is a kind of Microsoft moment

Spamming WPMY/BP is only popular enough because there are significant numbers of unmodified installations going on.

Because there are a significant numbers of unmodified installations going on we … and our servers … all take a hit on this crap.

So … disincentivize the platform by making that custom modification obligatory … for all … during the installation process.

Spammers would face a pretty impossible or unrewarding task and move their attentions elsewhere.

Does that work logically and technically?

It is not good enough just to point out one can change it … the problem is not enough people are and hence we are all paying for the vulnerability of the platform.

So shut that vulnerability off. Simple, no?

pushi22le
Participant

@pushi22le

14 years, 8 months ago

My solution against spam:

I replaced the whole content of wp-signup.php with

header( ‘Location: http://mysite.com/register’ ) ;

Since than no more spam

nightowl99
Participant

@nightowl99

14 years, 8 months ago

Well, I pretty much tried most of the suggestions here on this thread, and for a couple of days it was quiet. But since yesterday a new and much more aggressive wave is battering my poor little site with as much as 70 new accounts and blogs per hour.

The last wave started shortly after this log entry:

http://www.webwarper.net/ww/~av/www.google.com/search?hl=en&q=site:.NET%20inurl:%22register%22%20intext:%22Registering%20for%20this%20site%20is%20easy,%20just%20fill%20in%20the%20fields%20below%20and%20we%27ll%20get%20a%20new%20account%20set%20up%20for%20you%20in%20no%20time.%22&start=10&sa=N

These accounts don’t have ANY fields filled out from the BP registration form. Even if I re-write that page they’ll just pick something else to hunt for. I’m back to asking folks to contact me if they want to join the site, but that’s a major deterrent for most, understandably.

Andrea Rennick
Participant

@andrea_r

14 years, 8 months ago

Block the registration page from the search engines. JUST the register page.

bpisimone
Participant

@bpisimone

14 years, 8 months ago

@Andrea_r good thought, how would that look like?

Hugo Ashmore
Participant

@hnla

14 years, 8 months ago

Google ‘robots.txt file’ for starters

David Lewis
Participant

@takeo

14 years, 8 months ago

I’m starting to get hit now :o( I have had a custom slug for weeks. I added a robots file today disallowing bot access from /my-signup-slug/ and also installed invisible defender but I’m still getting spam registrations. I also just deleted my wp-signup.php file. I’m going to try hashcash. I’m also considering a htaccess file that simply bans ALL traffic to the entire website from Russia, China and any .info domains.

nightowl99
Participant

@nightowl99

14 years, 8 months ago

I must be overworked or hallucinating. Signups are disabled, wp-signup was deleted some time ago, and they are still creating new accounts and blogs as we speak! How is this possible? For a while I kept entering the ip s in wp-ban and had given up on that plugin, but I noticed it caught about 600 attempts in the last 24 hrs. Still, a few dozen got through anyway.

The only other way I can think of is that a member is “inviting” them via the “Allow blog administrators to add new users to their blog via the Users->Add New page.” on the WPMU options page, so I’m going to disable that as well now.

We’re still a relatively small and young community and all these restrictions and jumping through hoops is hurting us.

Andrea Rennick
Participant

@andrea_r

14 years, 8 months ago

“The only other way I can think of is that a member is “inviting” them via the “Allow blog administrators to add new users to their blog via the Users->Add New page.” on the WPMU options page, so I’m going to disable that as well now.”

That’s one of the first things I turn off.
David Lewis
Participant

@takeo

14 years, 8 months ago
So to sum up:
- Change your signup slug
- Add some required custom profile fields (or use the hashcash trick posted at the start of this thread)
- Disable “Allow blog administrators to add new users to their blog via the Users->Add New page”
- Delete BuddyPress credit in footer.php
- Delete wp-signup.php
- Create a robots.txt file with User-agent: * Disallow: /register/ (or whatever your slug is)
- If all else fails, use CAPTHCA or preferably a simple random question (what colour is snow)
Am I wrong or missing anything?

Also… all of my SPAM registrations were coming from .info domains. I added this to my .htaccess file but I’m not sure it’s correct. I found a million examples via Google search for how to ban full domains or subdomains… but nothing about blocking an entire extension (i.e… whatever.info). Anyway, this is what I wrote:
```
RewriteCond %{REMOTE_HOST} \\.info$

RewriteRule .* - [F]
```
Andrea Rennick
Participant

@andrea_r

14 years, 8 months ago

That won’t harm anything, but it won’t stop signups from that domain, just requests.

In MU, there *is* an option to block certain email domains. There’s a funny way to put in wildcards though.

Hugo Ashmore
Participant

@hnla

14 years, 8 months ago

In MU, there *is* an option to block certain email domains. There’s a funny way to put in wildcards though.

,

Thing is Andrea that doesn’t appear to make a blind bit of difference, we had a number of signups from half a dozen email domains repeated over and over, easy I thought, first line of attack drop those domains in the block list. Didn’t do a thing those same email domains kept coming through. I suspect that when someone looks into it they will find that BP registration bypasses this check somehow! sadly!

David Lewis
Participant

@takeo

14 years, 8 months ago

Thanks Andrea_r

So can you tell me how to block signups from anyone with a domain that has a .info extension? I’m sure that 99.9% of people with .info domains are SPAMers. I found the “Banned Email Domains” setting in WPMU but cannot find any documentation about how to use a wildcard or regex in that field. It’s not any ONE fully qialified domain for me… it’s dozens of different domains all ending in .info.

I’ve done everything in my list above (except CAPTHA or Hashcash) and I’m STILL getting signups from these bastards. Maybe I should try Hashcash. You’re right, the htaccess rule above did nothing. Driving me CRAZY!!! Buggers.