Board being targeted by spammer school

[lochness]

It’s been two days in a row now that my board has been attacked by spammers. It looks like they first registered, then get themselves out of the newly registered users group and then start spamming like crazy.

Most emails used came from fahih.com smallmtn.lol tospage.com seosnaps.com and gmail. I’ve just now disabled permission to open new topics but that is not a solution as you can understand. Is there a way to delay in time when a new user can start a topic?

[Mick]

There has been quite a lot of spambot activity this last couple of weeks. If you have the NRU active then each of the new users posts has to be approved by a moderator until he reaches the set threshold so I’m not sure how they can bypass that then post freely. Can you post a link to your board please so we can see what’s going on?

[lochness]

https://www.abretelibro.com/foro/

Spammers have been bypassing the need for new posts approval for some time now. But it was just one now and then.

Btw, I’ve just set new users to be approved by admins. Not ideal, but since I can’t find any other way right now…

[Mick]

I would suggest your Q&A is too easy, I translated the relevant information from Spanish to English got the answer and registered successfully. If I can do that so can a spambot.

Having the Newly Registered User group active basically means that the first number of posts of a new user, set by the threshold set in “New member post limit”, have to be approved by a moderator, two is usually ok. I can’t say I’ve known any spambot bypass the NRU since it has been available.

I suggest you beef up (¿reforzar?) your Q&A and activate the NRU. Also, if you have moderators approving posts ask them not to until you’re happy the Q&A and NRU are working correctly.

[lochness]

I know the answer to the Q&A is easy, but I still get emails from people that don’t manage to get the answer correctly.

And they’re overriding the new user post limit. No one is approving their posts. Here is the queue from the last forum they spammed. Thieve were the only messages from the user, plus another one I’ve left to be able to check things.

[Mick]

And they’re overriding the new user post limit

Are the users that are overriding the NRU settings then able to post freely or do you just have a list of posts waiting approval?

[lochness]

They are mostly able to post freely. When I checked this morning, there were

• Two or three accounts still inactive plus a bunch from yesterday’s attack.
  Two or three accounts whose messages showed on the to be approved notification list.
  Six or seven accounts that successfully overrode the approval and were able to post freely

[Mick]

Can you put the NRU back so I can see what’s happening please?

[KevC]

Can you do a version of that screenshot in English so we can understand the messages?
The important bit is to the left showing who approved the post.

It's not possible to bypass the systems, there will be a permission issue or something not set up correctly.

[lochness]

Can you put the NRU back so I can see what’s happening please?

The NRU is still on. Never removed it. At least with the user I’ve just approved it still shows as working.

Can you do a version of that screenshot in English so we can understand the messages?
The important bit is to the left showing who approved the post.

It's not possible to bypass the systems, there will be a permission issue or something not set up correctly.

The bottom two are two forum moderators and all the rest are mine. When a moderator approves a post, it says so: message approved.

[lochness]

Ok. There are also users who have been blocked due to spam showing no last time active on the user list.

[KevC]

None of the records in that screenshot are showing posts that have been approved.

Have you actually made a new account yourself and tried to post in the same forum they posted in to see if the permissions are working as you expect them to?

[lochness]

The permissions are working as expected for everybody, except the spammers. I’m just changing my passwords as an additional security step.

[KevC]

Like I said though, it's not possible to bypass those systems.

The best way to check is to make a new account yourself and try it.

[Mick]

I’ve just posted four topics in “Música y radio” and they are visible whilst logged out and I didn’t get the “This message has been submitted successfully, but it will need to be approved by a moderator before it is publicly viewable. You will be notified when your post has been approved” message. That account isn’t in the NRU group.