Board being targeted by spammer school

Get help with installation and running phpBB 3.3.x here. Please do not post bug reports, feature requests, or extension related questions here.
lochness
Registered User
Posts: 96
Joined: Tue Aug 07, 2007 12:04 pm

Board being targeted by spammer school

Post by lochness »

It’s been two days in a row now that my board has been attacked by spammers. It looks like they first registered, then get themselves out of the newly registered users group and then start spamming like crazy.

Most emails used came from fahih.com smallmtn.lol tospage.com seosnaps.com and gmail. I’ve just now disabled permission to open new topics but that is not a solution as you can understand. Is there a way to delay in time when a new user can start a topic?
Last edited by Mick on Mon Feb 12, 2024 5:57 pm, edited 1 time in total.
Reason: Solved.
User avatar
Mick
Support Team Member
Support Team Member
Posts: 26387
Joined: Fri Aug 29, 2008 9:49 am

Re: Board being targeted by spammer school

Post by Mick »

There has been quite a lot of spambot activity this last couple of weeks. If you have the NRU active then each of the new users posts has to be approved by a moderator until he reaches the set threshold so I’m not sure how they can bypass that then post freely. Can you post a link to your board please so we can see what’s going on?
  • "The more connected we get the more alone we become" - Kyle Broflovski©
  • "The good news is hell is just the product of a morbid human imagination.
    The bad news is, whatever humans can imagine, they can usually create.
    " - Harmony Cobel
lochness
Registered User
Posts: 96
Joined: Tue Aug 07, 2007 12:04 pm

Re: Board being targeted by spammer school

Post by lochness »

https://www.abretelibro.com/foro/

Spammers have been bypassing the need for new posts approval for some time now. But it was just one now and then.

Btw, I’ve just set new users to be approved by admins. Not ideal, but since I can’t find any other way right now…
User avatar
Mick
Support Team Member
Support Team Member
Posts: 26387
Joined: Fri Aug 29, 2008 9:49 am

Re: Board being targeted by spammer school

Post by Mick »

I would suggest your Q&A is too easy, I translated the relevant information from Spanish to English got the answer and registered successfully. If I can do that so can a spambot.

Having the Newly Registered User group active basically means that the first number of posts of a new user, set by the threshold set in “New member post limit”, have to be approved by a moderator, two is usually ok. I can’t say I’ve known any spambot bypass the NRU since it has been available.

I suggest you beef up (¿reforzar?) your Q&A and activate the NRU. Also, if you have moderators approving posts ask them not to until you’re happy the Q&A and NRU are working correctly.
  • "The more connected we get the more alone we become" - Kyle Broflovski©
  • "The good news is hell is just the product of a morbid human imagination.
    The bad news is, whatever humans can imagine, they can usually create.
    " - Harmony Cobel
lochness
Registered User
Posts: 96
Joined: Tue Aug 07, 2007 12:04 pm

Re: Board being targeted by spammer school

Post by lochness »

I know the answer to the Q&A is easy, but I still get emails from people that don’t manage to get the answer correctly.

And they’re overriding the new user post limit. No one is approving their posts. Here is the queue from the last forum they spammed. Thieve were the only messages from the user, plus another one I’ve left to be able to check things.
Attachments
IMG_8304.jpeg
User avatar
Mick
Support Team Member
Support Team Member
Posts: 26387
Joined: Fri Aug 29, 2008 9:49 am

Re: Board being targeted by spammer school

Post by Mick »

lochness wrote: Sun Feb 11, 2024 10:41 amAnd they’re overriding the new user post limit
Are the users that are overriding the NRU settings then able to post freely or do you just have a list of posts waiting approval?
  • "The more connected we get the more alone we become" - Kyle Broflovski©
  • "The good news is hell is just the product of a morbid human imagination.
    The bad news is, whatever humans can imagine, they can usually create.
    " - Harmony Cobel
lochness
Registered User
Posts: 96
Joined: Tue Aug 07, 2007 12:04 pm

Re: Board being targeted by spammer school

Post by lochness »

They are mostly able to post freely. When I checked this morning, there were
  • Two or three accounts still inactive plus a bunch from yesterday’s attack.
    Two or three accounts whose messages showed on the to be approved notification list.
    Six or seven accounts that successfully overrode the approval and were able to post freely
User avatar
Mick
Support Team Member
Support Team Member
Posts: 26387
Joined: Fri Aug 29, 2008 9:49 am

Re: Board being targeted by spammer school

Post by Mick »

Can you put the NRU back so I can see what’s happening please?
  • "The more connected we get the more alone we become" - Kyle Broflovski©
  • "The good news is hell is just the product of a morbid human imagination.
    The bad news is, whatever humans can imagine, they can usually create.
    " - Harmony Cobel
User avatar
KevC
Support Team Member
Support Team Member
Posts: 72287
Joined: Fri Jun 04, 2004 10:44 am
Location: Oxford, UK
Contact:

Re: Board being targeted by spammer school

Post by KevC »

Can you do a version of that screenshot in English so we can understand the messages?
The important bit is to the left showing who approved the post.

It's not possible to bypass the systems, there will be a permission issue or something not set up correctly.
-:|:- Support Request Template -:|:-
Image
"Step up to red alert. Sir, are you absolutely sure? It does mean changing the bulb"
lochness
Registered User
Posts: 96
Joined: Tue Aug 07, 2007 12:04 pm

Re: Board being targeted by spammer school

Post by lochness »

Mick wrote: Sun Feb 11, 2024 11:06 am Can you put the NRU back so I can see what’s happening please?
The NRU is still on. Never removed it. At least with the user I’ve just approved it still shows as working.
KevC wrote: Sun Feb 11, 2024 11:06 am Can you do a version of that screenshot in English so we can understand the messages?
The important bit is to the left showing who approved the post.

It's not possible to bypass the systems, there will be a permission issue or something not set up correctly.
The bottom two are two forum moderators and all the rest are mine. When a moderator approves a post, it says so: message approved.
Attachments
IMG_8305.jpeg
lochness
Registered User
Posts: 96
Joined: Tue Aug 07, 2007 12:04 pm

Re: Board being targeted by spammer school

Post by lochness »

Ok. There are also users who have been blocked due to spam showing no last time active on the user list.
User avatar
KevC
Support Team Member
Support Team Member
Posts: 72287
Joined: Fri Jun 04, 2004 10:44 am
Location: Oxford, UK
Contact:

Re: Board being targeted by spammer school

Post by KevC »

None of the records in that screenshot are showing posts that have been approved.

Have you actually made a new account yourself and tried to post in the same forum they posted in to see if the permissions are working as you expect them to?
-:|:- Support Request Template -:|:-
Image
"Step up to red alert. Sir, are you absolutely sure? It does mean changing the bulb"
lochness
Registered User
Posts: 96
Joined: Tue Aug 07, 2007 12:04 pm

Re: Board being targeted by spammer school

Post by lochness »

The permissions are working as expected for everybody, except the spammers. I’m just changing my passwords as an additional security step.
User avatar
KevC
Support Team Member
Support Team Member
Posts: 72287
Joined: Fri Jun 04, 2004 10:44 am
Location: Oxford, UK
Contact:

Re: Board being targeted by spammer school

Post by KevC »

Like I said though, it's not possible to bypass those systems.

The best way to check is to make a new account yourself and try it.
-:|:- Support Request Template -:|:-
Image
"Step up to red alert. Sir, are you absolutely sure? It does mean changing the bulb"
User avatar
Mick
Support Team Member
Support Team Member
Posts: 26387
Joined: Fri Aug 29, 2008 9:49 am

Re: Board being targeted by spammer school

Post by Mick »

I’ve just posted four topics in “Música y radio” and they are visible whilst logged out and I didn’t get the “This message has been submitted successfully, but it will need to be approved by a moderator before it is publicly viewable. You will be notified when your post has been approved” message. That account isn’t in the NRU group.
  • "The more connected we get the more alone we become" - Kyle Broflovski©
  • "The good news is hell is just the product of a morbid human imagination.
    The bad news is, whatever humans can imagine, they can usually create.
    " - Harmony Cobel
Post Reply

Return to “[3.3.x] Support Forum”