Spam PMs on PPCMLA

[alk]

Hey admins...

I'm having a bit of trouble keeping the spammers off the PPCMLA board and sending out PMs to everyone. That doesn't seem to happen here. What countermeasures are you taking to stop the spammers?

You're on phpBB 3, right? I'm still on 2.x, and I'm using the Anti-Spam ACP and a better captcha, but obviously that's not enough. Are there new security features in 3.x that make it harder for spammers to get through?

Thoughts?

Peace,

Drew

 

[bhylak]

Well to start off PPC's are more recent then 68k, so therefor searched for more and remember not all spammers are bots!

 

[Mars478]

I got another message about a PM that was not there. I can help you out with the board if needed, I am pretty good with phpBB.

 

[Osgeld]

there is a add on for , I think 2x and 3x, that checks the email someone enters during registration against "stop forum spam now"s big ass blacklist, if the email is on the list it insta bans the account

I have not personally delt with it (I left phpBB years ago) but I have mentioned it around some of the forums I frequent and its a large difference

 

[alk]

there is a add on for , I think 2x and 3x, that checks the email someone enters during registration against "stop forum spam now"s big ass blacklist, if the email is on the list it insta bans the account

That sounds useful. Do you have a name for that add-on?

Peace,

Drew

 

[Osgeld]

http://www.phpbb.com/community/viewtopic.php?f=70&t=1349145

that is the thread for the phpbb 3x version, I didn't see much in the way of a 2x version, but its been well over 2 years since I looked

just wondering, whats the reason behind using 2x?

 

[alk]

just wondering, whats the reason behind using 2x?

2.x was current when I started the forum (early 2007). The theme required a lot of work, and I'm putting off porting it to 3.x. That's the only reason.

Peace,

Drew

 

[Osgeld]

yea I can feel ya there, course as a side option you could install a local lamp package and make a clone site locally to fiddle with without borking the public site (an when you get it all worked out you do a current database conversion and upload all the files quick n smooth)

I am pretty sure there was a 2x version of the same idea, but I really dont know where, i think there is a whole subsite for phpbb2 somewhere in that domain, v3 did not sit well with v2 users for a while, but most of the pain is smoothed over

 

[bhylak]

Yes, today I got a message, and I clicked on it and it said I had no new messages...

 

[Osgeld]

yea, when someone - bot pm's you and the admins ban that user you still get notification, but by the time you read it the user has been removed

 

[alk]

In the meantime, I've decided to hack phpBB to require users to have at least 5 posts before they can access the PM interface. It's not ideal because new users won't be able to send or read PMs, but at least the spammers should be caught by it.

Peace,

Drew

 

[alk]

Props to Osgeld for the idea. I found a registration mod that looks up email addresses in databases of known emails associated with spammers. Here it is:

http://temerc.com/forums/viewtopic.php?f=71&t=6181

I installed that just a moment ago.

Mars478: Thanks for the offer of assistance, but I'm not looking for any new moderators at the moment.

Peace,

Drew

 

[Mars478]

You may want to put a custom profile field that is required at registration, in a pop up menu, I put that in my forum as

"Are you a filthy spammer?"

and a pop- down menu comes down with No selected by default and the user must select yes to register, and if they select no, they are told to choose the correct answer.

It solved most of our spam problems, we have no spammers, on a forum with 200,000 posts and 2000 members.

 

[bhylak]

Wait, do you mean the other say around???

 

[Mars478]

What do you mean?

 

[Osgeld]

"Are you a filthy spammer?"

Yes, OK come on in!

you had it backwards in your review

On the irshell.org (home brew sony psp OS like program) site I setup and occasionally admin we very rarley get any spammers, and barley have any methods of prevention with (last I looked) 1.9 million hits (per year) and ~ 22k registered users

what that site does is wraps around different modules (its a joomla system) which has the nice effect of not leaving a footer on every single page that says "hi were running joomla 1.5 please come spam us",its still there, just not in the footer... where I am going with this at the bottom of this page it has

"Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group" in plain easily script phrasable text, that bots look for when they are designed to target a system

taking that text and putting the exact same information (becuase its part of the licence you agreed to) in a image, and removing the link to phpbb to a different local page, like a listing of credits, is pretty darn effective

during a barrage on a buddies VB forum (vb sucks) where bots were posting at a rate of ~10 messages a min, doing the above almost instantly stopped new bots from wandering in, and a similar blacklist mod using 'stop forum spam now' auto banned all the bots already registered and rejected new ones

a year later and I think he has only had a couple sneak in, that when the blacklist was updated got autobaned before we even noticed

 

[Mars478]

Oh, you're right! Let me edit it! Thanks

 

[~tl]

The install of phpBB we're using here is completely stock, aside from some tweaks to the templates. We're using reCAPTCHA on the registration page (which is an option as of 3.0.6, but there is a modification for 2.0.x that adds it) which seems to keep a lot of spammers at bay. We do get the occasional account posting spam, but their accounts tend to get deleted pretty quickly. We also do a bi-monthly (ish) purge of all zero-posting accounts to help rid the spam-sleeper accounts. That is probably worth doing, though there's not an ACP tool to do it with 2.0.x. You can run a SQL query to do it easily enough, if you're in to that sort of thing.

I'm not really sure why we've escaped the blight of PM spam. Honestly, I can't remember ever having a case of it reported. It could just be blind luck, I guess [)] ]'>

 

[macgeek417]

Oh, and back on topic:

If you are going to have to rewrite your theme anyway, why waste your time with phpBB? You would be better off just making your current forum an archive and switching to Simple Machines. SMF is *loads* better than phpBB