Handling spam accounts - best practices?

a month ago by BrutalBirdie to c/general-discussion

Hello NodeBB Community :wave:

I started a purge for our forum with the goal of deleting spam accounts. Started with ~`40000` user accounts and realized very fast that deleting them manually will be a Sisyphus task. Vibe coded a usercleaner plugin with filters and stuff like that.

image.jpeg

So with that filter, 70.20% of all accounts are spam. After that was cleaned out I looked deeper into more recent accounts and was a little shocked.

I identified a set of mail hosts used for verification over and over again. From the manage user view with 500 accounts did a little RegEx search with a browser plugin and got 381 of 500 users are from these mail hosts. So 76.2%.

After I complete my purge, from 39133 accounts 2754 are left. 93% of accounts where spam or the other way around only 7% "good" accounts.

note: will create some feature requests since I noticed some stuff in the manage user view


I found this plugin https://github.com/... but also thought, that can't be it. These bots will just use other mail addresses. So, how do you guys handle this? Just ignore it?

Looking forward for some input from the community.

Thanks for reading and thinking about a clean forum with me :D

load all comments
brutalbirdie 1 point a month ago

Check in. Again 10 accounts from gsaserbuilder.xyz got created. I have configured Spam Be Gone with Akismet, Project Honeypot, StopForumSpam and hCaptcha.

I have mixed feelings about enabling the registration queue, but will try it anyway. edit: just set Registration Approval Type to Admin Approval and the link pointing to $FQDN/admin/manage/registration leads to a Not Found. Maybe need to restart the forum? Will try.

path: 0 25833318, hotness: undefined, score: 1, children: 3
omega 2 points 18 days ago

> @BrutalBirdie said: > > Check in. > Again 10 accounts from gsaserbuilder.xyz got created. > I have configured Spam Be Gone with Akismet, Project Honeypot, StopForumSpam and hCaptcha.

Spam has been a long running bot overhead for sites for what seems like forever. I can only imagine AI has given this virtual dead army a diabolical boost.

In my simple mind I would have thought hCaptcha might provide a decent holdout against bots, am I too understand it had negligible effect even when combined with all the other mitigations? :worried:

path: 0 25833318 26030258, hotness: undefined, score: 2, children: 1
brutalbirdie 1 point 17 days ago

> @omega said: > > In my simple mind I would have thought hCaptcha might provide a decent holdout against bots, am I too understand it had negligible effect even when combined with all the other mitigations?

In our case we still have a decent amount of spam accounts that try to get through. I have a suspicion how tho but I will need to investigate.

path: 0 25833318 26030258 26053746, hotness: undefined, score: 1, children: 0
brutalbirdie 1 point a month ago

> BrutalBirdie said: > > edit: just set Registration Approval Type to Admin Approval and the link pointing to $FQDN/admin/manage/registration leads to a Not Found.

Found the real one, it is /registration-queue and not /admin/manage/registration. So that is a "bug". https://github.com/NodeBB/NodeBB/pull/14825

path: 0 25833318 25833435, hotness: undefined, score: 1, children: 0
general-discussion
general-discussion

@community.nodebb.org

login for more options
0
121
15

A place to talk about whatever you want

go to feed...