By Sam308 on

It seems that the spam bots are somehow circumventing the CAPTCHA on the user sign-up (create a new account) form. I am currently using the latest version of CAPTCHA 6.x-2.0. I have multiple websites using both the image, text base, and math versions of captchas and still the spam bots are able to sign up.

I am tired of having my user databases polluted with these spam bot user accounts and having to manually delete them.

(1) It seems that these spam bots randomly search for websites with the "create a new account" URLs of ?q=user/register and user/register.

Is there any way to periodically change the "create a new account" URL to some like ?q=user/registernow or ?q=user/register_now_123?

(2) Is there another form of CAPTCHA that works better or a way to add an additional verification step to the "create a new account" process?

By the way, I am already using the LoginToboggan module and have it set to delete pre-authorized accounts within a few days if the users have not verified there new accounts via the email verification step. I am also using the Pathauto module.

Thanks,

Sam308

⋅ Categories: Drupal 6.x

Comments

gpk’s picture

gpk commented

>spam bots are somehow circumventing the CAPTCHA
CAPTCHA doesn't seem to log correct submissions to he system log (admin -> reports -> dblog "Recent log entries") so I'm not sure how you can check that it is all working properly. Perhaps the spammers are employing real people to get through the CAPTCHA, though quite why they would then leave the a/c dormant I can't imagine.

Anyway might be worth trying Mollom.

ALso you could make sure the CAPTCHA Persistence: option is set to Always add a challenge.

gpk
----
www.alexoria.co.uk

izmeez’s picture

izmeez commented

You might try taking a look at http://drupal.org/project/badbehavior

vm’s picture

vm commented

deleting spam accounts can be counter productive. I find it best to block the account rather than delete it. This ensures the bots, whether automated or human reuse the username and especially can't use the same email address they signed up with.

Rhino’s picture

Rhino commented

This is true. If one doesn't want to simply block user, I saw somewhere that somene had another option (I wish I could remember what it was called).

However, it would be nice to not have these bogus users sign up at all. Moderation takes too much of my day, I get 50-100 spam accounts a day since mid-December.

duncan.moo’s picture

duncan.moo commented

Not sure if you have tried it but I am about to use mollom to solve this issue on one of my sites. The handy thing about the Wordpress spam protection plugin Akismet is that it makes use of contributed data from thousands of Wordpress websites out there, so any bot running through sites will be more likely to be noticed.

http://drupal.org/project/mollom

Edit: Hmmm, not great, the Wordpress one is free. Mollom is pretty steep at EUR 30/month for more than 100 legitimate posts/day. It will be a while before I get to those levels, but if I hit 100 on a day do I have to upgrade? Looking elsewhere.

gpk’s picture

gpk commented

There is also .. http://drupal.org/project/akismet .. and Antispam ...

Re mollom:
>but if I hit 100 on a day do I have to upgrade?
No, but you have to choose to either leave your site unprotected once that limit is reached or deny users the ability to add content. What would be good I guess would be to fallback to something like Antispam in that situation, not sure if anyone has looked into that yet.

gpk
----
www.alexoria.co.uk

russelljns’s picture

russelljns commented

I notice that akismet is no longer under development and has been superseded by AntiSpam http://drupal.org/project/antispam
which includes the features as well as some additional, I've installed this and I'm about to try it.
Is it possible/worthwhile running more than one of these solutions? Like for example Mollom and AntiSpam as they seem to do different things?
I'd be interested in anyone who has any experience or further suggestions, thanks :)