In the last 2 weeks I've been getting numerous fake members added onto my website. They are bypassing the captcha, any required fields I add. I have even added new required fields and taken away fields to try and trick their robot from getting onto my website but nothing is working. They are even bypassing the email verification.
They are just appearing on the website, about 10 new fake members a day I am receiving. I have to manually delete each fake member.
I also noticed your demo site is also hit with the same person. The only reason I know it is the same person is because the fake members are similarly named and their profile picture is the same (different from oxwall default profile pic).
Here's an example http://demo.oxwall.org/user/WinstonOS [Edit: oxwall resets their demo periodically so that page is no longer existing]
The profile pic is always the same on these fake members. It looks like the one I have attached.
What can I do about it?
We build. You grow.
Get best community software hereStart a social network, a fan-site, an education project with oxwall - free opensource community software
Fake members appearing on website | Forum
Elle Spears
Sep 9 '12
Getting the exact same problem recently, same avatars & everything. would like to see if there's something that can be done about this
Roland Mallapre
Sep 9 '12
same here. same avatar. and even if i enable the email verification feature, the fake users can still register to the site and posts blogs afterwards.
The Forum post is edited by Roland Mallapre Sep 9 '12
Dennis
Sep 9 '12
Same issue here. I guess I have to wonder why, when I make it mandatory for me to approve members, do their spam posts show up on the site. I'm willing to deal with the fake users, but don't like their posts cluttering things up until I delete them.
Vicki
Sep 9 '12
Here is another good look at it (attached). This screenshot was from Oxwall's very own Demo site. I know their demo site is for testing purposes but it is exactly what is happening on my website.
I also noticed that Oxwall is cleaning up their own demo site of this because I checked a few hours ago and the fake members had been deleted. [Edit: oxwall resets their demo periodically so you can refer to the attachment to see what it looks like]
Manually deleting fake members every other hour is not my idea of website management. I hope something can be done about this.
I also noticed that Oxwall is cleaning up their own demo site of this because I checked a few hours ago and the fake members had been deleted. [Edit: oxwall resets their demo periodically so you can refer to the attachment to see what it looks like]
Manually deleting fake members every other hour is not my idea of website management. I hope something can be done about this.
The Forum post is edited by Vicki Sep 10 '12
Purusothaman Ramanujam
Sep 9 '12
Hi,
It is possible to handle the fake members or spammers automatically with the plugin in store.
It is possible to handle the fake members or spammers automatically with the plugin in store.
Vicki
Sep 10 '12
Hi Purusothaman, I don't think that is the solution to this issue. The spammer/hacker is bypassing all system mechanisms.
Vicki
Sep 10 '12
Hi Paul, do you know how I can find out the IP address of the fake members? Aside from having to keep buying plugins, is there a way?
Vicki
Sep 10 '12
Hi Paul, that would be a great start for me. Where can I go to see the access logs? I don't have a heavy load on my website so it would be fairly easy for me to see, I think, which IP is from the spammer. If I can just know where I can go to see the access log, that would be very helpful to know.
Vicki
Sep 10 '12
Hi Paul, thank you so much for pointing me in the right direction. I found in my hosting control panel "latest visitors" and it shows me IP, date stamp, and even the page that was visited.
I marked down the IP address from the suspect. There were 5 joins all during the same minute, which matches the fake members on my site.
I will wait for the next attack to be sure of this IP address. Once I get that, I can add it to my block/ban list.
I marked down the IP address from the suspect. There were 5 joins all during the same minute, which matches the fake members on my site.
I will wait for the next attack to be sure of this IP address. Once I get that, I can add it to my block/ban list.
Vicki
Sep 10 '12
This particular IP says France which is definitely not within my member base.
Thanks again Paul. You rock!
Thanks again Paul. You rock!
Purusothaman Ramanujam
Sep 10 '12
Trusting IP address does not really work practically as it can be bypassed by spammers. They could easily forge IPs. You might even loose some real users in this case.
Reg. UserIP plugin: It stores the data based on the user login. Which means, during registration also, as registrations triggers login.
Reg. UserIP plugin: It stores the data based on the user login. Which means, during registration also, as registrations triggers login.
Vicki
Sep 10 '12
True, I understand all that. I'd like to try my own methods before forking out dollars for plugins in which may also be bypassed eventually.
Purusothaman Ramanujam
Sep 10 '12
No anti-spam method can block all the spams.
Hope you can find some better way to stop them.
Hope you can find some better way to stop them.
Douglas
Sep 10 '12
I am getting hit by that same spammer using the same avatar.gif
What i did was set the user signup so new users must be approved by the admin before becoming active. I still have the bot signups, but they cant do anything until i approve them. then i can delete all of them at once with two clicks of the mouse from the admin panel.
You can find this setting under Privacy & Permissions--> Global Privacy--> Mandatory User Approve
See attached image...
The Forum post is edited by Douglas Sep 10 '12
Vicki
Sep 11 '12
Hi Douglas, thank you for that information. I did try that selection and noticed they were still getting on the website but what I didn't know was that they can't create fake groups and links. That is very helpful. I will keep the selection on and hopefully, oxwall may fix this hole in the future.
Douglas
Sep 11 '12
You're welcome Vicki. I went to your site yesterday and saw the mess the spammer created. He did that to mine also until i activated that setting. Now all i have to do is delete the inactive spam accounts daily. :)
Thomas
Sep 12 '12
I have been getting nailed with spam these last couple of days! What a pain in the a**. So the only way around this by doing mandatory approvals? That sucks since I do not want to sit here all day approving members.
Vicki
Sep 12 '12
Hi Paul, I'm not sure how advanced robots can be but I have found that the fake members are seen as "verified" on my list but "unapproved" because I have the "mandatory member approve" set.
