Russian Spam Bots

Lately the forum has been inundated with new registrations from Russian Spam Bots. For every one bot that gets through registration, there are at least 10 more that get flagged for admin approval.

So please keep reporting these accounts as they slip through the spam filter.

 

I've noticed they seem to be adapting quickly as we play this game of whack-a-mole with them.

The latest one changed to using English characters for the username, probably so we wouldn't detect what it was until it posted some BS thread in Russian.

 

I was able to block an entire e-mail domain (.ru) from registering previously but they are now using Gmail accounts and other various domains.

For now, I'm just going to have to manually approve/reject new registrations.

 

Why are Russian spambots targeting a small American site about a lolcow and odd media anyways?

 

Because it's automated and takes nanoseconds to do. They just scour the internet for any website software they're compatible with and just hound it. I remember when I set up a FreeBSD box, didn't even host anything yet, just forwarded ports, and I was flooded with Chinese IPs trying to log in to SSH as "root" and "minecraft", probably trying to drop a miner.
This is what people in starving shithole countries (anywhere outside of the US) have to do to make money since they have no job, skills, or an economy to use those in. They just cast a wide of a net as possible and hope they get a bite.

 

They've been busy today.

The number in red is how many user registrations that need to be addressed.

 

Registrations are closed for the time being as the spam bot influx is getting worse.

 

theme of the bots: Эй, ухнем! (Ey, ukhnyem!, "Yo, heave-ho!")

(AKA "Song of the Volga Boatmen" or "I'm a bad troll..." tune)

 

I turned registrations back on.
That was a mistake.
Because 12 hours later:

 

Do you have access to the source code for this forum software?
Maybe you can just straight-up break the sign-up form to where it still technically functions but you do some shit like randomly generate HTML attributes for the fields or something, or make several fake "sign up" buttons and it tells you which one is real.
It's stupid but also the bots will probably be helpless lol.

 

A lot of the bots were coming from the same IP addresses, so it was easy to ban them. However, short of denying a widely-used e-mail domain, I'm kind of at my wit's end. I reached out to Glaive for suggestions.