Preventing Spambots on PHPbb (For Malky and Davie?)

[Beachcomber]

I vaguely remember Malky (I think) commenting about the time it takes deleting all the spam, drug- and porn-vendor usernames that get setup on the forum, and this is a problem that until a few days ago took up an inordinate amount of my time on another forum.

That appears to be a thing of the past now though, since I installed 'The Humanizer'.

This is a modification to the standard PHPbb files that takes about five minutes to apply and inserts an additional question into the registration script that very effectively confuses the robot software that creates these dummy user accounts without inconveniencing real users.

Full details of the modification and download link care at this web page: http://www.phpbb.com/phpBB/viewtopic.php?t=383788

[Malky]

Thanks for that Beachcomber, I'll maybe give it a go.

A while back I tried a mod that removed the www field from the registration script (you can only add your webpage when you have posted 10 times) so when a spambot tried to fill in the www details, it was deleted as a human would have seen there was no field there. Was quite effective and still is to a degree taking out about 75% of the spam. I get email notification of failed registration attempts and full whois details which can make interesting reading

The only problem is, spammers can read the support forums too and it's not long before they program the bots to deal with the extra question.

On the php-fusion cms I use at campbeltownloch.com, to post comments, you need to add 2 randomly generated numbers together or you can't post. That's very effective. I'd like to see similar for phpBB. I believe version 3 of phpBB will be much more secure though.

Malky

[Beachcomber]

The only problem is, spammers can read the support forums too and it's not long before they program the bots to deal with the extra question.

Yes, it would need to be modified on a regular basis to keep them on the hop.

One of the other mod's for this problem is something that times how long it takes for the registration for to be completed. Below a certain number of seconds and it's rejected as a robot. All it takes to get around it, of course, is a timed delay in the robot's execution loop.