Massive spam users and spam entries despite triple layer protection

Question

I'm going a little nuts here. The entire point of my site resides on the idea of people registering for the site to contribute content. But I get spam accounts created at least once every minute. Im mass deleting these accounts and the content they create every single time I visit my own site.

I currently use Mollom with the CAPTCHA as the default method (not text analysis) and I have text analysis set to every other form across my site, I use the AntiSpam module set to and properly configured Akismet (had good results from Wordpress), and also have Spamicide enabled and properly configured.

But spam users are still being made in some very insane amounts, and generating content all over my site; which leads me to wonder if they're even using the forms at all any more to generate content on my site..

EDIT may have been a little paranoia but I changed the user credentials to my database just to be sure. And yeah, user accounts by the dozens still being created..

I just tried out the Spamicide module by exposing the form element with Firebug and writing anything in it. Sure enough the form doesn't register the account.

The Captcha works perfectly too.

Note: I understand Captchas is not good enough (Spam bots these days can solve captchas), but its the only option I get from Mollom.

Answer 1

While there are many approaches different people follow, here is the approach that I follow and generally works for me.

Anti-spam suit should include the following three

1. Centralised blacklisting or whitelisting.
2. A quality scoring mechanism.
3. Honeypots and user behaviour analysis.

I use the following generally.

At the server level Install Fail2Ban on server.

1. Use httpbl for centralised DNS Blacklisting.
2. Mollom is getting better with time.
3. Botcha or Spamicide.
4. Captcha I still prefer text captcha or math captchas :)

This combination has been working out very well for me.

Answer 2

Consider adding either of those modules (quotes are from their project pages):

• Honeypot

Honeypot uses both the honeypot and timestamp methods of deterring spam bots from completing forms on a Drupal site. These methods are effective against many spam bots, and are not as intrusive as CAPTCHAs or other methods which punish the user.

• BOTCHA Spam Prevention

BOTCHA Spam Prevention is a highly configurable non-CAPTCHA spam protection framework.

BOTCHA, doesn't abuse human users, BOTCHA protection is completely transparent to them and non-intrusive.

If these modules still don't help to reduce your issues, then I would go for plan-b, i.e:

• Consider reviewing (extending if needed) your registration form, by adding 1 more or fields so that it becomes AbitMORE difficult to complete registration requests. Either some obvious question for which your target audience should know the answer by heart, or something for which the answer can be found by first browsing around on your site. Yet another option is to ask some question about their real name or address, which may help later on how "serious" the request is.
• Make admin approval required for every new user registration request. This will reduce the speed of "registered" users to the speed of an admin approving / reviewing such requests.
• Set appropriate permissions so that "creating content" requires a user to be logged in. This will imply that a new user starting to create content can only start after their account (registration request) has been approved.

Pretty sure this plan-b will help a lot ... Up to you to decide if it fits with "the entire point of your site".

Answer 3

I would recommend you changing the default admin pathes. Most of the spam bots are only trying /user/register etc. to create accounts. There is a module that helps you, doing it: Rename Admin Paths

This should dramatically reduce spam accounts.

Together with Honeypot and Are You A Human PlayThru it is almost possible to get rid of spam completely.

Answer 4

I recommend you try something different from the usual enter text Captchas.

I personally use Are You A Human module. This is a video tutorial on how to set it up: Drupal 7 Are You a Human PlayThru Module - Daily Dose of Drupal episode 78.

If you want another option, I suggest you try Draggable Captcha here is an instruction video on how to set it up Drupal 7 Draggable Captcha - a more friendly way to prevent Spam

A new one that came to my attention is reCAPTCHA. Uses the Google reCAPTCHA web service to improve the CAPTCHA system and protect email addresses.