Blocking spammer.<random>.domain registration attempts

Support
1

We’ve had a recent flood of registration attempts with email addresess looking like @services.cn that are filling up our MTA queue as non-deliverable.

My understanding is that there is no way to block domains using wildcards ( as per Use of an asterisk in blocked email domains prevents registration from any email address - #7 by selase )

Is there any other way to avoid this kind of attack ?

2

Discourse does not support wildcards in the blocked email domains list, so blocking entire domain patterns like @services.cn is not possible directly. However, there are several measures you can take to reduce or prevent these spam registration attacks:

  1. Reduce “max new accounts per registration IP”
    Lower this setting to 1 or another low number to limit how many new accounts can be created from the same IP address. This helps prevent mass registrations from a single IP and is very effective during an attack.
  2. Enable hCaptcha on Registration
    Add a CAPTCHA challenge to your signup form by enabling the Discourse hCaptcha Plugin. This increases friction for bots and automated signups and is available on all hosted plans.
  3. Manually Block Known Bad Domains
    While wildcards are not supported, you can explicitly add problematic domains to your “blocked email domains” list.
  4. Require New User Approval
    Temporarily enable the setting to “must approve users.” This puts all new registrations in a moderation queue for manual approval.
2 Likes
3

Sandro, were you able to resolve your issue?

4

We ended up blocking those addresses at the postfix level

1 Like
5

That’s a smart move! What was the wildcard that worked?

I wonder why this did not work? Maybe there is a case to be made for supporting wildcards, though I can imagine that would be very easy to misconfigure and make your site impossible for anybody to use!

1 Like
6

I replied by mail but don’t see my reply here, no time to dig it up now and the web UI doesn’t let me just type preformatted text (I hate it!) so you’ll have to guess :slight_smile:

7

WDYM you can’t type preformatted text?

strk says the wildcard was /.*@service\..*\.cn/.

1 Like
8

Welcome to meta, @lnicola! :sunflower:

@strk maybe you are not familiar with how preformatted text works in Discourse. There are multiple ways to do it and it’s quite powerful once you learn how. See: Posting code or preformatted text

1 Like
9

@tobiaseigen there’s a little bug, though, if I copy that regex as text and paste it in Discourse, it gets mangled to /.@service...cn/ (the backslashes are lost).

1 Like
10

We are veering into off topic territory here! :rofl:

What you are seeing there is not a bug, but intended markdown behavior. Two asterisks surrounding text displays the text as italics. Because it includes an @ it is displayed as an invalid @username. Once you surround the regex in backticks it displays as preformatted text:

Italics with username: /.@service...cn/
Preformatted text: /.*@service\..*\.cn/

11

It doesn’t work for me:

  1. paste /.*@service\..*\.cn/into a plain-text editor, copy it back
  2. open a backtick on Discourse, paste, you get /.@service...cn/
  3. paste as plain text (Ctrl-Shift-V) in backticks, you still get /.@service...cn/
  4. if you copy as HTML (from my comment above), pasting works fine
12

Oh yes, I am able to replicate what you are describing, using the richtext editor. Try switching to the markdown editor first and it will work. Not sure if there is anything that can be done about this.

1 Like