Maybe spam attacks are so pervasive that what’s happening to us is just par for the course. I believe we use SSO, but it’s limited just to our site. We don’t use any external authentications. The pattern is very clear they always fill our “Gender” field with a random string of uppper and lower case letters. The username is almost always a “real” sounding first and last name followed by a string of numbers The email used is always some custom domain, usually very unusual looking. Never a popular service We haven’t adjusted anything with our spam filters. We might get three or four of these per day. Maybe 10 per week or more. So far I have just been deleting them so they haven’t had time to post. Any ideas?

[image] one1: The username is almost always a “real” sounding first and last name followed by a string of numbers I’ll share this from a staff member giving advice on how to detect spam accounts ‘Classic “FirstLast1234” email address format’ just typical spam account tactics [image] one1: always fill our “Gender” field with a random string of uppper and lower case letters maybe that one confuses the AI?

[image] Andrew_Rowe: maybe that one confuses the AI? Maybe. In any case I’m glad it does. It’s hard to believe that an AI based bot wouldn’t know the next logical answer to a question about gender, though.

Yes, I had this too, and it stopped after I switched to manually approving posts for TL0 users. I have a custom field that lets registering users select their operating system(s) (my community is for an app), and these bot accounts had random data in that field. I used a custom Data Explorer query to list all users with an invalid operating system value, that is, a value not included in the predefined list of options for the custom user field. SELECT u.id, u.username, ucf.value AS user_field_1 FROM users AS u LEFT JOIN user_custom_fields AS ucf ON u.id = ucf.user_id AND ucf.name = 'user_field_1' WHERE ucf.value IS NOT NULL AND ucf.value NOT IN ( SELECT ufo.value FROM user_field_options AS ufo WHERE ufo.user_field_id = 1 )

[image] fhe: and it stopped after I switched to manually approving posts for TL0 users. Did the new signups stop? Because that’s my “problem”. We actually already manually approve TL0 posts.

Yes, it stopped, but reading about your experiences now, that might have just been a coincidence. I’ve also blocked every email and IP of those accounts.

[image] fhe: I’ve also blocked every email and IP of those accounts. Yes, I’ve also been blocking the IP and email as well. Only once were two accounts using the same IP, but honestly I stopped checking. I’m slightly worried that I’m blocking so many IPs that it might start preventing real users. Maybe I’m not grasping how many possible IPs there are and the likelihood of a legit user getting blocked. Should I always be checking to see if it is a shared IP before I block it?

Yeah a custom field on signup can often catch this sort of spam, that dataexplorer query is a good way to try and catch that now… but I think we should provide an automation of some kind that makes this easier. [image] one1: I’m slightly worried that I’m blocking so many IPs that it might start preventing real users. We’ve been doing it on Meta for years and new account signup has been fairly steady throughout

[image] one1: I’m slightly worried that I’m blocking so many IPs that it might start preventing real users. I also provide an email address on my website for users of my app to contact me directly, so whenever a real user cannot register, I’d probably hear about it (but haven’t yet). [image] one1: Should I always be checking to see if it is a shared IP before I block it? Not sure if you should, but I don’t do it :see_no_evil_monkey:

[image] awesomerobot: [image] one1: I’m slightly worried that I’m blocking so many IPs that it might start preventing real users. We’ve been doing it on Meta for years… Oh no! I believe it’s a legitimate concern - many parts of the world don’t have loads of IP addresses, and it’s much more common to see them pooled than it used to be. [image] awesomerobot: …and new account signup has been fairly steady throughout Hmm, I don’t think that is any assurance of not disenfranchising lots of people. I think the idea of blocking the IP address of a spammer is a tactic which comes from the USA and the times of individual bad actors and home access from cable-provided internet. I believe it’s quite inappropriate now. It can be helpful to check an IP address against a well-maintained stoplist, or to check the address’ ASN against a stoplist of unlikely sources (cloud providers, for example). It’s still not great to block on that basis, if you want to allow people to sign up using VPNs.

Sure, it can be trouble for VPNs, but VPNs are also an outsized source of abuse… so there’s a burden to not taking action on them at all. I guess ideally we’d have some sort of IP reputation system so it’s not all or nothing.

Is anyone experiencing an odd spam user attack? Any way to block?

Product Support

haydenjames (Hayden James) June 5, 2026, 12:59am 12

Can solve with Cloudflare. Use log explorer, then block and challenge accordingly using WAF settings and custom rules:

Topic		Replies	Views
How to prevent registration spam Product Support	27	4632	March 17, 2025
Strategies for filtering spam / AI user accounts? Community Building spam	5	543	April 9, 2025
Blocking recent wave of spam Product Support	20	1127	July 29, 2025
Lots of Spam New User Registrations? Product Support	42	6347	April 7, 2020
Just had about 38 bot accounts and posts sign up and spam in the space of 30 mins Community Building spam	12	961	October 12, 2025

Is anyone experiencing an odd spam user attack? Any way to block?

Related topics