# Is anyone experiencing an odd spam user attack? Any way to block?
**URL:** https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427
**Category:** Support
**Created:** [3 ביוני, 2026, 1:59pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427 "2026-06-03T13:59:07Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@one1](https://meta.discourse.org/u/one1)
#### Post date: [3 ביוני, 2026, 1:59pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/1 "2026-06-03T13:59:07Z")
Maybe spam attacks are so pervasive that what’s happening to us is just par for the course.
I believe we use SSO, but it’s limited just to our site. We don’t use any external authentications.
The pattern is very clear
- they always fill our “Gender” field with a random string of uppper and lower case letters.
- The username is almost always a “real” sounding first and last name followed by a string of numbers
- The email used is always some custom domain, usually very unusual looking. Never a popular service
We haven’t adjusted anything with our spam filters. We might get three or four of these per day. Maybe 10 per week or more. So far I have just been deleting them so they haven’t had time to post.
Any ideas?
---
### Author:  [@Andrew\_Rowe](https://meta.discourse.org/u/Andrew_Rowe)
#### Post date: [3 ביוני, 2026, 2:09pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/2 "2026-06-03T14:09:03Z")
> [@one1](#):
>
> - The username is almost always a “real” sounding first and last name followed by a string of numbers
I’ll share this from a staff member giving advice on how to detect spam accounts
‘Classic “FirstLast1234” email address format’
just typical spam account tactics
> [@one1](#):
>
> - always fill our “Gender” field with a random string of uppper and lower case letters
maybe that one confuses the AI?
---
### Author:  [@one1](https://meta.discourse.org/u/one1)
#### Post date: [3 ביוני, 2026, 3:09pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/3 "2026-06-03T15:09:54Z")
> [@Andrew\_Rowe](#):
>
> maybe that one confuses the AI?
Maybe. In any case I’m glad it does. It’s hard to believe that an AI based bot wouldn’t know the next logical answer to a question about gender, though.
---
### Author:  [@fhe](https://meta.discourse.org/u/fhe)
#### Post date: [3 ביוני, 2026, 3:12pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/4 "2026-06-03T15:12:00Z")
Yes, I had this too, and it stopped after I switched to manually approving posts for TL0 users.
I have a custom field that lets registering users select their operating system(s) (my community is for an app), and these bot accounts had random data in that field.
I used a custom [Data Explorer](https://meta.discourse.org/t/32566?silent=true) query to list all users with an invalid operating system value, that is, a value not included in the predefined list of options for the custom user field.
```sql
SELECT
u.id,
u.username,
ucf.value AS user_field_1
FROM
users AS u
LEFT JOIN user_custom_fields AS ucf ON u.id = ucf.user_id
AND ucf.name = 'user_field_1'
WHERE
ucf.value IS NOT NULL
AND ucf.value NOT IN (
SELECT
ufo.value
FROM
user_field_options AS ufo
WHERE
ufo.user_field_id = 1
)
```
---
### Author:  [@one1](https://meta.discourse.org/u/one1)
#### Post date: [3 ביוני, 2026, 3:25pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/5 "2026-06-03T15:25:23Z")
> [@fhe](#):
>
> and it stopped after I switched to manually approving posts for TL0 users.
Did the new signups stop? Because that’s my “problem”. We actually already manually approve TL0 posts.
---
### Author:  [@fhe](https://meta.discourse.org/u/fhe)
#### Post date: [3 ביוני, 2026, 3:27pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/6 "2026-06-03T15:27:58Z")
Yes, it stopped, but reading about your experiences now, that might have just been a coincidence.
I’ve also blocked every email and IP of those accounts.
---
### Author:  [@one1](https://meta.discourse.org/u/one1)
#### Post date: [3 ביוני, 2026, 3:35pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/7 "2026-06-03T15:35:17Z")
> [@fhe](#):
>
> I’ve also blocked every email and IP of those accounts.
Yes, I’ve also been blocking the IP and email as well. Only once were two accounts using the same IP, but honestly I stopped checking.
I’m slightly worried that I’m blocking so many IPs that it might start preventing real users. Maybe I’m not grasping how many possible IPs there are and the likelihood of a legit user getting blocked.
Should I always be checking to see if it is a shared IP before I block it?
---
### Author:  [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [3 ביוני, 2026, 3:36pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/8 "2026-06-03T15:36:58Z")
Yeah a custom field on signup can often catch this sort of spam, that dataexplorer query is a good way to try and catch that now… but I think we should provide an automation of some kind that makes this easier.
> [@one1](#):
>
> I’m slightly worried that I’m blocking so many IPs that it might start preventing real users.
We’ve been doing it on Meta for years and new account signup has been fairly steady throughout
---
### Author:  [@fhe](https://meta.discourse.org/u/fhe)
#### Post date: [3 ביוני, 2026, 3:42pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/9 "2026-06-03T15:42:29Z")
> [@one1](#):
>
> I’m slightly worried that I’m blocking so many IPs that it might start preventing real users.
I also provide an email address on my website for users of my app to contact me directly, so whenever a real user cannot register, I’d probably hear about it (but haven’t yet).
> [@one1](#):
>
> Should I always be checking to see if it is a shared IP before I block it?
Not sure if you should, but I don’t do it 🙈
---
### Author:  [@Ed\_S](https://meta.discourse.org/u/Ed_S)
#### Post date: [4 ביוני, 2026, 4:49am UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/10 "2026-06-04T04:49:35Z")
> [@awesomerobot](#):
>
> > [@one1](#):
> >
> > I’m slightly worried that I’m blocking so many IPs that it might start preventing real users.
>
> We’ve been doing it on Meta for years…
Oh no! I believe it’s a legitimate concern - many parts of the world don’t have loads of IP addresses, and it’s much more common to see them pooled than it used to be.
> [@awesomerobot](#):
>
> …and new account signup has been fairly steady throughout
Hmm, I don’t think that is any assurance of not disenfranchising lots of people.
I think the idea of blocking the IP address of a spammer is a tactic which comes from the USA and the times of individual bad actors and home access from cable-provided internet. I believe it’s quite inappropriate now.
It can be helpful to check an IP address against a well-maintained stoplist, or to check the address’ ASN against a stoplist of unlikely sources (cloud providers, for example). It’s still not great to block on that basis, if you want to allow people to sign up using VPNs.
---
### Author:  [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [4 ביוני, 2026, 2:30pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/11 "2026-06-04T14:30:57Z")
Sure, it can be trouble for VPNs, but VPNs are also an outsized source of abuse… so there’s a burden to not taking action on them at all. I guess ideally we’d have some sort of IP reputation system so it’s not all or nothing.
---
### Author:  [@haydenjames](https://meta.discourse.org/u/haydenjames)
#### Post date: [5 ביוני, 2026, 12:59am UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/12 "2026-06-05T00:59:14Z")
Can solve with Cloudflare. Use log explorer, then block and challenge accordingly using WAF settings and custom rules:
> [@Using Discourse with Cloudflare: Best Practices](https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405/26):
>
> Hopefully it’s helpful, but I also wrote a general guide to the best settings here: A Cloudflare staff member also added some pointers and corrections in the comments section. I’m updating that guide and was trying to see if there was any new advice from Discourse and found this page. I will be adding these to my managed rules. Thank you! Here’s an overview of my custom rules. This has really help reduce spam and often times (not always) some of the lowest quality traffic comes in via VPN…
---
### Author:  [@Lee\_Ars](https://meta.discourse.org/u/Lee_Ars)
#### Post date: [5 ביוני, 2026, 12:27pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/13 "2026-06-05T12:27:32Z")
Discourse’s official [hCaptcha plugin](https://meta.discourse.org/t/discourse-hcaptcha/291383) can be a huge help here. It’s specifically intended to help mitigate bot signups.
(I would personally also love to see [Discourse support for Cloudflare Turnstile](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821), given that Turnstile’s free tier includes a frictionless non-interactive mode, whereas similar functionality with hCaptcha requires transitioning to their “pro” pricing tier at $99/month—which is absolutely pants-on-head ludicrous for self-hosters.)
---
### Author:  [@mcdanlj](https://meta.discourse.org/u/mcdanlj)
#### Post date: [7 ביוני, 2026, 12:41pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/14 "2026-06-07T12:41:50Z")
> [@fhe](#):
>
> I also provide an email address on my website for users of my app to contact me directly, so whenever a real user cannot register, I’d probably hear about it (but haven’t yet).
If I ran into that as a potential new user, I’d probably just give up instead.
I typically don’t even delete spam users. I suspend them forever. That way I can more easily harvest information from them to see patterns, which makes it easier for me to react quickly as tactics shift.
If I block an IP, they just get a new IP. If I don’t, some of them come back with the same IP and I can react quickly.
At the same time, I have plenty of new spammers whose registration and last used IP are different.
I get a lot of legit usage via VPNs, so it would actually cause random failures to just keep blocking random IPs that don’t actually map to spammers.
I think we should have an option to block email but **not** block IP when deleting a spam account. Blocking IP ends up being a hidden cost that you can’t directly measure. I think it’s very 🙈
---
### Author:  [@Ed\_S](https://meta.discourse.org/u/Ed_S)
#### Post date: [7 ביוני, 2026, 4:36pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/15 "2026-06-07T16:36:28Z")
> [@mcdanlj](#):
>
> I think we should have an option to block email but **not** block IP when deleting a spam account. Blocking IP ends up being a hidden cost that you can’t directly measure
Agreed!
> [@mcdanlj](#):
>
> I typically don’t even delete spam users. I suspend them forever.
Hmm, perhaps I should try doing that. Since a recent onslaught, I’m running in approve-new-users mode, which at my scale is quite manageable, and allows me (or other mods) to check at StopForumSpam.
---
### Author:  [@LordOfBikes](https://meta.discourse.org/u/LordOfBikes)
#### Post date: [5 בספטמבר, 2026, 8:48am UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/16 "2026-09-05T08:48:41Z")
I experience the same issue, self hosted instance, with rising numbers. It started with sporadic registrations 1 or 2 a week. This week were 10 registrations, 5 even yesterday.
The pattern is a random string in the Pronoun setting and the already mentioned patterns in first and last names.
I do `whois IP` queries and over 90% are from 2 cloud providers in the US. So I started blocking networks instead of IPs. The risk to block regular users is very low when blocking cloud provider networks. Most are /24, some were /23 or /22 networks.
Often I get a bounce message for the registration email, because the email address is not available. There is also a pattern in these addresses. The common part is a subdomain, their domain part starts with a single letter subdomain like `...@a.example.com`. I’ve seen letter `a`, `b`, `c`, `e` so far.
This could be a good attribute to block with `Blocked email domains` if it only allows regex patterns. A simple `@[a-z]\.*` could stop these attempts.
---
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [5 בספטמבר, 2026, 8:59am UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/17 "2026-09-05T08:59:31Z")
I’ve seen a flurry of these very recently. Initially I thought I’d finally cracked SEO 😅
But then I remembered OpenClaw 😅
Thank goodness for the new bulk User Admin features! 🙏
---
### Author:  [@one1](https://meta.discourse.org/u/one1)
#### Post date: [5 בספטמבר, 2026, 9:15am UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/18 "2026-09-05T09:15:12Z")
To follow up… A few weeks ago we started using the hCaptcha and that has completely eliminated the specific type of spam users I mentioned in the OP. Perhaps even spam in general is down, without any noticeable decrease in over all signups.
So, give the hCaptcha a try.
---
### Author:  [@Ed\_S](https://meta.discourse.org/u/Ed_S)
#### Post date: [5 בספטמבר, 2026, 9:41am UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/19 "2026-09-05T09:41:48Z")
A few days ago I added a mandatory text (a User Field called “Interests”) for applicants to help the human moderators approve their application (“a few words please to help the human reviewers in deciding to approve your account.”
It’s early to say but two suspicious accounts put random password like text in there which makes for easy rejection.
I’d like my mods to help with processing account reviews, and they do, but they can’t see emails or IP addresses which is a bit limiting. Stopforumspam has been quite a useful resource.
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [5 בספטמבר, 2026, 12:58pm UTC](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427/21 "2026-09-05T12:58:56Z")
> [@Ed\_S](#):
>
> I’d like my mods to help with processing account reviews, and they do, but they can’t see emails or IP addresses which is a bit limiting
How did you configure the `moderators_view_ips` and `moderators_view_emails` site settings?
[Next page](https://meta.discourse.org/t/is-anyone-experiencing-an-odd-spam-user-attack-any-way-to-block/404427.md?page=2)