# Lots of Spam New User Registrations?
**URL:** https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925
**Category:** Support
**Created:** [2월 2, 2016, 9:22오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925 "2016-02-02T21:22:35Z")
**Posts on this page:** 20
**Page:** 2
### Author:  [@BCHK](https://meta.discourse.org/u/BCHK)
#### Post date: [2월 3, 2016, 7:51오전 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/21 "2016-02-03T07:51:28Z")
> [@codinghorror](#):
>
> Lots of sites have the “spam users sign up but never post anything, ever” issue.
Yes - it just screws up our understanding of how many users we have, what percent are active, etc…
[https://www.evernote.com/l/AGpxoz0XNShIjphfH7q72aRIUhI8dFDG128B/image.png](https://www.evernote.com/l/AGpxoz0XNShIjphfH7q72aRIUhI8dFDG128B/image.png)
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2월 3, 2016, 8:08오전 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/22 "2016-02-03T08:08:13Z")
I think a reasonable setting for your site (that we should add) is
- Don’t allow users to enter any profile info until they have at least 1 public post
This would force spammers to out themselves.
@codinghorror I actually think that is a sane default, it erases the issue of ghost accounts messing stuff up, also … why muck with your profile prior to posting something on the site seems pointless.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2월 3, 2016, 9:53오전 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/23 "2016-02-03T09:53:35Z")
No, you _want_ them to fill out their profile so you can definitively know they are spammers vs. new sign ups that just never come back for “unknown reasons”, this will haunt the minds of every metric obsessed manager and they will never let you delete these “users”.
Strongly opposed, also, this was covered at extreme length in existing topics..
I support Akismet profile checks and auto delete of users who never come back and never read anything.
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [2월 3, 2016, 12:49오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/24 "2016-02-03T12:49:37Z")
> [@codinghorror](#):
>
> I support Akismet profile checks and auto delete of users who never come back and never read anything.
I also would love to see this implemented at some point. I know we have a few staff members who watch the Suspect list and remove profile spam now, this would alleviate some of that work for them.
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [2월 3, 2016, 3:59오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/25 "2016-02-03T15:59:56Z")
Some stats from Sitepoint.
In the past 7 days we’ve had 32 users with spam profiles. There were an additional 8 members who shared an IP address that were also dealt with, a few of those had spammy profiles too.
So you can say between 32 and 40 of our user registrations in the last 7 days were to create spammy profiles.
(or at least these are the ones we caught through manual processes)
---
### Author:  [@TechnoBear](https://meta.discourse.org/u/TechnoBear)
#### Post date: [2월 3, 2016, 4:32오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/26 "2016-02-03T16:32:57Z")
> [@sam](#):
>
> I think a reasonable setting for your site (that we should add) is
>
> Don’t allow users to enter any profile info until they have at least 1 public post
>
> … why muck with your profile prior to posting something on the site seems pointless.
Agreed.
I’ve seen quite a number of users return after a week, a month, six weeks, whatever and fill out their profile (usually Spammy) and still they haven’t read a post, far less made one. We even have members imported from vBulletin, with 0 posts there, who have popped up on Discourse at some stage, filled out their profile, and not read a single post.
_Really?_ Do they not have even the slightest curiosity about how the new forum looks compared to the old? Apparently, they have no interest in the forum at all, beyond using it to promote their fiverr account.
I actually feel these accounts are worse than those who sign up, complete their profiles - and never return. Some of those, at least, may have had good intentions, but returning simply to Spam your profile whilst ignoring the actual forum is just cynical, IMHO.
---
### Author:  [@BCHK](https://meta.discourse.org/u/BCHK)
#### Post date: [2월 3, 2016, 5:40오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/27 "2016-02-03T17:40:56Z")
> [@codinghorror](#):
>
> I support Akismet profile checks and auto delete of users who never come back and never read anything
This sounds reasonable.
Also - an FYI to the Discourse team - the “suspect users” list seems to be getting only about 30% to 50% of the spam user accounts that I’m getting every day. Whatever you’re doing right now is a start, but needs more work.
Thanks for all your efforts.
---
### Author:  [@BCHK](https://meta.discourse.org/u/BCHK)
#### Post date: [2월 3, 2016, 5:48오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/28 "2016-02-03T17:48:47Z")
It seems like the dimensions of the avatar image might also be a clue that an account is spam. In the 30 per day that I’m getting right now - all the avatar imgs seem to be the same shape/size:
[https://www.evernote.com/l/AGoxBlMG\_jFDuIxXxLGjq-wBXy07DJTxUtUB/image.png](https://www.evernote.com/l/AGoxBlMG_jFDuIxXxLGjq-wBXy07DJTxUtUB/image.png)
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [2월 3, 2016, 10:55오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/29 "2016-02-03T22:55:46Z")
> [@BCHK](#):
>
> It seems like the dimensions of the avatar image might also be a clue that an account is spam. In the 30 per day that I’m getting right now - all the avatar imgs seem to be the same shape/size:
If you go to the Autobiographer Badge page do the avatars stand out?
(We don’t have that Badge enabled so I can’t see on our site)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2월 3, 2016, 11:06오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/30 "2016-02-03T23:06:42Z")
Reminder, as you delete these users as spammers, the IP block ban widens. So the more you delete, the more you are blacklisting IPs and IP ranges.
Unless the attackers have a crazily large number of IPs at their disposal, this will slowly start to prevent them from signing up as the blacklists are merged and expanded.
This is all automatic based on deletion.
---
### Author:  [@TechnoBear](https://meta.discourse.org/u/TechnoBear)
#### Post date: [2월 4, 2016, 2:27오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/31 "2016-02-04T14:27:37Z")
We had so many Spam/fake sign-ups from the same provider that we eventually took the step of manually blocking _all_ their IP addresses that we could find. This slowed things down considerably, but occasionally one pops up that wasn’t on our list, and the same profile patterns now turn up on two other providers, although not many and not often.
---
### Author:  [@BCHK](https://meta.discourse.org/u/BCHK)
#### Post date: [2월 22, 2016, 5:07오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/32 "2016-02-22T17:07:11Z")
> [@codinghorror](#):
>
> Reminder, as you delete these users as spammers, the IP block ban widens. So the more you delete, the more you are blacklisting IPs and IP ranges.
This is helpful - but it would be even more helpful if it was easier to delete groups of new registrants at once - similar to how you can delete a large number of message in Gmail. Its very time consuming to sit and delete one registrant after another. Try doing it for 30 accounts - and it takes probably 15 minutes or more - every day. Its a pain and I’ve stopped doing it because its too time-consuming.
---
### Author:  [@RChesley](https://meta.discourse.org/u/RChesley)
#### Post date: [7월 28, 2016, 7:11오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/33 "2016-07-28T19:11:11Z")
This topic is not closed and I am not trying to hijack it. It seems very relevant as I look at what is in place to prevent spammers from automatic or manual registration abuses.
I do like the thought that forum users who have not read any content should be suspected – just wondering how “auto delete of users who never come back and never read anything” could affect users who register with the main intention to interact via mailing list mode with e-mail-in and reply by mail features. I suspect you are mostly thinking forum, yet the mailing list features are a huge asset and I would like to keep this user from getting auto deleted, and perhaps consider ways to assure they are able to gain reputation, reference other users with @ user etc. Mailing list users may only come to the forum to create the account and access public content without logging in (unless we force private content so they must login to read it, or educate them on the value of logging in for personal messages, profile updates, etc.
Rather than try to punish the spammer after they log in, why not just prevent them from registering in the first place?
I have experienced automated registration and profile spamming on previous forums. There are characteristics that do stand out and most of them include adding URLs in the profile – perhaps that should be or already is denied for a TL0 user.
I found some solutions that worked with add-ins/plug-ins/mods to eliminate most spammers. Before that I was banning users, blocking IPs, and spending too much time policing and cleaning up after the mess.
Why not tap into the already existing databases of known spammers? I am definitely not a plug-in developer. I hope perhaps this might inspire someone to consider the possibilities of using something like these solutions:
1. [www.projecthoneypot.org](http://www.projecthoneypot.org) – seems to work very well to stop folks from accessing the forums if they are a known spammer.
2. [StopForumSpam.com](http://StopForumSpam.com) – ties in with the admin list of members and adds options to select users and check them against the database by e-mail address, IP address and username with a status returned (green=good, yellow=caution, red=blocked). The check can be automated at registration or run manually. If there are matches on at least two pieces of information, the user is allowed to register but is held in limbo until someone reviews the registration issue and decides their fate. There are some false positives occasionally. If a spammer slips through the cracks on registration, the solution also includes the ability to report them and update the database so they are blocked from all other subscriber sites.
Discourse might benefit from either or both of these resources as part of pre-registration.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [7월 28, 2016, 7:26오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/34 "2016-07-28T19:26:03Z")
As previously discussed, I think new user profile text should be sent to Akismet for vetting. You can search for prior testing we did with the services you mention, they are real spotty.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [1월 31, 2019, 7:31오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/35 "2019-01-31T19:31:24Z")
> [@codinghorror](#):
>
> I think new user profile text should be sent to Akismet for vetting.
Is this happening now?
I just set up a personal forum and am allowing signup with approval required. Every day I get 5-10 spam accounts in the pending users list, which surprises me because I just set up this site and the user list is disabled. This did not seem to change when I enabled akismet.
Another question - if I delete pending users individually, I can choose to just delete or delete and add to IP blacklist. If I delete pending users in bulk via the pending user list, I don’t get that option. Does it blacklist them or not?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [1월 31, 2019, 9:39오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/36 "2019-01-31T21:39:57Z")
This does not currently happen, no.
---
### Author:  [@hunterk](https://meta.discourse.org/u/hunterk)
#### Post date: [3월 17, 2020, 1:09오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/37 "2020-03-17T13:09:21Z")
이 주제에 관한 몇몇 스레드를 읽어봤는데, 여기서 찾을 수 있는 가장 오래된(네크로) 스레드가 아닌 것 같아서 여기에 질문을 남깁니다.
수년 동안 작은 디스코urses 포럼을 운영해 왔는데, 스팸 프로필 등록 활동은 매우 적었습니다. 하지만 일주일쯤 전에 업데이트를 한 이후로 이 문제가 심각해졌고, 지금은 하루에 100건 이상의 등록이 들어오고 있습니다.
다른 스팸 방지 기능이 실제 스팸 _게시물_을 최소화하고는 있지만, 이러한 등록은 의심스러운 것으로 플래그가 지정되고 있습니다(당연히 그래야 하지만요). 그 결과 알림이 가득 차서 승인/조치해야 할 실제 게시물을 찾기 위해 모든 알림을 살펴보고, 확인하면서 금지 및 차단 조치를 취해야 하는 상황이 되었습니다.
따라서 제 질문은 다음과 같습니다: 최근 포럼 소프트웨어에서 기본 설정 변경 등 무언가가 바뀌어서 이전의 동작으로 되돌리기 위해 설정을 조정해야 하는 상황인가요? 이는 스팸 등록 자체를 처음부터 방지하거나, 아니면 비활성으로 인해 자동 삭제될 때까지 무시할 수 있도록 내 알림에 표시하지 않는 것을 의미합니다.
수정: "스태프가 모든 의심스러운 계정을 승인해야 함"이라는 체크박스가 있는 것 같아, 이를 해제하고 "비활성 사용자 정리(일 수 기준)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [3월 17, 2020, 8:57오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/38 "2020-03-17T20:57:51Z")
> [@hunterk](#):
>
> 요즘 하루에 100건 이상의 등록 건수가 발생하고 있습니다.
이것들이 실제로 이메일 확인을 완료한 유효한 계정들인가요? 하루 100건은 우리 고객 사이트에서 본 적 없는 매우 높은 수치입니다. 스크린샷과 추가적인 세부 정보를 제공해 주실 수 있나요? 이 문제를 끝까지 파고들고 싶습니다.
---
### Author:  [@hunterk](https://meta.discourse.org/u/hunterk)
#### Post date: [4월 7, 2020, 9:43오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/39 "2020-04-07T21:43:17Z")
안녕하세요, 늦게 답장 드려서 죄송합니다. 앞서 언급한 체크박스를 해제한 이후로는 문제가 발생하지 않았지만, 데이터를 수집하기 위해 방금 다시 체크해 보았습니다.
이것들이 실제로 확인된 계정인 것 같지만, 프로필에 스팸성 링크(대부분 호주 부동산 회사 관련…)를 넣기 위해 존재하기 때문에 신뢰 수준 0을 넘지 못하는 것 같습니다.
추가 정보를 얻게 되면 이 게시글에 업데이트하겠습니다. 감사합니다 🙂
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [4월 7, 2020, 9:44오후 UTC](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925/40 "2020-04-07T21:44:11Z")
> [@hunterk](#):
>
> 그들이 실제로 확인된 사용자라고 믿지만, 그들은 항상 신뢰 수준 0을 넘지 않습니다.
음, 그건 좋은 소식입니다!
스팸이 TL1에 도달해야 한다는 사실을 깨닫기 시작하면 걱정되지만, 그들에게도 상당한 추가적인 노력(읽기 시간, 게시된 주제 등)이 필요하므로 아마도 그렇게 하지 않을 것입니다.
[이전 페이지](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925.md?page=1)
[다음 페이지](https://meta.discourse.org/t/lots-of-spam-new-user-registrations/38925.md?page=3)