mbauman reports a surge of spam accounts on Discourse, characterized as recently created but never “Seen” or “Activated.” They seek methods to identify and purge these accounts, questioning if the state indicates API abuse. awesomerobot explains that unactivated accounts remain unusable until email verification and clarifies that bots can bypass rate limits. They guide users to the admin/users/list/new page, which offers a “not activated” filter and bulk selection tools for deletion. Discourse also automatically purges unactivated accounts after a grace period defined by purge_unactivated_users_grace_period_days (default 14 days). Admins can use IP lookup to find and suspend related accounts.
Other community members, including putty and watchmanmonitor, report similar waves of spam, often originating from specific IPs like 89.124.71.104. watchmanmonitor discovers the “select all” function for mass deletion, resolving earlier UI confusion. A distinct spam pattern emerges where bots use distinct IPv6 addresses to rapidly gain Trust Level 1 (TL1) by programmatically marking posts as read via the API, then send spam private messages. mbauman describes receiving sales pitch PMs from accounts that hit TL1 thresholds. awesomerobot notes that default settings requiring topic entry for TL1 should theoretically prevent this, but bots may be exploiting API loopholes or specific configurations.
Mitigation strategies discussed include implementing reCAPTCHA v2 (putty), enabling manual account approval, and adjusting PM limits. Danika_Dakika recommends suspending identifiable accounts quickly and blocking suspicious email domains like fldubai.com. mbauman suggests a feature to block email domains directly upon user deletion, though acknowledges the complexity for communities with self-hosted email users. Finally, dax confirms that the offending IP 89.124.71.104 has been blocked across the hosting infrastructure to protect hosted customers.
I’m tracking down a huge influx of spam accounts on our discourse. There are a large number (hundreds!) of recently-created accounts that have never been “Seen” and are not yet “Activated” — how does this happen? Are they using some API to create the account? Or creating the account and then never logging in? This seems to be a very strong signal that these accounts are spam, but I don’t know what it actually means or if I can filter on it to mass-delete them.
Is there a UI to find and purge these un-seen and/or un-activated accounts? Perhaps it’s something that could/should happen automatically after some lengthy delay?
Looks like there is a way, believe that is automatically done after a certain number of days for un-activated accounts which you can adjust to less or more days:
If it’s a recent big wave, then I’d guess a bot of some kind… much of the internet is now under regular bot hammering… these accounts will remain useless until activated, so I’m not sure why someone would create and then abandon them though.
Someone created an account, never verified the email, and therefore can’t log in. Without activating an account, it will never have a seen record.
Discourse is one big API, so someone can directly access the same endpoints the interface does to create an account. It’s certainly possible to automate, though someone doing so would have to work around rate limits to create many accounts quickly.
From admin/users/list/new there’s a “not activated” filter
From here you can click the icon over the avatar in the table header to enter bulk select mode. You can delete accounts this way if needed.
Discourse will automatically delete these after 14 days by default as long as they have no posts, the relevant site setting is purge_unactivated_users_grace_period_days.
If you select one of the users and go to their admin page, you can also use the “IP lookup” button to see accounts associated with the same IP. If multiple accounts are associated, you’ll get the option to delete them:
You shouldn’t need to do anything manually and can rely on the auto-purge… but maybe worth keeping an eye on if there are many accounts or if some are being activated to create spam.
Are there any patterns? same location? same IP? same email domain? You can consider adding more protections if there’s a tell of some kind.
Thanks Kris! This was unfortunately very helpful for me, too. We also just had a surge of new users that were clearly spam. Since 10/16, we have had 268 users all sign up from the same IP with usernames that were b & a bunch of random numbers (b123456789).
We had the same experience.. 266 accounts recently from 89.124.71.104
When I went to block one, the gui allowed me to manually select 10 more users to suspend, but not all. It’d be nice to allow an “all” button, vs having to select 10, and repeat 25 more times.
Unless there’s already a better way to mass suspend?
Precisely what prompted this question, yes! At least 193 here. We also had another swarm of a few dozen other bot accounts that gained TL1 and then spammed 20 private messages each — it was in searching for more of those that I noticed the b123456789 accounts.
Update: even after blocking that IP, I see several new users that have registered with the same name pattern but from a different IP. Time to look into a captcha solution
I recommend you keep an eye on those ones. We’ve been hit by several waves of that in the past few days. Same pattern of names, from a handful of IP addresses.
They zoom up to TL1 [“reading” 209 posts in 11m …] so they can spam DMs to random users.
Saw your thread on “[topic title]” — [sales pitch and link]
We’ve tightened the PM limits and tried to target this a bit more. They all seem to be using many distinct throwaway email domains; I’m also considering moving to a much more constrained email host allowlist (inverting from the default block-list).
It’s possible to populate “posts read” like this without entering topics (using the API), but if tl1_requires_topics_entered is set to the default 5 it shouldn’t be possible for these accounts to reach TL1
