In a discussion about handling recurrent email-in spam, nathank reports persistent phishing emails impersonating ‘CommSec’ that bypass username blocking via staged users. nat confirms this may be a bug since reserved usernames should block such signups. pfaffman and NateDhaliwal recommend enabling AI spam detection — noting it’s low-effort and effective, with Nate successfully using OpenRouter’s free Gemini model. Moin suggests alternatives like watched words (for similar text) or the Approve unless staged setting, but concludes AI spam detection is most effective with minimal user disruption. nathank acknowledges the site’s low budget but considers AI as a justified solution given the severity.
On one of my sites, we’ve got persistent spam/phishing coming in from a single source which I’m struggling to prevent. It gets in via an email-in to a group inbox.
It uses a different email and IP address each time, but the content is almost identical each time. It claims to be from CommSec (a well known Australian company), and phishes for personal details. Each time the staged user is called ‘Commsec’.
No amount of blocking is working. I tried making ‘Commsec’ a not-allowed username, but Discourse still lets that through.
Any suggestions? Or do I need to rely on AI for this one?
Email-in topics/posts go through a very similar path as regular post creation, so AI spam would most likely cover you.
Just confirming, did you go through the “reserved usernames” site setting?
The setting description shows “Usernames for which signup is not allowed. Wildcard symbol * can be used to match any character zero or more times.”, but without getting too pedantic with the definition of “signup”, this feels like a bug.