The forum has been blasted by spam many times.

I am seeing cyclic patterns in the IP address.

It is tiring to ban/delete hundreds of spambots per day.


Suggestions welcome.

This thing run on a linux box, hosted linux virtual machine maybe?

If Linux
iptables, ipchains
fail2ban fail2ban and iptables < System | The Art of Web

iptables controls who may connect to your server and under what circumstances they may do so.

fail2ban is a script that runs in the background and watches connection logs for suspicious activity, and automatically generates new iptables rules for you.

__________________
Remember, Safety Third!
'99 E300 Turbodiesel, '82 300TD, 1996 12V Cummins Turbo, '94 Neoplan - Detroit 6V92TA

We asked Bill to investigate with V-Bulletin for a method to block IP addresses. I don't believe he ever got a satisfactory answer.

The software has existed for such a long period that I'd be rather surprised if there wasn't a method to do it.

Been looking around. One good idea that I see is to "nofollow" all external links by default. But, even then, many spammers aren't selective.
Have a look over here, if you haven't already:
Dealing with vBulletin Spam | Forum Doc

__________________
Remember, Safety Third!
'99 E300 Turbodiesel, '82 300TD, 1996 12V Cummins Turbo, '94 Neoplan - Detroit 6V92TA

How are spammers creating their accounts? Make account creation more difficult via CAPTCHA or require a brief message about yourself to the moderator. Also require strong passwords for existing accounts to avoid cracking.

With dynamic IP's and proxies you're kind of screwed i think. You can ban ranges of IPs but this can screw over everyone who uses the same ISP.

capcha, as spdrun suggested, would be the thing to do.

__________________
1985 CA 300D Turbo , 213K mi

Other way to do this is to introduce community moderation. If 10 people click "spam", post gets hidden. If a user gets dinged for spam > 5 times, then his account gets locked and is reported to the moderator. Not familiar enough with vBulletin innards to explain how to do this, sadly.

I run a Vbulletin forum, not the most recent version, and the software offers a few good methods to ban ip addresses and related. The syntax and locations within the Admin CP aren’t' exactly intuitive. Send a PM if you’re interested.

I can see that getting abused quite quickly on OD!

Don't agree with someone? Gang up and ban...

__________________
1992 W201 190E 1.8 171,000 km - Daily driver
1981 W123 300D ~ 100,000 miles / 160,000 km - project car stripped to the bone
1965 Land Rover Series 2a Station Wagon CIS recovery therapy!
1961 Volvo PV544 Bare metal rat rod-ish thing

I'm here to chat about cars and to help others - I'm not here "to always be right" like an internet warrior



Don't leave that there - I'll take it to bits!

Neither captcha, nor IP banning are a panacea. But both can be quite useful. Captcha is not a perfect solution though as some believe it to be; and it looks like you can have them solved for less than two cents each. I bet you could find a cheaper one if you looked. Try IPbanning the worst abusers; even though they can use proxies, it adds an extra layer of trouble to their task, meaning that the laziest ones will go find lower hanging fruit. Put up a good error message (better than the default) if you're worried about banning legitimate accounts, or legitimate new sign-ups.
It should be trivial to make a rule which exempts those two from being auto-banned. I think user moderation could work better than you might expect.

__________________
Remember, Safety Third!
'99 E300 Turbodiesel, '82 300TD, 1996 12V Cummins Turbo, '94 Neoplan - Detroit 6V92TA

I see some real potential for abuse....

__________________
On some nights I still believe that a car with the fuel gauge on empty can run about fifty more miles if you have the right music very loud on the radio. - HST

1983 300SD - 305000
1984 Toyota Landcruiser - 190000
1994 GMC Jimmy - 203000

https://media.giphy.com/media/X3nnss8PAj5aU/giphy.gif

Say that you make it apply only to people with less than 10 posts.

You've got to be joking - haven't you?

I think the current moderation system is a very necessary part of the forum - particularly on OD. There's enough of the he who shouts loudest / wanna be in my gang attitude there - I don't think it needs to be encouraged. The self righteous already know they are right; you don't need to hand them the keys to the city as well.

__________________
1992 W201 190E 1.8 171,000 km - Daily driver
1981 W123 300D ~ 100,000 miles / 160,000 km - project car stripped to the bone
1965 Land Rover Series 2a Station Wagon CIS recovery therapy!
1961 Volvo PV544 Bare metal rat rod-ish thing

I'm here to chat about cars and to help others - I'm not here "to always be right" like an internet warrior



Don't leave that there - I'll take it to bits!

You can't ban on IP and other triggers in v Bulletin?

If spam is coming from hacked machines on dynamic IP addys, banning by IP will only randomly rope innocent people in.