2011-07-15, 01:00 AM
I've been running my new board for about a month, and found that I have about 5% spam/bogus users already. They mostly come from 173.234.*.* IPs, but there's something more useful that they have in common:
Their Time Spent Online is 1 second.
It looks like these users just register with the forum, and don't come back. Perhaps they await a botnet-like activation when they'll all spam the forum at once? I don't know.
So how did I find them? I simply edited admin/modules/user/users.php and added an entry for timeonline. Please find attached a screenshot of the result, and a patch.
Once the user adds a view to sort by timeonline descending, they can easily see these suspicious accounts at the top. If the usernames are bogus (like in my example, 7 random characters), they're spambots for certain.
I think this is a simple improvement to Admin CP, too simple to be a plugin. I wish it makes it in 1.6.4 but if not, I posted a tutorial in the Tutorials forum (being moderated; not approved yet) on how to do the same with a SQL query.
Their Time Spent Online is 1 second.
It looks like these users just register with the forum, and don't come back. Perhaps they await a botnet-like activation when they'll all spam the forum at once? I don't know.
So how did I find them? I simply edited admin/modules/user/users.php and added an entry for timeonline. Please find attached a screenshot of the result, and a patch.
Once the user adds a view to sort by timeonline descending, they can easily see these suspicious accounts at the top. If the usernames are bogus (like in my example, 7 random characters), they're spambots for certain.
I think this is a simple improvement to Admin CP, too simple to be a plugin. I wish it makes it in 1.6.4 but if not, I posted a tutorial in the Tutorials forum (being moderated; not approved yet) on how to do the same with a SQL query.