In the past 24 hours I've had 30 spam accounts get through the reCaptcha on the registration page. I'm also using Bad Behavior module on this site, and it rarely gets spam, only two or three attacks in the past 9 months - and that's with traffic of around 70-130k page views per month.

What do you think this is? Can bots get through reCaptcha? Some of these accounts were created through mobile.domain.com.

Comments

luthien’s picture

Hi, I'm getting lots of spam via the contact form as well. It is like recaptcha stopped working. Any other ideas where is the problem?

modctek’s picture

I'm guessing someone's managed to defeat recaptcha and the scripts are now spreading through the spam world. We've gotten several hundred this morning.

luthien’s picture

I'm reading the Google forum, and it looks like it is a problem with human spammers. I copied below the comments from one of the Google webmasters:

"It turns out there are a lot of Banladeshis who think sitting at a terminal solving captchas for a few pennies a day is a good job. Some of the boiler room outfits that employ them have even had the chutzpah to advertise on this list. By definition, no CAPTCHA can block human spammers. You have to put in other filters to block them."

https://groups.google.com/forum/#!topic/recaptcha/FNTzlNpRE1w

"You're getting spam from human spammers. By definition, there's nothing reCAPTCHA, or any CAPTCHA, can do about that. You have to build in
other filters to keep them out."

The next question for us is: how to protect the forms if recaptcha is not enough? what other working solutions works for other Drupal users? please advice.

thermador’s picture

Yeah same issue here. Thankfully the Mollom module stops the spam from actually making it to the site, but I've got thousands of spammer accounts being created and filling up my database.

I have been going through and manually deleting any account where they don't actually access the site after creating an account (building custom views to filter users, and then deleting them with the views bulk operations module) helps, but it is really inefficient.

I am thinking about abandoning ReCaptcha for something else, like the Riddler captcha, where you create your own questions with acceptable answers. Or something.

I wish there was a way to add multiple captchas to ONE form - like, to register an account, you have to answer a ReCaptcha, a Riddle captcha, and a picture captcha.

luthien’s picture

I replaced recaptcha with mollom too, lets hope spam will be reduced with mollom.

Liam Morland’s picture

Project: reCAPTCHA » CAPTCHA
Version: 6.x-1.4 » 7.x-1.x-dev
Component: reCAPTCHA Captcha » Code
Category: support » feature

I wish there was a way to add multiple captchas to ONE form - like, to register an account, you have to answer a ReCaptcha, a Riddle captcha, and a picture captcha.
That would be a feature request for the CAPTCHA module.

thermador’s picture

Way to pass the buck Liam, lol... ;-)

Update on this:

I have been able to almost eliminate spam AND spam account creation with the Mollom module - and adding protection on all the forms, including the user account form - and the Spambot module, which checks for spammer IP addresses and email addresses at account creation.

The Spambot module also allows you to scan your existing accounts with Cronjobs for spammer email addresses and log/block/delete them!

This combo of ReCaptcha/Mollom/Spambot has worked really well on two fairly high-traffic D6 and D7 sites I manage.

Liam Morland’s picture

Title: Spam accounts getting through reCaptchs? » Allow multiple CAPTCHAs on one form
soxofaan’s picture

Status: Active » Closed (won't fix)

I think the route of imposing multiple CAPTCHAs on each form is the wrong route:
you're mainly pissing off your normal/legitimate users and you're only making it marginally harder for human spammers.

As already mentioned, adding other spam filtering systems, like mollom does, is a better approach IMHO.