There are work arounds for this, I’m sure you know of them, but it’s additional resource cost and effort for I agree with you that captchas would be helpful. I then discovered the AS Number (ASN) blocking feature that Cloudflare has and have set up additional Firewall rules to block out a significant amount of them, referencing the useragent block logs. I don’t believe many innocents were getting challenged by it and it completely stopped their spam registrations. I added a firewall rule to challenge users with that useragent and disabled “I’m under attack” mode on CF.

They were indeed using identical useragents. I put Cloudflare on “I’m under attack” mode temporarily (which stopped their registrations - they were making a new account every 1-2 minutes) and checked the Cloudflare firewall logs for some IPs they were using, seeing it was challenging/logging every visitor. Thanks for the tips, much appreciated - you sent me on a spam whacking journey. Raising the difficulty bar that high eliminates most of the problem, based on what we’ve observed with our customers and here on meta.Īnyway TL DR I am not necessarily opposed to a simple “disallow certain characters in emails” setting, I guess, but in my heart I don’t think anything except a CAPTCHA is going to help much in this case? We could do Legend. Note that most of your comments fall into the category described in my previous sentence – it’s very hard to script us because we are so complex, compared to a 1999 era HTML 1.0 website. Automated spammers (minus bamwar) haven’t really been a huge problem in Discourse because we are so hard to automate against being a full bore JavaScript application. I mean they fill out user profiles, upload profile images, and everything. Historically speaking, the trend has been toward 100% human spammers over time. I dunno this feels more like we need CAPTCHA user creation plugin to me? I don’t feel “let’s disallow dots and plusses” is treating the underlying disease, it’s only addressing the symptoms of the problem? They already have thousands of accounts on this single gmail address.

For example, using the username+ trick, someone created 748 accounts in the last 10hrs.

Caught gmail dot trick