Ive been following this thread and have been using a custom CRON script nightly to clean bots from my forums. I used Claude to generate an ALTCHA registration plugin here to hopefully help out some more, you can check it out here: https://github.com/sweetppro/nodebb-plugin-altcha :)

On this forum we started using the registration queue with spam-be-gone plugin. It shows if the email/ip/username used during registration is found in the stopforumspam database.

Noticed some more things being outdated or bricked.

Translations not shown correctly. Report button shows [[spam-be-gone:report-user]] and does apperently nothing because the click handler is only attached on tpl_url === 'admin/manage/registration'

Will create some more issues and PRs :)

Got another idea to improve the spam-be-gone plugin - Check ASN of IP to get another spam indicator

GitHub issue #118

Since we already have the IP, the plugin could also check the IP address if it matches against knows ASNs. So if an IP is from a datacentre it is more likely to be spam. I am aware that this might also mark users as suspected spam if they use VPN/Proxy.

I already did an implementation but would like to discuss this first before creating a PR.

Demo Idea:

This was implemented using https://www.maxmind.com/en/home and https://github.com/X4BNet/lists_vpn There is a promising repo for ASN lookup, tho pretty new: https://github.com/openasn/openasn but good to have on the map for the future.

Edit.

here : https://github.com/BrutalBirdie/nodebb-plugin-usercleaner

I will test it...

Hey @downpw

> @DownPW said: > > You have wrote this plugin ?

Yes and No :sweat_smile: I did not write it, I vibe coded it. I would describe it as: I have thought it up and let AI do its thing.

Yea I have published it after I used it a little. Thought to myself, ehh, may be useful to someone else as well so why not put it on GitHub and npm.

> @BrutalBirdie said: > > Vibe coded a usercleaner plugin with filters and stuff like that. > >

You have wrote this plugin ? I'm interrested :)

Hmmm I will have a look at that!

edit: Installed and set it up. Before we already had 20 new accounts from one of the spam mail hosts again. Will report back after some time to see how well it works :)

Check in. Again 10 accounts from gsaserbuilder.xyz got created. I have configured Spam Be Gone with Akismet, Project Honeypot, StopForumSpam and hCaptcha.

I have mixed feelings about enabling the registration queue, but will try it anyway. edit: just set Registration Approval Type to Admin Approval and the link pointing to $FQDN/admin/manage/registration leads to a Not Found. Maybe need to restart the forum? Will try.

Another thought. There is the config option Automatic Approval Time. So with spam-be-gone an option like Automatic Deny Time for suspected spam would also be great. If my default action is to deny all suspected spam a setting like that would be good since if I forget to check the registration queue for the time configured for the Automatic Approval Time all the suspected spam account are approved.

(:+1:/:-1:)?

Cross posting here, based on comment on this topic as there is similar thinking going on with maybe a novel idea jsut arrived at: https://community.nodebb.org/topic/19501/should-post-registration-queue-be-enabled-by-default/7

To avoid impacting sign-up friction and keep it as clean and smooth as possible, a bot-test pop-up as suggested here I believe would work a treat if it was post sign-up.

When sign-up completes successfully, throwing up an immediate checkpoint of some design for first time signups elegantly sidesteps making signup a PITA, creating a extra domain of protection where anything can be inserted to mitigate the dead army.

This solves the problem of loading up the signup stage with too much security in your face.

Caveat: Apologies if I'm way of the mark here and it already exists within the feature set of the post registration queue! :sweat:

Make the Data Centres go Brrrr...

How about a more advanced NodeBB community built hCaptcha, lets call its... NodeBBGame(r)Gate :wink.

The NodeBB peoples put their heads and hearts together and develop custom (nano) games that can be deployed as part of the sign up process. Totally and fully exclusive to the NodeBB platform.

Game hCaptcha has to present an higher computational overhead, so as to make them bot Data Centres go Brrrr... until they can Brrrr no more. :shrug:

The Human Approach

Why not ask the question, like - Are you registering using a VPN?

• you might then branch out what happens next if YES, as follows:

A) You filter the registration accordingly into vpn or non-vp groups, the later need admin approval etc.

B) You notify the registering user that there sign up will need manual approval

C) Your force or offer an option, to register with VPN off.

Speed Kills

I cna't remember are their speed of typing and other such checks handled by NodeBB?

My thinking with introducing a bit more human readable friction, is that bots would need to update to handle these fields if they ar not dynamically able to tackle, adding and removing periodically a question or two might stall waves.

In the age of the machine learning dead army maybe all bets are off, but instead of always defaulting to having tech solve our problems, why not use the solutions that already work and are tried and tested in a world we call home, the real world. :)

Even if Ai can be made parse and respond correctly, it may introduce a computational load that is unattractive.

Periodically adding or removing (here is where you could have a plugin that does this) or rotating all kinds of questions on the registration form might help:

• Are you submitting your registration in good faith?
• Did you answer all the questions truthfully?
• Did you miss any of the registration requirements?
• Where you able to read the registration pop-up ok?
• Are you happy with your username?
• etc. etc.

There is a rather vast amount of question you can have pre-loaded that might route based on admin or plugin settings, I suppose this is a king of variation on the honeypot fields that only the bots are suppose to see and trip over, but I've found or my impression at least is, they do not work very well. You still get spam in contact form pages. Maybe less, but some still get through.