Spam attack - or worse?

[draggar]

I have a WP based fan site that usually gets 2-3 people signing up a week (most are probabaly bots).

Today there has been pver 70 signups from random email addresses (most are clearly spam bots). Luckily all comments are moderated but there hasn't been a single attempt on it yet.

Is this just a spam attack or do you think there might be something more sinister at hand?

I'm having issues pulling up logs from my host (could be work's firewall) so I can't check those right now.

 

[ukbackorderukbackorder is verified member.]

Sounds to me like you've just made it onto a list somewhere. I have seen this happen but usually a good spam blocker will deal with it.

 

[Jilo]

I used to own a popular celebrity site, and used to receive a comment per day. One night, I received over 200 - all spam. So yes, you're site's probably made it onto a list somewhere, I don't think it's anything worse than that. Just add ReCaptcha to the signup page, and you should be ok.

 

[draggar]

Good suggestion Jilo, I just added it to the site, we'll see how it goes.

 

[whitebark]

There are also some older versions of WP with security holes centered around user permissions.

http://wordpress.org/extend/plugins/bad-behavior/ - one more decent layer of protection against spam bots.

 

[draggar]

Yeah, I think there is a hole, they're getting around the Captcha. I'm not sure what version I'm on now but I'm going to back up the DB and then update to the latest.

Traffic has gone from 150-200 a day to over 1000 so far today. I'm still getting signups but I hope it's just from before the update.

 

[draggar]

I had a few dozen more signups last night so the update and improved captcha didn't help.

 

[foundrstack]

Any comments yet? How are you protecting your comments?

 

[draggar]

Comments are 100% by admin (me) approval but there have been no attempts.

 

[draggar]

Over 100 more today, I had to turn off registration.

They're getting around recaptcha - any other suggestions?

 

[foundrstack]

Try the Register Plus plugin and turn on Email Validation & Captcha.

 

[draggar]

Thanks, I'll give that a try. I'm in the middle of deleting all the users but I feel bad because some are legitimate and made some helpful comments.

I just checked my logs - it seems like they are all going straight to the registration page.

 

[Gerry]

Just add ReCaptcha to the signup page, and you should be ok.

Precisely what I was going to recommend.

 

[foundrstack]

Came across a Wordpress plugin today called Sabre that seems to be promising in preventing registration spam.

 

[Jilo]

Thanks Tia, the most complete anti spam plugin I've seen in a while, I'll be downloading it for some of my sites.