• Welcome to the Chevereto user community!

    Here users from all over the world gather around to learn the latest about Chevereto and contribute with ideas to improve the software.

    Please keep in mind:

    • 😌 This community is user driven. Be polite with other users.
    • 👉 Is required to purchase a Chevereto license to participate in this community (doesn't apply to Pre-sales).
    • 💸 Purchase a Pro Subscription to get access to active software support and faster ticket response times.

Bots registering and webhosting blocked mail function

Status
Not open for further replies.
Bazim

Bazim

Chevereto Member
Hello, today i get a email from my webhosting which i using for my Chevereto site.

They allerted me because so many bots registering to my Chevereto site and sending an spam emails. So my webhostgin blocked mail() function for me.

They said i need fix that with captcha or something. And yes if i see to a registered users. So many bots are here.
 
Hey @Bazim

You should enable reCaptcha at /dashboard/settings/external-services and use an external email provider (like SendGrid) to avoid interruptions.

Hope it helps!
 
Rodolfo said:
I really doubt about that. There isn't a email or PM feature between users so most likely it was just the welcome or account confirmation email.
Click to expand...
Indeed. Had this issue on Coppermine Gallery before. And many a forum.
Bazim said:
They allerted me because so many bots registering to my Chevereto site and sending an spam emails. So my webhostgin blocked mail() function for me.
Click to expand...
Set up a mail service to send out your transactional emails for you. This will help keep you whitelisted. I use https://mailgun.com but there are plenty out there. You should almost never use the mail() function...
 
I switched to mailgun.org from mandrill.com (they removed free option).
But I still have registrations flood. And emails from users complaining about that.
Look:
Clipboardimage2016-10-0120232989828.png

Going to add some captchas. But I personally don't like them.
 
gobzer said:
Going to add some captchas. But I personally don't like them.
Click to expand...

No one likes captchas but you must use it if you run any web service. Can you confirm if the IP is the same?
 
To make things easier for legit users, use human friendly captcha. You can set it in your Google recaptcha settings.

32749df3f31c80e8317283db77d939a8.jpg
 
I will add a flood prevention on sign-up but you should still use reCaptcha.
 
After you fixed bots registrations it's time to find all these users.
You can also block IPs that make a lots of registrations.
With this query you can count users awaiting confirmation by their IP address:
Code: 
SELECT COUNT(`user_id`) AS cnt, `user_registration_ip` FROM prefix_users WHERE `user_status` = 'awaiting-confirmation' AND `user_registration_ip` not like '' GROUP BY `user_registration_ip` ORDER BY `cnt` DESC
I found that blocking 8 IPs blocks 90% of fake registrations.
 
System now detects registration flood so I think that it should fix this issue. Keep me updated if you still have issues.
 
Status
Not open for further replies.
Back
Top