The accounts are all from one specific email client that is usually legitimate, not a weird made-up one or a .ru type of thing. This is not a new issue, been around for years, but it's the first time we've been directly affected by it. We have all the aforementioned measures in place and they aren't enough - also, there was no reduction in spam regardless of however many discouragement, IP bans, email bans etc. The flow was steady and never duplicated in terms of email addresses or IP addresses.
Once it calms down we can look at relaxing things a touch. Until then, if anyone finds themselves in the moderation queue, please let us know.
Thats just it most of the spam we get comes from legitimate email clients as
@Angel said and there is no other pattern than that. We ban, blacklist and IP Ban every throwaway domain name we come across and those are thinned out over time before another load pop up. However every now and again we get an influx of bots all from those legitimate sources that just have to be manually removed and banned which they are as soon as we spot them or they are reported and there has been thousands over the years. Somewhere in the region of 3,530 banned spam accounts here (177 pages worth) and im not sure thats even all of it. Spam like this has been reoccurring on every forum we have had over the last 18 years in the same manner and difficult to find a complete solution.
I currently own 5 websites (I used to have 7 at once.), and in one of them, I faced the same thing you guys did. What I did to solve it was what I said, but when I bought a site with like a thousand awaiting approval accounts, just sitting there... So, this prompted a lightbulb moment for me. I understand why these people were getting spammed on a daily basis. It's because some bots are scanning for their old accounts to be used, some are looking at older accounts, whatever. I batch update'ed them. I pruned any account with zero posts. What you really should look at is the "awaiting account confirmation" section. Clean that up, and I think the spam problem goes away for good. You start at ground zero.
When you do this, make sure this section right here, is
ZERO. Not -1 or whatever...
I ticked off the selections so you can see what you really need to clean up. These are accounts sitting in the "invalid" account state. These are accounts that are dormant, waiting to be approved. You don't want to delete banned accounts for the obvious reason (ahem; for them to re-do the spam.)
If you want to prune valid accounts with zero posts, be my guest, but just understand that doing so, will decrease your member count. I would clean up valid accounts with zero posts, but that is dependent upon your goals.
The spam is there because xenForo is currently a magnet. It's not a bad thing, it's actually a good thing, but what I mean is... this spam problem is the same old, tried, true, age old issue: Spammers are looking for keywords such as "Powered by xenForo." Kinda like vBulletin. Moreover, they're looking for already-posted links, so they can re-do it as a new account. The other issue is that these spammers are spam farms, when a spam farm wants to attack a site, they will sell the account to another person. I'm not ****ing kidding. There was someone who e-mailed me after I banned their spam account, you wanna know what he said? You won't believe me, but he actually said "Give me my money back." I'm like, "What the ****? You paid money to register on my site!?" It was so dumb.
Long story short: Keep cleaning things up, it won't be long before they're ****ed off and try using throwaway email accounts. When they are using those, that means you ****ed them off already.
