Invision Community 5: A video walkthrough creating a custom theme and homepage By Matt Thursday at 04:02 PM
londonmitch Posted October 23 Posted October 23 We’ve had an issue lately where multiple user accounts have been hacked. Scammers are using the opportunity to post fake for sale ads. What’s the best way to combat this issue?
Gary Posted October 23 Posted October 23 Hi @londonmitch, This subject has come up a few times especially with the increase of people getting hold of email accounts all around the world. I am going to piggyback on Marc's post from June last year as a first step to see whether it improves things on your community. Ensure you are using hCaptcha, rather than any other CAPTCHA type. It is the most advanced and effective at the moment. AdminCP -> Members -> Content Moderation -> Spam Prevention -> CAPTCHA Ensure you have increased the sensitivity when you set up a hCaptcha account. Ensure you have set up a Question and Answer Challenge (or numerous ones). AdminCP -> Members -> Content Moderation -> Spam Prevention -> Question and Answer Challenge There is also an entire guide written about Spam Prevention here at Invision Community. Here are some other topics that discuss an increase in spam found on some communities. You can find more by searching 'spam'. Octavian Dima, Marc and abobader 3
londonmitch Posted October 23 Author Posted October 23 Thanks, I’ll take a look at the guides. We’ve dealt with spam for years but easily combat it with first x posts require mod approval. This is new as they’re using long time member accounts to post the threads and using pictures from previous ads in our buy/sell/trade
Gary Posted October 23 Posted October 23 I know it seems basic but they're the best options built into Invision Community to assist you in mitigating spam on your community right now. The biggest concern are breaches of data from companies that hackers seem to be targeting all the time. Once an email address is compromised, they use it for spam or whatever other motive they have. Nine times out of ten these are older or inactive email addresses (at least to the original creator, but a candy store for hackers).
Marc Posted October 24 Posted October 24 There isnt really much I can add to what Gary has already said, other than to say its likely that the users accounts have come up in a user/pass combination list somewhere, and they are using the same details for your site. However a couple of observations I can make about your site specifically that you should address right away You are not using the latest release, and there have been security releases since the version you are using. You are allowing username logon. Changing this to email only as advised in the ACP, will certainly reduce instances of what you are seeing londonmitch 1
londonmitch Posted October 24 Author Posted October 24 13 hours ago, Marc said: There isnt really much I can add to what Gary has already said, other than to say its likely that the users accounts have come up in a user/pass combination list somewhere, and they are using the same details for your site. However a couple of observations I can make about your site specifically that you should address right away You are not using the latest release, and there have been security releases since the version you are using. You are allowing username logon. Changing this to email only as advised in the ACP, will certainly reduce instances of what you are seeing Thanks. Will try both
Recommended Posts