I'll code this into the SBST

That's curious because there is no rate limiting happening yet!

... except the script is still receiving it now

I'll check the code to ensure it's not a bug in my script

/edit

Got a feeling it's a bug ...... I've got the following code checking the return value, and it's returning absolutely err - nothing;

$bSFSLimit = strpos($fspamcheck, 'rate limit exceeded');
if($bSFSLimit == True ){

... this is acting as though $bSFSLimit is true, even though it's set to false by default.

/edit 2

Nevermind, was checking the wrong bit of code ....... it was caused by the following;

if($bSFSLimit=true){

Last edited by MysteryFCM (2009-04-01 8:49 pm)

Either one exceedingly popular website, or a spambot that really really really wanted to get into it ..... or of course, just someone abusing your API ...

= vs ==, always a popular mistake

== vs === still a popular mistake

I wonder if they're calling the API for every page hit or something.

My site only hits the API on a new registration, and when they activate their account by hitting the link they receive in email.  That and when the admin (me) does a lookup.  And the lookups are cached locally too.  I think we'll stay well under the 5,000/day limit.

yeah, I would think that even 1000 querys a day would be more than enough.

I'm a member of a board that was getting clobbered by spam until about 2 months ago when they finally put in some anti-spam code .

and I estimated that even THEY were only getting 50-70 spammer sign-ups a day .

Last edited by ih8spam (2009-04-13 3:41 pm)

Depends.

If the forum has already implemented the system AntiSpam SFS, then even be very active, never will have ~100 checks by days (unless the site is being hit very hard).

But if a site begining to introduce the system AntiSpam, It isn't normal to check all (or many) users? (a site average may have more than one thousand users).

Yes.

You have:
16000 users total.
500 actives.
15500 inactives

It isn't normal you want to check these 15500 users? (or 10000, or 5000)

--

At first glance, 1000 querys per day seems enough or too much. But not always.

I just wanted to make known this point of view.

Last edited by M-DVD (2009-04-16 4:10 am)

You know, if 10% of 15500 inactive users, were to send their validation codes, within 1 hour...

and each of those robots were to spray 100 messages into your forums...

not only would the load, and fragmentation on your MySQL server be something just this side of epic due to 155,000 new messages in so short a time, but your mods will be picking up the pieces for weeks, if they don't revolt and walk.

My suggestion, if you haven't allready done it, is to ban (or otherwise incapacitate) all the inactives, but do not delete. Each one feels like a bullet that hasn't been put in a gun yet to me.

Zap.
(Glad his forum is barely alive and not popular)

When I first implemented my SFS hooks, I only checked new registrations (and still do).  Some fishy looking older registrations got checked as well, but I don't see the point in scanning all 15,000 users.

Either they're regular contributers (not spammers), or inactive (not spamming), or spammers (have posted spam/have suspicious registrations).  That third category are what gets further scrutiny.

I have my forum set to email me whenever a new user registers (if they pass the SFS checks).  My favorite users are the ones who post something right away, that makes my life easy.  Check their post(s), immediately I know if they're a spammer or not.  It's the ones who register and don't post that take more of my time, since then I start checking IPs, googling usernames, etc.

Sometimes if I see a registration from an unfamiliar country, or a possibly fishy registration that I can't tell for sure is a spammer, I'll flag them as "suspicious" so their posts are queued.  99% of these registrants never seem to return to post for some reason.  I bet a lot of spammer registrations are abandoned without ever being used.