Receiving thousands of dummy spam comments

[jascanio]

Hi,
My journal (OJS 2.4.8) has been fed with thousands of spam comments
I’ve disabled user registration feature, so I don’t ge more unwanted users. Furthermore, I have disabled comments feature.

1. Can I delete the comments in database or this will be affecting referential integrity?
2. How could I identify what users registered in the journal and posted the comments, so I can delete them as well?

Thanks in advance for your reply

Regards,
Juan

[astevens]

Hi @jascanio,

I think it is okay to delete comments in the database because comments are not integral to a submission record (the way a user ID is).

It should be easy for you to identify spam users by their email addresses, which will probably be a string of nonsensical numbers and letters with an uncommon domain. You can’t delete user records in OJS but you can merge spam user accounts into one account.

Best,
Amanda Stevens
Public Knowledge Project Team

[jascanio]

Hi @astevens,
Thanks for your reply.

Best regards
Juan

[piotreba]

But how to prevent it? I cannot disable user registration and adding comments functionality. I have recaptcha v2 on and require_validation set to on and still I receive hundreds of spam comments and user accounts! My OJS is 2.4.8.1.

[ctgraham]

We encountered this problem and applied a couple of additional mechanisms to address it:

No logging for user validation emails?

Hi, @drbauder. When I initially implemented ReCAPTCHA v2 for OJS 2.4.8, I didn’t cover the use case of notification list subscriptions and I inadvertently broke (the now unusable) ReCAPTCHA v1. This was fixed in the patches @asmecher references. Unfortunately, ReCAPTCHA alone will not stop all spam registrations. We’ve found several instances of botnets (or distributed mechanical turks?) targeting specific journals we host of publish. These registrations are completing the ReCAPTCHA challen…

A prior sprint proposed an enhancement which would require a Journal Manager to optionally approve each new user registration. Code for this was attached to an issue here, but not pulled into a release yet:

Add setting to require a journal manager to approve all new user accounts

[piotreba]

Hi @ctgraham,

thanks for these notes. Approval seems ok, but for hundreds of registration everyday this may be challenging (or maybe if accompanied by other solution).

And is there any way to block these bots in .htaccess simply? Are they easy to track down? Maybe a list of these bots published on the website would be some solution?

[ctgraham]

If you have a specific user agent or ip address range that you want to block, this can be performed with a .htaccess or similar webserver configuration.

From my experience earlier this year, we were being hit by some sort of distributed botnet or mechanical turk operation. We were unable to find an appropriate set of user agent strings and ip addresses which we could use as the basis for an .htaccess or similar configuration block.

[dung]

Hi ctgraham,

For my 2 cents, I have seen registered users required to click on link to validate, and link received via registered email, will that be an effective solution.

Thanks!

Dung.

[dung]

There is a response here for my question Spam account under Users and Roles - #7 by dung