Massive SPAM

[wim]

A few weeks ago I got a message form my host that someone tried to hack the hostserver via my website. The problem was an old version of the JCE editor.
With some help from the hosts’ helpdesk the JCE editor was updated to the newest version 2.3.1 and also the Joomla version was udated to 1.5.26.
Later I also update Phoca Gallery and Phoca Guestbook ( 1.5.3. ) to the newest version.
Ever since I have increasing problems with SPAM on my Guestbook. At the beginning, after the update it was minor but since a few days I receive over 25 SPAM messages a day.
I experimented with the parameter settings in the control panel of Guestbook. But is seems not working. For example, when I fill in an IP address in the “IP ban” of the security settings then I still receive SPAM massages from that same IP address.
Of course I enabled the Captcha “random ( standard, Math, TTF ). In the frontend I looks like it works but I see no result with regard to less SPAM messages.
Is there anyone who can help me with this because it’s quite annoying.
Maybe there is something wrong with my settings in Guestbook but I don’t know what

Regards

Wim

[Jan]

Hi, there are different places in Joomla! 1.5 where to set the Options, see:
https://www.phoca.cz/documents/16-joomla ... -in-joomla
Check if they are correct and if you are using right syntax (e.g. , instead or ; or ; instead of , in parameter IP ban, etc.)

See:
https://www.phoca.cz/documents/3-phoca-g ... -from-spam

Jan

[wim]

Hi Jan,

The parameter IP ban is still not working. The syntax ( ; ) is correct.
I installed the recaptcha yesterday but that has no effect. I received again 11 Spam messages in the last 16 hours.
The first URL you send yesterday, relates only to Phoca Galery. I have no problem with Galery.
The second URL I knew already and I tried all the suggestions last days to solve the problems. But nothing seems to help.
Do you have any more suggestions?

Another question.
Suppose the IP ban works. Is there also a possiblility to ban a range op IP addresses because I see that a lot of SPAM comes from simular IP addresses in which only the last three numbers are different.

Thnx

Wim

[Jan]

Hi, sorry for the first link, it should be:
https://www.phoca.cz/documents/16-joomla ... -in-joomla

IP Ban, if you are using Phoca Guestbook 1.5.3, then there is no semicolon as separator:
Add the IP(s) you want to block, to the IP(s) Ban list. Separate each IP with a comma (,) ... check your translation, maybe it is not up-to-date

IP Range - yes, it is possible to ban IP range: 100.100.100.100 ==> 100.100.100

Jan

[wim]

Hi Jan,
In the IP ban I changed the separator from semicolon ( ; ) into a comma ( , ). You are right, the Dutch explanation by the IP ban is not up to date because it still talks about semicolon.
In all the other security settings ( Word Ban, Word filter, URL identification words ) is the instruction also to use a semicolon as separator. Should that also be a comma?
Thanks for your instructions about the IP range.
I implemented al your instructions so far. In the last 24 hours I had only one new spam message. Let’s wait and see how it will develop.
Thanks so far.

Wim

[wim]

Hi Jan,

Problem seems to be solved. No spam any more for the last 4 days. Hopefully it keeps this way.
Thanks for your help.

Wim

[Jan]

Ok, great to hear it.