Looks like the bot troubles might be 2 or 3 distinct groups.
Russians are definitely behind a campaign attempting to create forum accounts. Even though the problem has been ongoing and seems to have massively increased a few weeks ago, it really got my attention just a few days ago. Some of that traffic is actually from Russia, but most is through shady VPN services. I'm pretty sure it's all from Russia, because the accounts which don't get immediately rejected end up being accessed from a huge number of different IP netblocks, mostly VPNs but also some directly from Russia. While digging into the details, about half of the VPNs are from
PureVoltage Hosting who have
a pretty bad reputation. Some of the
PureVoltage netblocks which are now registered as USA are actually portions of larger Russian IP netblocks which I banned a couple years ago.
However, other bot activity seems to be just accessing the site without attempting to create accounts. Google, Bing/Microsoft, Facebook and plenty of others do this without causing problems. But someone accessing mostly from Vietnam, China plus a massive global botnet occasionally hits the site at over 100 requests per second, which seems to be the limit where we start to run out of resources. Their software is probably designed around different forums. It's easy to spot in the server log because they add a big query string to every request, which XenForo does sometimes use but it isn't part of normal traffic. This morning has about 650,000 accessing in the server log from midnight to 5am, almost all apparently from this botnet judging by the look of those URLs with not-normally-used query strings.
A third group that I believe may be low wage human workers rather than bots regularly hits the site from Bangladesh, Pakistan and India. Most of the spam we actually see comes from them. Reporting those spams really does work. Currently we have a policy where 3 reports sends a message to the moderation queue, effectively removing it from public view. So when you see spam here, please report it. No need to type any explanation in the report other than "spam". Quick reports do get them off the public site.
