当机器人攻击时！
除了验证码之外，还有哪些流行的垃圾邮件预防方法？
What are some popular spam prevention methods besides CAPTCHA?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
除了验证码之外，还有哪些流行的垃圾邮件预防方法？
What are some popular spam prevention methods besides CAPTCHA?
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
接受 或继续使用网站，即表示您同意使用 Cookies 和您的相关数据。
发布评论
评论（27）
我尝试过做“蜜罐”，你放置一个字段，然后用 CSS 隐藏它（对于禁用样式表的任何人将其标记为“留空”），但我发现很多机器人能够很快通过它。 还有一些技术，例如将字段设置为特定值并使用 JS 更改它们、计算加载时间和提交时间之间的时间、检查引用 URL 以及其他一百万种技术。 它们都有自己的陷阱，你所能希望的就是尽可能多地过滤它们，同时又不疏远你在这里的目的：用户。
不过，归根结底，如果您真的、真的不希望机器人通过您的表单发送内容，您将需要在其上添加验证码 - 这是我见过的最好的验证码大多数情况下，一切都是 reCAPTCHA - 但由于印度的验证码解决市场以及各地垃圾邮件发送者的独创性，这些垃圾邮件发送者并不总是成功。 我会小心使用一些“巧妙”但有点“外面”的东西，因为对于至少在某种程度上习惯了常用验证码的用户来说，它更像是“wtf”。
I have tried doing 'honeypots' where you put a field and then hide it with CSS (marking it as 'leave blank' for anyone with stylesheets disabled) but I have found that a lot of bots are able to get past it very quickly. There are also techniques like setting fields to a certain value and changing them with JS, calculating times between load time and submit time, checking the referer URL, and a million other things. They all have their pitfalls and pretty much all you can hope for is to filter as much as you can with them while not alienating who you're here for: the users.
At the end of the day, though, if you really, really, don't want bots to be sending things through your form you're going to want to put a CAPTCHA on it - best one I've seen that takes care of mostly everything is reCAPTCHA - but thanks to India's CAPTCHA solving market and the ingenuity of spammers everywhere that's not even successful all of the time. I would beware using something that is 'ingenious' but kind of 'out there' as it would be more of a 'wtf' for users that are at least somewhat used to your usual CAPTCHAs.
令人震惊，但这里几乎每个回复都包含某种形式的验证码。 OP想要一些不同的东西，我想也许他想要一些真正有效的东西，甚至可能解决真正的问题。
验证码不起作用，即使它起作用 - 这是错误的问题 - 人类仍然可以淹没你的系统，并且根据定义，验证码不会阻止这种情况（因为它的设计只是为了告诉你是否是一个人类与否 - 并不是说它做得那么好......）
那么，还有哪些其他解决方案？？ 嗯，这取决于...您的系统和您的需求。
例如，如果您想要做的只是限制用户可以填写“联系我”表单的次数，您可以简单地限制每个用户每小时/每天/任何时间可以提交的请求数量。 如果您的用户是匿名的，也许您需要根据 IP 地址进行限制，并偶尔将 IP 列入黑名单（尽管这也可以被规避，并导致其他问题）。
如果您指的是论坛或博客评论（例如此评论），那么我使用它的次数越多，我就越喜欢该解决方案。 经过身份验证的用户、授权（基于声誉，不太可能通过洪水累积）、限制（一天可以执行多少次）、偶尔的验证码以及最后的社区审核以清理少数通过的用户之间的混合 - 所有这些都结合在一起提供一个像样的解决方案。 （我想知道 Jeff 是否可以提供一些关于实际通过了多少垃圾邮件和其他恶意帖子的信息...？）
另一个需要考虑的控制措施（不知道他们是否有）是某种形式的 IDS/IPS - 如果您可以检测到并识别垃圾邮件，您可以阻止该模式。 此处的审核可以手动满足这一需求...
请注意，其中任何一项都不能防止垃圾邮件，但会逐渐降低概率，从而降低盈利能力。 这改变了经济方程式，并使验证码实际上提供了足够的价值——因为对于垃圾邮件发送者来说，不再值得费心破坏或绕过它（感谢其他控件）。
Shocking, but almost every response here included some form of CAPTCHA. The OP wanted something different, I guess maybe he wanted something that actually works, and maybe even solves the real problem.
CAPTCHA doesn't work, and even if it did - its the wrong problem - humans can still flood your system, and by definition CAPTCHA wont stop that (cuz its designed only to tell if you're a human or not - not that it does that well...)
So, what other solutions are there? Well, it depends... on your system and your needs.
For instance, if all you're trying to do is limit how many times a user can fill out a "Contact Me" form, you can simply throttle how many requests each user can submit per hour/day/whatever. If your users are anonymous, maybe you need to throttle according to IP addresses, and occasionally blacklist an IP (though this too can be circumvented, and causes other problems).
If you're referring to a forum or blog comments (such as this one), well the more I use it the more I like the solution. A mix between authenticated users, authorization (based on reputation, not likely to be accumulated through flooding), throttling (how many you can do a day), the occasional CAPTCHA, and finally community moderation to cleanup the few that get through - all combine to provide a decent solution. (I wonder if Jeff can provide some info on how much spam and other malposts actually get through...?)
Another control to consider (dont know if they have it here), is some form of IDS/IPS - if you can detect and recognize spam, you can block THAT pattern. Moderation fills that need manually, here...
Note that any one of these does not prevent the spam, but incrementally lowers the probability, and thus the profitability. This changes the economic equation, and leaves CAPTCHA to actually provide enough value to be worth it - since its no longer worth it for the spammers to bother breaking it or going around it (thanks to the other controls).
让用户能够计算：
3 和 8 的和是多少？
顺便说一句：刚刚浏览了微软研究院的一个有趣的方法：Asirra。
http://research.microsoft.com/asirra/
它向您显示了几张图片，您必须识别具有给定主题的图片。
Give the user the possibility to calculate:
What is the sum of 3 and 8?
By the way: Just surfed by an interesting approach of Microsoft Research: Asirra.
http://research.microsoft.com/asirra/
It shows you several pictures and you have to identify the pictures with a given motif.
从可用性的角度来看，尝试 Akismet
验证码或任何形式的仅限人类的问题都是可怕的。 有时它们是必要的，但我更喜欢使用 Akismet 等过滤器来消除垃圾邮件。
Akismet 最初是为了阻止 WordPress 博客上的垃圾评论而构建的，但该 API 可以适应其他用途。
更新：我们已经开始使用 ruby 库 Rakismet在我们的 Rails 应用程序上，Yarp.com。 到目前为止，它在阻止垃圾邮件机器人方面效果很好。
Try Akismet
Captchas or any form of human-only questions are horrible from a usability perspective. Sometimes they're necessary, but I prefer to kill spam using filters like Akismet.
Akismet was originally built to thwart spam comments on WordPress blogs, but the API is capabable of being adapted for other uses.
Update: We've started using the ruby library Rakismet on our Rails app, Yarp.com. So far, it's been working great to thwart the spam bots.
一种不会给用户带来任何负担的非常简单的方法就是在页面加载后禁用提交按钮一秒钟。 我在一个公共论坛上使用了它，那里有连续的垃圾邮件帖子，从那以后它就阻止了它们。
A very simple method which puts no load on the user is just to disable the submit button for a second after the page has been loaded. I used it on a public forum which had continuous spam posts, and it stopped them since.
Ned Batchelder 编写了一种技术，将哈希值与蜜罐结合起来，以实现一些极其有效的机器人预防。 没有验证码，只有代码。
它位于使用哈希值和蜜罐阻止垃圾邮件机器人：
Ned Batchelder wrote up a technique that combines hashes with honeypots for some wickedly effective bot-prevention. No captchas, just code.
It's up at Stopping spambots with hashes and honeypots:
http://chongqed.org/ 维护活动垃圾邮件源和垃圾邮件中宣传的 URL 的黑名单。 我发现在论坛中过滤后者的帖子非常有效。
http://chongqed.org/ maintains blacklists of active spam sources and the URLs being advertised in the spams. I have found filtering posts for the latter to be very effective in forums.
我观察到的最常见的问题是围绕用户输入来解决简单的难题，例如下面是一张猫的图片。 （显示狗围绕猫的缩略图）。 或者简单的数学问题。
虽然很有趣，但我确信军备竞赛也会压垮这些系统。
The most common ones I've observed orient around user input to solve simple puzzles e.g. of the following is a picture of a cat. (displaying pictures of thumbnails of dogs surrounding a cat). Or simple math problems.
While interesting I'm sure the arms race will also overwhelm those systems too.
您可以使用 Recaptcha 至少使验证码变得有用。 然后你可以用简单的数学问题或类似的问题来提问。 Microsoft 的 Asirra 可让您找到猫和狗的照片。 需要有效的电子邮件地址来激活帐户可以阻止垃圾邮件发送者，因为他们无法从该服务中获得足够的好处，但也可能会阻止普通用户。
You can use Recaptcha to at least make a captcha useful. Then you can make questions with simple verbal math problems or similar. Microsoft's Asirra makes you find pics of cats and dogs. Requiring a valid email address to activate an account stops spammers when they wouldn't get enough benefit from the service, but might deter normal users as well.
以下内容对于今天的技术来说是不可行的，但我认为这并不是太遥远。 对于处理论坛垃圾邮件来说，它也可能有点过分，但对于帐户注册或任何您想要真正确定您正在与人类打交道的情况可能很有用，并且他们会准备好花费几分钟来完成过程。
让 2 个用户试图通过网络摄像头证明自己与彼此有人类联系，并询问他们所看到的人是否是人类并且是活人（即不是录音），例如让他们镜像彼此的动作，或者在一张纸上写一些东西。 让每个人与不同的用户一起这样做几次，并将一些录音放入混音中，他们也必须正确识别这些录音。
The following is unfeasible with today's technology, but I don't think it's too far off. It's also probably overkill for dealing with forum spam, but could be useful for account sign-ups, or any situation where you wanted to be really sure you were dealing with humans and they would be prepared for it to take a few minutes to complete the process.
Have 2 users who are trying to prove themselves human connect to each other via their webcams and ask them if the person they are seeing is human and live (i.e. not a recording), by getting them to, for example, mirror each other's movements, or write something on a piece of paper. Get everyone to do this a few times with different users, and throw a few recordings into the mix which they also have to identify correctly as such.
论坛上流行的方法是简单地将帖子少于 10 个的成员的帖子放入审核队列中。 当然，如果您没有版主，或者这不是论坛，这并没有什么帮助。 更通用的方法是计算超链接与文本的比率。 通常，垃圾邮件帖子包含大量超链接，您可以通过这种方式捕获很多内容。 同样，比较连续帖子的内容。 根本不允许出现极其相似的连续帖子。
当然，任何了解您所采取措施的人都能够绕过它们。 老实说，如果您是特定攻击的目标，您无能为力。 相反，您应该专注于防止更普遍的、不熟练的攻击。
A popular method on forums is to simply queue the threads of members with less than 10 posts in a moderation queue. Of course, this doesn't help if you don't have moderators, or it's not a forum. A more general method is the calculation of hyperlink to text ratios. Often, spam posts contain a ton of hyperlinks, and you can catch a lot this way. In the same vein is comparing the content of consecutive posts. Simply do not allow consecutive posts that are extremely similar.
Of course, anyone with knowledge of the measures you take is going to be able to get around them. To be honest, there is little you can do if you are the target of a specific attack. Rather, you should focus on preventing more general, unskilled attacks.
对于人类版主来说，如果机器人足够聪明，可以使用注册帐户，那么能够轻松查找和删除某个 IP 的所有帖子或某个用户的所有帖子肯定会有所帮助。 同样，无需进一步管理即可轻松阻止 IP 地址或帐户一段时间的选项将减轻人工审核员的管理负担。
使用cookie让机器人和人类垃圾邮件发送者相信他们的帖子实际上是可见的（虽然只有他们自己看到），从而阻止他们（或巨魔）改变技术。 让垃圾邮件发送者和巨魔看到其他垃圾邮件和巨魔消息。
For human moderators it surely helps to be able to easily find and delete all posts from some IP, or all posts from some user if the bot is smart enough to use a registered account. Likewise the option to easily block IP addresses or accounts for some time, without further administration, will lessen the administrative burden for human moderators.
Using cookies to make bots and human spammers believe that their post is actually visible (while only they themselves see it) prevents them (or trolls) from changing techniques. Let the spammers and trolls see the other spam and troll messages.
像这样的Javascript评估技术Invisible Captcha系统要求浏览器评估Javascript在页面提交被接受之前。 当用户没有通过仅显示传统的验证码测试来启用 Javascript 时，它会很好地回退。
Javascript evaluation techniques like this Invisible Captcha system require the browser to evaluate Javascript before the page submission will be accepted. It falls back nicely when the user doesn't have Javascript enabled by just displaying a conventional CAPTCHA test.
动画验证码（滚动文本）仍然很容易被人类识别，但如果您确保没有一个框架提供完整的识别内容。
选择题 - 只需一个______和一个微笑。 这里的想法是用户必须选择/理解。
会话变量 - 检查放入会话中的变量是否是请求的一部分。 将挫败仅生成请求的愚蠢机器人，但可能不会挫败像浏览器一样建模的机器人。
数学问题 - 2 + 5 = - 这又是提出一个易于解决但阻止机器人生成响应的问题。
图像网格 - 您创建图像网格 - 选择 1 或 2 个特定类型，例如 3x3 动物网格图片，您必须选出网格上的所有鸟类。
希望这能为您的新解决方案提供一些想法。
Animated captchas' - scrolling text - still easy to recognize by humans but if you make sure that none of the frames offer something complete to recognize.
multiple choice question - All it takes is a ______ and a smile. idea here is that the user will have to choose/understand.
session variable - checking that a variable you put into a session is part of the request. will foil the dumb bots that simply generate requests but probably not the bots that are modeled like a browser.
math question - 2 + 5 = - this again is to ask a question that is easy to solve but prevents the bots ability to generate a response.
image grid - you create grid of images - select 1 or 2 of a particular type such as 3x3 grid picture of animals and you have to pick out all the birds on the grid.
Hope this gives you some ideas for your new solution.
朋友有一个最简单的反垃圾邮件方法，而且很有效。
他有一个自定义文本框，上面写着“请输入数字 4”。
他的博客相当受欢迎，但仍然不够受欢迎，以至于机器人无法弄清楚（还）。
A friend has the simplest anti-spam method, and it works.
He has a custom text box which says "please type in the number 4".
His blog is rather popular, but still not popular enough for bots to figure it out (yet).
请记住让那些不使用传统浏览器的人可以访问您的解决方案。 iPhone人群不容忽视，那些有视力和认知问题的人群也不应被排除在外。
Please remember to make your solution accessible to those not using conventional browsers. The iPhone crowd are not to be ignored, and those with vision and cognitive problems should not be excluded either.
蜜罐是一种有效的方法。 Phil Haack 给出了一种好的蜜罐方法，可以使用原则上适用于任何论坛/博客/等。
您还可以编写一个爬虫程序来跟踪垃圾链接并分析其页面以查看其是否是真实链接。 最明显的是包含内容的精确副本的页面，但您可以选择其他指标。
审核和黑名单，尤其是像这样的插件 WordPress（或者您正在使用的任何软件，大多数平台都提供类似的软件），将在低容量环境中工作。 如果您的环境容量较小，请不要低估这给您带来的优势。 如果您有时间的话，亲自决定什么是合理的内容，什么是不合理的内容，可以让您在垃圾邮件控制方面拥有最大的灵活性。
不要忘记，正如其他人指出的那样，验证码不仅限于图像中的文本识别。 视觉联想、数学问题和其他通过图像传达的非主观问题也符合条件。
Honeypots are one effective method. Phil Haack gives one good honeypot method, that could be used in principle for any forum/blog/etc.
You could also write a crawler that follows spam links and analyzes their page to see if it's a genuine link or not. The most obvious would be pages with an exact copy of your content, but you could pick out other indicators.
Moderation and blacklisting, especially with plugins like these ones for WordPress (or whatever you're using, similar software is available for most platforms), will work in a low-volume environment. If your environment is a low volume one, don't underestimate the advantage this gives you. Personally deciding what is reasonable content and what isn't gives you ultimate flexibility in spam control, if you have the time.
Don't forget, as others have pointed out, that CAPTCHAs are not limited to text recognition from an image. Visual association, math problems, and other non-subjective questions relayed through an image also qualify.
Sblam 是一个有趣的项目。
Sblam is an interesting project.
不可见的表单字段。 创建一个不向用户显示在屏幕上的表单字段。 使用 display: none 作为 css 样式，这样它就不会显示。 为了可访问性，您甚至可以放置隐藏文本，以便使用屏幕阅读器的人知道不要填写它。机器人几乎总是填写所有字段，因此您可以阻止任何填写不可见字段的帖子。
Invisble form fields. Make a form field that doesn't appear on the screen to the user. using display: none as a css style so that it doesn't show up. For accessibility's sake, you could even put hidden text so that people using screen readers would know not to fill it in. Bots almost always fill in all fields, so you could block any post that filled in the invisible field.
根据垃圾邮件发送者 IP 地址黑名单阻止访问。
Block access based on a blacklist of spammers IP addresses.
蜜罐技术在页面顶部放置了一个看不见的诱饵表单。 用户看不到它并提交正确的表单，机器人提交错误的表单，该表单不执行任何操作或禁止其 IP。
Honeypot techniques put an invisible decoy form at the top of the page. Users don't see it and submit the correct form, bots submit the wrong form which does nothing or bans their IP.
我看到了一些类似于 Asira 的巧妙想法，它们要求您识别哪些图片是猫。 我相信这个想法源自 KittenAuth 不久前..
I've seen a few neat ideas along the lines of Asira which ask you to identify which pictures are cats. I believe the idea originated from KittenAuth a while ago..
使用 Google 图片标签 之类的工具以及适当选择的图片，这样计算机就无法认识到人类能够识别的主要特征。
用户将看到一张图像，并且必须输入与其相关的单词。 他们会不断地看到图像，直到他们输入了足够多的单词，这些单词与之前用户为同一图像输入的内容一致。 有些图像可能是新图像，并未对其进行测试，但包含在内是为了记录与它们相关的单词。 根据您的受众，您也可以选择只有他们能识别的图像。
Use something like the google image labeler with appropriately chosen images such that a computer wouldn't be able to recognise the dominant features of it that a human could.
The user would be shown an image and would have to type words associated with it. They would keep being shown images until they have typed enough words that agreed with what previous users had typed for the same image. Some images would be new ones that they weren't being tested against, but were included to record what words are associated with them. Depending on your audience you could also possibly choose images that only they would recognise.
Mollom 据称擅长阻止垃圾邮件。 提供个人（免费）和专业版本。
Mollom is supposedly good at stopping spam. Both personal (free) and professional versions are available.
我知道有些人提到了 ASIRRA，但如果你转到所有图像的收养我链接，它会在该链接页面上显示它是猫还是狗。 因此，对于机器人来说，访问所有采用我的链接应该相对容易。 所以该项目的实施只是时间问题。
I know some people mentioned ASIRRA, but if you go to all the adopt me links for the images, it will say on that linked page if its a cat or dog. So it should be relatively easy for a bot to just go to all the adoptme links. So its just a matter of time for that project.
只需验证电子邮件地址并让谷歌/雅虎等担心它
just verify the email address and let google/yahoo etc worry about it
您可以获得一些设备 ID 软件 the41 有一些欺诈预防软件，可以检测用于访问您网站的硬件。 我相信他们用它来抓捕欺诈者，但也可以用来阻止机器人。 一旦您确定了机器人正在使用的设备，您就可以阻止该设备。 上次检查时，它甚至可以通过电话网络跟踪您的路线（不是您的地理 IP！），因此如果您愿意，甚至可以阻止邮政编码。
通过如此支撑，它的价格昂贵。 一个更好更便宜的解决方案，但有点不那么大哥。
You could get some device ID software the41 has some fraud prevention software that can detect the hardware being used to access your site. I belive they use it to catch fraudsters but could be used to stop bots. Once you have identified an device being used by a bot you can just block that device. Last time a checked it can even trace your route throught he phone network ( Not your Geo-IP !! ) so can even block a post code if you want.
Its expensive through so prop. a better cheaper solution that is a little less big brother.