阻止垃圾邮件发送者创建帐户（reCaptcha 不起作用）
您好，我们刚刚在我们的电子邮件系统中注意到一堆尼日利亚垃圾邮件帐户。现在，我们的注册表单中确实有一个验证码，但显然他们手动或以其他方式绕过了它。这似乎是一种半手动规避，因为帐户不是批量创建的，而是以中间间隔几分钟的方式源源不断地创建的。
由于大多数垃圾邮件帐户都是由来自尼日利亚的 IP 地址创建的，因此我们刚刚在几个相当广泛的 IP 范围内设置了一些简单的 IP 过滤器，目前看来效果不错。然而，我们希望对这个问题做出更永久的解决方案。
我们正在考虑的最合理的改进是从使用 reCaptcha 更改为使用丹麦语的 textcaptcha。这可能会让尼日利亚人很难手动输入答案，因为他必须学习丹麦语或在网络上搜索答案。但是，我想知道您是否有更好的建议，或者只是我们可以实施的替代或额外的筛选方法。
Hi we have just noticed a bunch of Nigerian spam accounts in our email system. Now, we do have a reCaptcha in the signup form but apparently they circumvent it, manually or otherwise. It seems like a semi-manual circumvention since the accounts aren't created in bulk but instead as a steady stream with a few minutes in between.
Since most of the spam accounts were created by IP addresses from Nigeria, we have just set up some simple IP filters over a couple of pretty broad IP ranges and that seems to be working for now. However we would like to make a more permanent solution to this problem.
The most reasonable improvement we are thinking about is to change from using reCaptcha to use a textcaptcha in danish. This might make it hard for a Nigerian to manually enter the answer since he would have to learn Danish or search the web for an answer. However, I would like to know if you have a better suggestion or maybe just alternative or additional screening methods we could implement.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
据我所知，最好的方法是要求通过短信进行验证。您很容易检测到同一个电话号码被多次尝试，并且拥有大量支持 SMS 的电话相当困难。
The best approach that I know of is requiring verification via SMS. It's very easy for you to detect that the same phone number is being tried more than once, and it's reasonably difficult to have a large number of SMS-capable phones.
再想一想，我想我确实有一个解决方案，尽管不一定是您会喜欢的解决方案：
给您的人提供电子邮件帐户
可以说，做你正在做的事情的组织是问题的一部分。
除非您的主要业务是提供免费电子邮件（这肯定是一项吃力不讨好的生意），否则我认为没有必要向人们分发电子邮件帐户。如果您希望他们能够与您或您的其他用户进行通信，请让他们使用自己已经拥有的私人电子邮件帐户。如果您只需要与您沟通，网络反馈表就可以了。如果您希望它们相互通信并且它是某种社交网站，请在帐户之间提供消息传递功能。但不要让陌生人访问您的全球连接电子邮件服务器！这相当于操作一个打开的继电器。
任何人都可以免费从 Google（或雅虎，或...）获得电子邮件帐户。让那些公司担心垃圾邮件发送者吧，他们比你赚更多的钱。
Having thought about this for a little more, I think I do have a solution, though not necessarily one you will like:
From what I understand of your question, you are giving out email accounts to people who
It could be argued that organizations doing what you are doing are part of the problem.
Unless your primary business is being a provider of free email (and that's surely a thankless business), I don't see a need to hand out email accounts to people. If you want them to be able to communicate with you or with other of your users, let them use their own, already owned private email accounts. If you only need communication with you, a Web feedback form will do. If you want them to communicate among each other and it's some kind of social site, provide messaging capability between accounts. But don't give strangers access to your worldwide-connected email server! This is the equivalent of operating an open relay.
Anybody can get an email account from Google (or Yahoo, or...) for free. Let those companies worry about spammers, they make more money than you do.
您可以在表单中设置一个隐藏字段，名称为“电子邮件”或未使用的名称，真人不会填写它，但机器人会填写，因为他们通常阅读代码，而不是查看页面。
You could set up a hidden field in the form with a name like "email" or something thats not used, real humans wouldn't fill it in, but a robot would since they usually read the code, not look at the page.
我们的光荣领袖关于打击准备解决验证码的垃圾邮件发送者的想法：
https:// blog.stackoverflow.com/2009/02/new-question-answer-rate-limits/
Thoughts from our Glorious Leaders on combating spammers who are prepared to solve captchas:
https://blog.stackoverflow.com/2009/02/new-question-answer-rate-limits/