Script flooding mailout avec OVH via register.php

Bonjour,

Est-ce que quelqu'un a déjà eu un blocage http avec OVH pour la raison suivante :

Citation
OVH
Problème rencontrée : Script flooding mailout
Commande apparente : S 23:59 0:00 php.ORIG.5 -c /usr/local/lib/php.ini -d register_globals=1 -d magic_quotes_gpc=1 -d session.use_trans_sid=1 register.php

Sur mon site, je n'ai que forum qui possède un fichier register.php...
ça fait 2 fois que mon site est bloqué pour la même raison. Une idée, une solution ?

Merci d'avance pour toutes les pistes
@+
Greg

I don't understand your post fully but you might want to enable the spamhurdles module for new registrations.

---

Thomas Seifert

Hello Thomas,

I've just set the spam hurdles module. It may be the right solution.

Thanks !
Gregory

Bad news... the spam hurdles is active but the spam problem occurs...

Did you actually configure spamhurdles to show some captcha at the registration screen?

---

Thomas Seifert

I think so, you can look : Register on my web site

Then either posting the spam is done from an account that already was active (did you disable the spam users?) or somebody is doing manual labor to bypass the captcha.
In the last case, you should check if the spamming can be blocked by the ip address of the posting user(s).

---

Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce

How to identify the spam users ?
I will try to find in my log the ip.

Thank you and Thomas

Well.. the spam user would be the user that posted the message. If you allow anonymous users to post messages (so no registration required), then the task would be more difficult. In that case, there might not be a user. However, on your forum this does not seem to be the case.

As administrator or moderator, you can look at the IP address in the message to see if the spammer is coming from one IP address.

---

Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce

I don't allow anonymous users and I don't have any spam messages on my forums. Maybe in privates messages ?
My logs show different IPs when the pb occurs.