Disabled "About me" and "Signature" profile elements as the "Spam Be Gone" plugin does not check these
This, I feel, will help us a lot. We have a lot of bots using this vector and really see essentially no legitimate usage of it.
Almost all of my spam users originate in Russia, and most have ".ru" email accounts. Is there a way to block them?
I'd rather not use recaptcha because some people hate it, so it would be great to enable a question+answer, like "What is lebron's last name?".
I would most probably go with IP blockade. The idea is that to include directives inside Nginx/Apache to stave off traffics from Russia. It is a quite messy workaround, if you ask me.
@zenkamal enabling captcha with spam-be-gone seems to help. Give that a try.
90% of the spam originated from China, Nigeria, and Russia from what I've analyzed over the past 4 months. I just used GeoIP country block in my nginx. A little extreme, but it works and I will use this last measure until I feel the system is good enough to handle the spam. Somehow with the spam-be-gone they still got through with the registrations somehow.
EDIT: Wait, just seen the captcha when I logged out from NodeBB. Will be using that then.
I feel bad that my forum isn't popular enough to be targeted by spam bots