Just like to bring this to an mods attention

I don’t know which member you’re referring to specifically, but if anyone is sending you spam in private you should use the report function - every post, private message and chat message has a report button for bringing it to the attention of the moderators. It looks like a flag.

You can also dm one of us directly but it’s better to use the report function because then it ends up in our report log.

I think op means this -
memberlist.php

If I understand him correctly he refers to someone creating a massive amount of new bot accounts on this site, not 1 person pestering him with private bot messages, but I maybe wrong...

We've always had tons of bot sign-ups. And so far they've always got stuck in post-approval limbo because they can't post on the forum or message anyone until a moderator has approved one of their forum posts. Before Teebling enabled that feature we had waves of spam on the forum, if you remember.

But like I said, if you see suspicious activity (forums posts, trade listings, private messages, chats, etc) that seem to be spam or something, then always report it to us.

These are definitely all bots, they all went offline the same minute they registered.
Will these accounts get deleted by you mods?

I don't delete ban accounts on suspicion of being bots, I delete ban accounts based on what they do. And so far they have done nothing besides registering, as far as I know.

EDIT: moderators can't actually delete accounts, only ban them, so I adjusted the wording accordingly

A suspicion?
You think there is a slight chance that these accounts a not bots?

A dozen accounts created at the same time with names of exactly 8 randomly created letters that all went offline in the same minute they were created, without any battlenet-account or any other information given.

Which human would do that?
Sometimes you mods are overly cautious.

Let's all calm down.

Nowhere did I say that you mods should watch the members list all day. These bots here were brought to your attention by a normal user.

I was just commenting on Shadowheart who seems to have doubts that these are bots. For me, these are 100% bots. Still thinking that these might be real people is what I called "overly cautious".

But if you have a policy that you don't care about registered bots as long as they don't do anything, that makes sense. But that is not what Shadowheart said.
He also implied that mods can delete accounts. But he has clarified that.

And bots don't seem to waste a lot of storage space and don't stress the server (much) when they are inactive. So, no problem there. And most of the bots seem to get deleted eventually. In the members list there are hundreds of bots that joined in the last weeks. But hardly any mods that are older. So, your approach seems to work.

Moving to feedback forum.

This is a particularly persistent bot that started up about 1 month ago - I did notice it OP.

It actually began because it was able to place links to gambling sites in the profile fields like bnet, discord etc. which I have since patched with strict form validation on the frontend and on the backend, and did a pass to remove all the bad links. That stopped the bot from being able to post bad links, but it didn't stop it from continuing to create registrations. This bot has never been able to make an actual post, private message, or anything like that, but it's very good at getting a successful registration.

Allow me to explain:

It runs on a botnet (thousands of legit people's infected-by-malware computers from all over the world), so I am:

• Unable to target the bot by IP or IP group (they're all unique IPs)
• Unable to target the bot by ASN/datacentre/geo (they're all unique/different countries/datacenters/ASNs - real people's infected devices).

Furthermore, the bot is very sophisticated:

• It is able to bypass Cleantalk's bot detection - a service I pay for that matches known offending IPs, email addresses, and also detects behavioural things like cursor movement etc.
• It is able to bypass Cloudflare's bot detection - another service I pay for that does something similar, but is even stricter and more effective than Cleantalk - even the most severe Interactive Challenge this bot can complete with about a 75% success rate.
• It is able to bypass my 'honeypot' - a hidden off-screen field to normal users (but bots can see), which if populated provides a fake 'registration success' screen but does not actually register the account.
• It is capable of bypassing a simple Diablo 2 related question and answer challenge which is sometimes shown, like who is act II boss - it quickly works out the answer (no, the answer is not exposed in the frontend, so it is searching the internet for the answer).

So tbh I'm starting to run out of options at this point. I really don't want to introduce email address validation, because I know the bot will have no problem with that (have tried it before), and it makes the registration experience shit for everyone else.
I suspect that due to the slow and steady rhythm of registrations, it's an LLM and not a typical script - a script would have been caught and prevented from registering much earlier at maybe even the first or second layer of defence.

There is a lot that happens behind closed doors to keep the site free of spam - it's under 24/7 attack of bots just like this one, but this is definitely the worst and most persistent one I've had to deal with.

Edit: I suspect what happened is that the owner of this bot didn't realise that his spam links weren't making it onto web pages anymore, and just hasn't turned the bot off, so it keeps on registering and attempting (and failing) to include spam links.

Thanks for your constant efforts to keep the bot flood at bay, Teeb.