Do you see that on your faucet itself or in FaucetBOX.com Dashboard?

Even if it would matter which captcha was completed (you can implement something like that easily), it wouldn't help against bots. It's trivial for a script to check which captcha it has to solve.

Just to sum up last few posts about bots/abusers and to show my view on it:

1. adding random things to session won't help much. There's already random name of the address input and bots can handle it, so it won't be a problem for them to also handle something new.
2. calculating the time between visiting the landing page and making a claim won't help, bots will just add some delay (and they can even make it a little bit random, so you won't be able to tell a difference from real person)
3. trying to detect mouse movement etc and sending this info through AJAX won't help, bots can just spoof the request
4. there already is a hidden field AND a hidden checkbox in Faucet in a Box script, but it only helped for a week or so until bots were modified to avoid that field. We could also make names of these hidden fields random, but then bots will be able to just traverse the DOM tree to find the real ones. And if you make a few visible fields and somehow tell the user which one is valid, bots will be able to read it too.
5. any javascript-based "protections" aren't worth anything. That includes most anti-bot links, though I've seen one implementation that also used a backend code and could help (but that isn't significantly different from just another captcha, so again, a short-term solution)

I believe that there's no point anymore in this cat and mouse game. Anything that can be done by a browser and a user sooner or later will be done by bots, it's just a matter of time it takes to code it. And to be honest it's usually asymmetric, where it takes longer to implement the protection than it takes to implement handling of it in a bot.
Also what I believe is that automated bots aren't really a problem. "Captcha rotators", scripts that shows a captcha to user and automatically change proxies are worse, as from my experience are more common.

However there's only one solution, both to automated bots and these nasty rotators: detect networks used by abusers and ban them. Make sure you have protections in place that will prevent your faucets from going dry in case of attack and will allow you to react and stop abusers, at least until they change networks again.

At FaucetBOX.com we're currently focusing on:
1. improving NastyHosts.com using various blocklists and metadata
2. adding features that will help to quickly react to an attack and will prevent losing too much coins.

Open index.php file and find this line:

it's line 102 in r62. Right above this line add (it's something that will be integrated in r63):


It should show the real error now. If all details are correct then probably you also have to add permissions to your database to your user or something like that.

It also can get delisted if it returns any http error. It'll get back up soon.


Nastyhosts blocks cloudflare if you don't configure it properly in your faucet's admin panel. Use your "absolute URL" (it's a problem that's possible, it leaves you vulnerable), login to admin panel and read everything on the "Advanced" tab. If you don't understand what's written it, it's safer for you to not use CloudFlare.

It loads just fine for me, so maybe that's some incompatibility with a browser or some extension. Have you tried visiting this in Private/Incognito mode of your browser? What browser and which version do you use?

What's your address?

We're not in a place where we can afford supporting yet another script/feature, we want to focus more on our core (there's still some work to be done to have full sustainability) and security features.

But ScanTheBox.com took maybe 20 hours to build, I'm sure you (as in whole community) can build something better . And it's definitely not that great for owners. Due to sandboxing (to prevent faucets from redirecting user from rotator or opening popups) ads mostly don't work, nothing happens when users click them.

You can't, the script doesn't store associations between bitcoin addresses and IP addresses for privacy reasons. You will have to modify the script to have that.


About a year now. However it's not very well maintained due to problems with getting real timer value...

Be patient, there's a queue, everyone wants to get verified as soon as possible

Edit the template file directly. However usually putting more than 3 banners actually decreases your revenue, so I'm not sure you want to do that

Easy to check. Just provide your own IP address and test if you're blocked. However please note that it'll also lock you out of the admin panel, so have another IP address to revert the change from.

1. FaucetBOX.com doesn't know IPs of users the coins are sent to, only the script itself knows it
2. FaucetBOX.com doesn't have enough information to tell a difference between abuser and just an owner of a faucets list or a rotator with many referrals. It actually happened multiple times here when addresses were being accused of scamming, and later it turned out there were actually legit.
3. FaucetBOX.com is a payment cache. API call to pay to address was made, it's not FaucetBOX.com job to decide whether it's legit or not.


1. no, it's not automatically updated
2. there's a list of changes that's shown in the admin panel when you're using outdated version
3. yup, there is, but nothing big, just minor tweaks

Guys, it's irrelevant if captchas can by solved automatically or not. Current protections (captcha, timer per IP address) can be bypassed one way or another, it doesn't really matter how. The only thing that changes is whether we can call abusers bots, human-assisted scripts or rotators with built-in proxy switcher. The effect is the same: drained faucets, and there's only one solution: checking IP addresses.

First, let me thank you for your post. Although it's harsh and could be written in more polite way, I agree with most of it and I hope it'll change the way this issue is discussed.

Now about captcha. Yes, automated scripts can't solve captchas on their own. But there are human powered services like https://2captcha.com/, where an automated script can send a captcha and will receive a solution made by a real human. Last time I checked it was about 170 satoshi per one solve.

EDIT: here's a sample bot that uses these services: http://www.autoclickbots.com/product/coincollector-v3/ .

Geoblocking doesn't help, there's no specific correlation between countries and bots.
Nastyhosts isn't perfect, but it's free.
All bots need is just an access to your site, just like a regular user.


To get around captchas they use services like this: http://www.deathbycaptcha.com/user/login. In short, there's a real human sitting on the other end doing nothing but solving captchas for money.

To be honest it's not really FaucetBOX.com responsibility to protect faucets from bots. FaucetBOX.com is a payment cache, not a bot protection service. However we do what we can (Nastyhosts, honeypots, settings that limit the impact of bots etc.) and it's almost the only thing we're focusing on right now.

Now to what you can do more is:
1. use CloudFlare with high security settings. I heard that helps a lot. And for CloudFlare bot protection is actually one of core functions.
2. use safety limits in FaucetBOX.com Dashboard. While they won't stop the bots, they'll at least stop them from stealing all your coins in 2 minutes...
3. use a proper fraud detection service like https://www.maxmind.com/en/minfraud-services . Now that's possibly impossible given how expensive they are, but that shows how hard this issue actually is. You can also contact the guy behind http://getipintel.net/ for the cost of using it for a faucet (the free 15 reqs per minute / 500 reqs per day won't be enough usually)

That's not an error from the script, looks like someone just tried to visit /xmlrpc.php on your faucet. There are exploits for this file, so I guess just a random crawler. Not related to 500 error and nothing to worry about.


You're using new template files (~r60 I guess) with and old index.php file (~r50?). You didn't update properly.
Also these Notices wouldn't cause 500 error. There must be some other error.


A few days.

Caching the payments and withdrawing them in batches, and not on demand, is what makes faucets possible at all. Otherwise fees for the Bitcoin network are too high. The threshold would need to be about 0.01 BTC instead of just 13k satoshi in such case.
What's your address? I'll check what's wrong.

That's client-side protection. It won't do anything against bots.

If your faucet works I wouldn't worry about it. Looks like just intermittent connection problem.