We're working on ways to lower the fees, but Bitcoin network fees are expensive and larger faucets actually generate more network fees.

I remember running my own faucet before FaucetBOX.com and Microwallet. 50% of costs were spent for network fees (~20 BTC over about 2 years, but Bitcoin was way cheaper back then).

This IP is just a shared web hosting. Are you sure that's not the IP of your own faucet? How many IPs do you see on the list?
Do you use MFA and ACL in FaucetBOX.com Dashboard?

Has anyone tried incapsula? They advertise Bot Protection as one of their main features:
https://www.incapsula.com/website-security/access-control.html
and they do include it in their Free plan:
https://www.incapsula.com/pricing-and-plans.html

Incapsula is more security-oriented than CloudFlare, so maybe it'll work better, but personally I have almost no experience with them.

It has only referral payouts, so either bot or just a rotator or something similar.

In that case leave Nastyhosts disabled, as it also tries to block proxies/VPNs.

Bot protection is a hot issue currently. It seems that no captcha on it's own is enough to prevent bots. You should:

1. use captcha (I still think that FunCaptcha is best, but there are different opinions. reCaptcha is most certainly not secure: http://www.deathbycaptcha.com/user/login)
2. use CloudFlare or Incapsula (they try to catch bots too, but make sure you've configured it correctly. Your web server MUST block connections that don't come from their servers or you'll be hacked)
3. use NastyHosts.com service (you can enable that in admin panel)
4. review and use one of the list of addresses / IPs / hostnames used by bots that you can find on this forum
5. don't put too much coins on your account and make use of the safety limits in FaucetBOX.com Dashboard

But still, there are no guarantees that it'll be enough.

Unfortunately we can't allow users to withdraw manually. That's the whole reason FaucetBOX.com exists in the first place. We need to batch payouts to many, many users before we actually pay out to make fees to the network as low as possible.


Does it also happen if you try unmodified template with nothing in the ad boxes in admin panel? That issue is often triggered by weird ads and visitor tracking systems that for some reason make AJAX request to the site itself, which invalidates the anti-CSRF token.

NastyHosts doesn't block this address: http://v1.nastyhosts.com/92.112.233.199 (suggestion: allow).
Do you have anything in "List of hostnames to ban" in your admin panel? Disabling NastyHosts also disables checking hostnames, so maybe you've blocked yourself through that.

What IP do you see there exactly? I will check why it's banned. Unfortunately false-positives may happen, that's why Nastyhosts is disabled by default.

I don't know if you remember that, but we did show the average user payout earlier. And faucet owners massively abused it by making fake payouts to their own addresses, which made this stat totally unreliable. How much a faucet pay doesn't matter anymore on the list. We only use user's up and downvotes. Unfortunately we don't have enough manpower to keep this list clean. But FaucetBOX.com isn't a faucets list, it's a payment cache. You should use much better 3rd party faucets lists instead.


Tor exit nodes change frequently, so a single copy-paste-forget isn't a good way. However Nastyhosts already blocks Tor. It uses this list https://check.torproject.org/exit-addresses and refreshes it every hour. A quick check using a random address from the list shows that it's working: http://v1.nastyhosts.com/176.10.99.208 .

If you're depending on FaucetBOX.com's list for traffic and revenue, then you're missing most of it . I estimate that only ~30% of users use that list.


Email wouldn't change a thing unfortunately. There're hundreds of 10-minute-mails that bots can use. They can also just use aliases, for example on gmail if you have myaccount@gmail.com account, then you can add whatever you want after the plus sign and it will work as well, like myaccount+bot1@gmail.com, myaccount+bot2@gmail.com etc. So instead of endless game of blocking ips and tors you'd have an endless game of blocking mail providers.
Also FaucetBOX.com is all about users not having to register, that's what brings lots of traffic. Users get discouraged quickly when you promise them something for free, but only after they register. And if you also require their phone number for SMS verification... I know I wouldn't use such a faucet . However that's something that can be implemented in the script, it doesn't have to be done by FaucetBOX.com. Just make a faucet with registration and SMS verification. If you can't code, I think that it wouldn't take longer than a weekend for someone for a small fee.


That was probably Nastyhosts.com doing it's work

There's nothing to fix. Our script doesn't block anything on it's own, the faucet owner had to manually add your address to list of banned addresses. You have to contact this faucet owner if you care enough.

That's not the error we're talking about. That one can be caused pretty much by anything and you're right, it can be caused by error in config.
I believe that ONLYFree was referring to the error shown by the script itself that literally says "Unknown error.".

"Unknown error" is only shown when address is banned or faucet can't connect to the API*, so that's not a problem in config. And it worked for me (I've just tried), so it's not a problem with connection, at least not a long-lasting one.

Have you tried a fresh new address?

* unless he modded his faucet

Yes, that most likely means that the faucet owner blocked your address.


FaucetBOX.com doesn't block giving coins to your own address from your own faucet.

It wouldn't change anything. It'll save maybe half a second for the connection itself, but if you're going to do 50 payouts in one request, our server will simply take 50 times longer to reply.

Also do these long replies from our servers still happen? I think that we've fixed it about a month ago.


Hmm... that sound good, but I don't think many users will actually use it. I've added it to our issue tracker, we'll look into that further when we will have some time to spend


N/A means that the script couldn't even connect to FaucetBOX.com API. Does it show any errors when you log in to the admin panel?

Hmm.. I can't reproduce that on my Android and it does sound like it's a problem with cookies.

Can you login on other sites correctly?

If I understood you correctly, then yes, that's how it works. The system counts how much did you spent and resets this every 30 minutes. If it gets more than the limit you set before resetting, payouts will be blocked until it resets.


Set $display_errors = true; in your config.php file. Does it show anything else now? If not, check your server logs. You don't have to delete the database, it wasn't updated in a way that would cause such issues. Most likely you have PHP older than 5.4.


That's not true. Referrals are assigned to the address. So if user that uses address ABC uses a faucet with a referral link of XYZ, and then visits the faucet directly, in both cases XYZ will get the claim. What's more even if user with address ABC visits the faucet again, but with referral of DEF, still it's the XYZ who will get referral payout.

If you run your own faucet, you can check the Faucetinabox_Refs table in database, this data is stored there.

EDIT: but also please remember, that FaucetBOX.com as a service doesn't handle referrals at all. Faucets do it on their own and the behavior I described applies to Faucet in a Box script, other scripts may work differently.

You know that mobile verification isn't free, right? And it'd probably cost much more (like ~100x more) than what faucets are giving away?

EDIT: also, bots CAN create new mobile number every 5 minutes. Check Twilio, Nexmo and other similar services. Most of them allow not only sending, but also receiving messages.

Yea, we need to figure out what to do with it. However we don't have the timer data anymore, which complicates things.

Blocking currency addresses is pointless. If we do that for whole FaucetBOX.com then the bot will simply change it as soon as he sees that. So it'll help for 5 or so minutes.
If you can get the IP addresses then it'll make sense to block it, as it's harder to change IP address (but just a little bit).

Also, as noted in thread, it's probably not a bot, but real user using proxies. That's REALLY hard to detect & block.