It was posted already, search the thread:


Also no "human powered captchas solving service" has an API that allows to solve these kinds of captchas. They can only solve captchas that can be solved based on a single screenshot, so as of now Are you a human and FunCaptcha are safe from them.

That said the "Bots blocked" stat that FunCaptcha is providing is crap, no way it can be so high.

Personally I believe that both Are you a Human and FunCaptcha are safe. The "proof" that Are you a human can be bypassed is this: http://hackaday.com/2012/05/25/captcha-bot-beats-new-are-you-a-human-playthru-game/ . But read the comments there. It doesn't actually get accepted. The game shows that it was solved, but after actually submitting it it gets rejected. Some people reported that Are you a human isn't safe because they were hacked, but that didn't have to do anything with captcha itself, but with them being sloppy with their passwords.

I think that captchas that can't be solved based on single screenshot are safe as for now. Just don't try so hard to see bots everywhere, in most cases these are hardcore but legit users that just spend really huge amount of time on faucets.

The best test is to compare it. Try each captcha for a day or two and see which one results in smallest spendings. Only a small fraction of legit users care what captcha system they use, so that shouldn't be a problem.

Buy they're all from https://faucetbox.com/en/check/1ERM3mkNWXwHCNNcJiYHBFtNUoKivRwBiQ which I don't believe is a bot. I think only the second one may be a bot.

https://faucetbox.com/en/check/1AMUVYtt2tG21TDjNaqmTMiyYQRc5tUuW4

That's maybe a bot (although I'm not really convinced), but I don't see any faucet with FunCaptcha here.

https://faucetbox.com/en/check/1ERM3mkNWXwHCNNcJiYHBFtNUoKivRwBiQ

It doesn't look like a bot to me. He just doesn't withdraw very often from these faucets and they allow their users to accumulate coins. So this spike on the graph is just from a few cumulated withdrawals.

I've only checked a few faucets from payouts lists of these addresses and didn't encounter any that uses FunCaptcha. Which ones are you referring to exactly?

I'd really love to see that. Hovewer I think it'll be cheaper if you just pay someone to create a custom script for you. I don't think any bot will care to bother for just one custom faucet, looks like only generic sites are being attacked.

Why would you want something like that?

Things to consider:

1. If user hasn't changed his payout threshold, anyone can do that just knowing the link / his address
2. User may lose anonymity. Probably right now noone can connect him to the address his using on FaucetBOX.com. If he sends his link, he'll lose that (not that many will care though)
3. That's mostly public data anyway. Everything's on the blockchain.

You can copy any template you want.



That's not a captcha... That's what bots use to break captchas.

https://rucaptcha.com/blog/for_webmaster/recaptcha_izobrajenia_pohozhie_na (It's Russian, but it's still easy to figure out what happens)

As I said previously, I wouldn't trust these "Bots blocked" statistics from FunCaptcha at all. That said, FunCaptcha can't be solved by any CAPTCHA-solving service I've checked, so it should help to those that were really raided by bots. However sasa87it was clearly attacked by some bot and I think he was using FunCaptcha, so unless he made a mistake somewhere or was hacked, FunCaptcha can be bypassed somehow.

We're still working on more solutions to these problems.

What do you mean by "turn on"?


That's correct if there's no vulnerability that allows to bypass the captcha entirely.

Addresses are free, so a bot can just use 30 different addresses, one for each second. No single address will have withdrawals less than 30 seconds apart.

Addresses are free, so a bot can just use another set of 30 addresses after an hour.

There are many legitimate addresses like that, for example: 1BDSf6T17iCRFkSwXbWUFWqsr29j24KqGu . It's not a bot, owner of this address runs a very popular rotator. And there's a lot of rotators and faucets list etc, most of which have significant income.

Unfortunately your suggestions wouldn't help.

We really thought it through, there's not much we can do with our resources. We're preparing a service that will allow us to ban entire networks (like entire Amazon Web Services) from using faucets, but it'll take us a little while (we still need to figure a good way to detect and report new networks abused by bots) and even then it won't be perfect. They'll always be some cheap VPS provider that we didn't find.

To be honest I'm dissappointed. It's the CAPTCHA services duty to protect faucets from bots. Looks like they all fail to do that and they're only purpose is to annoy users...

Most bots attacking FaucetBOX.com faucets don't use Tor, but public clouds like Amazon Web Services.

What would you like me to do? Problems with bots were already covered in this topic multiple times, there's really nothing more I can add.

No, as you don't use CloudFlare. Using Faucet in a Box script behind a load balancer is a bad idea if you don't know what you're doing.

Also: I think that you weren't just hit by a bot, you were hacked, which allowed the attacker to bypass your faucet's security measures. Payments patterns looks way different when people are just hit by usual bots.


Trivia: yesterday we sent coins to over 16 thousands addresses. And that's just Bitcoin.

Your site is behind a loadbalancer. Have you done anything related to reverse proxy settings or IP detection?

Stop spamming. I'm investigating already.

I wouldn't really trust that stats. Most bots that are out there use real browsers and can't be detected as bots. Your spendings would have to drop about 75-80% after enabling Funcaptcha if these stats are real. Did that happen?

That can be an interesting discussion. So as you can see here: https://faucetbox.com/stats, 1.4% of all deposits is what we have to pay to the network as network fees (that's an average since the beginning, we manage to get it lower and lower with time). So you expect us to pay that 0.4% from our empty pockets. And then we have to pay for the servers, not speaking about any salary for us. You know, a powerful server for 6 daemon nodes, another powerful server to manage a few dozens of gigabytes of payouts data and a powerful server for a website. With 1.4% lost to network, 1.5% is what's left to us. For now, since the beginning of FaucetBOX.com, it equals to ~14 BTC. And that must be enough for tools we use, for couple servers and for couple people constantly developing a website, responding to support tickets and keeping it all together for about 10 months now. We basically run the service without any salary on our end, so if you think that could run something like this for 1% fee then I'd honestly love to hear suggestions (no irony here, really).