XF 2.2 dynamic avatar

[Opus X]

just want to confirm that dynamic avatars are based upon username and not email.
also if you have a default avatar assigned there should not be any avatar that looks like a dynamic one?
i am getting users registering that the so called dynamic avatar is based upon the email and not username so appears to be an uploaded one?
these avatars also appear to be upload ones to emulate what xenforo normally does.
i have a feeling these are spam programs that just have not come back but use a graphic avatar based upon the email used to look like a dynamic avatar.

 

[Jeremy P]

They're based on username, yeah. If they don't match it'll be a custom avatar, and anecdotally nearly every time I've seen this in practice it's been a spam account.

 

[Opus X]

thanks.
that is what i was thinking also.
especially with a defined avatar to use on the site that fits the topic.
a spammer trying to game the dynamic avatar system to blend in for some reason?
kind of stupid as it seems like it flags them more as they would not draw as much attention.
time to do some house cleaning.

 

[Jeremy P]

I've always suspected they might be completing registration with the connected accounts feature, where some providers like Google may set a similar looking default avatar. I've never really double checked this though.

 

[Opus X]

I've always suspected they might be completing registration with the connected accounts feature, where some providers like Google may set a similar looking default avatar. I've never really double checked this though.

i think you may be on to something.
every one i looked (23) at had a connected google account.

 

[Jeremy P]

Interesting, thanks for confirming my suspicion. That explains the avatars then, Google will set a default one based on the account name which then gets picked up by our connected accounts provider. I guess this makes it harder to assume they're spam though as it would affect anybody who registers via Google without a custom Google profile picture set.

 

[Opus X]

if i put them in a user state of email invalid bounced it should require them to confirm email again?
odds are if they are a spammer they do not have access to that account still.
it makes for an easy tell to spot.

 

[Jeremy P]

It would require them to confirm the email address, yeah. Though if they were able to register with the account to begin with they probably do have access to do so.

 

[Opus X]

it would be nice if the built in spam check against the configured systems checked bounced emails.
but i guess that might be over kill.