Is Bot: Registration Time Check

[calorie]

This mod calculates the time it takes to go between these two pages:

/forum/register.php?do=register
/forum/register.php?do=addmember

The point is to try and prevent bots from registering at your forum when the time between the two pages is humanly impossible, assuming that humans actually take the time to complete the registration page.

Should a user be blocked from registering at your forum, an email will be sent to your vB webmasteremail address and the user will see the vB noregister phrase message, so no screenshot is necessary.

[projectego]

Excellent idea - I'm sure this will make every admin's job alot easier! :)

[imported_Pigs]

Thanks,
Another cool tool..

[Distance]

Very good idea!! Excellent infact for sites that attract alot of bots

[KURTZ]

reserved :)

[Cyburbia]

Thanks! This has the potential to be a great mod. Here's my original post with the request:

I've discovered that the Xrumer/Botmaster spambots will submit register.php?do=addmember just seconds after register.php?do=register. While humans take a minute or more to fill out the registration form, bots do it instantly. Here's some evidence from my logs:

87.240.15.25 - - [16/Dec/2006:07:00:41 -0500] "POST /forums/register.php?do=register HTTP/1.0" 200 22180 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
87.240.15.25 - - [16/Dec/2006:07:00:45 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22579 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
87.240.15.25 - - [16/Dec/2006:07:00:49 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22576 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
87.240.15.25 - - [16/Dec/2006:07:00:57 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22579 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
87.240.15.25 - - [16/Dec/2006:07:01:00 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22579 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"

Note the times: 07:00:41, 07:00:45, 07:00:49, 07:00:57, 07:01:00. Five hits in 19 seconds.

Here's one that just rolled in a few seconds ago. The IP (193.69.180.120) is a Swedish proxy.

193.69.180.120 - - [16/Dec/2006:15:10:15 -0500] "POST /forums/register.php?do=register HTTP/1.0" 200 22177 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
193.69.180.120 - - [16/Dec/2006:15:10:19 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22860 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
193.69.180.120 - - [16/Dec/2006:15:10:22 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22861 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
193.69.180.120 - - [16/Dec/2006:15:10:25 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22861 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
193.69.180.120 - - [16/Dec/2006:15:10:29 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22860 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"

Five hits between 15:10:15 and 15:10:29 - 14 seconds.

I think that it attempts to break the captcha, fails, and tries again. After four or five failed attempts, the bot is programmed to give up and move on to the next victim.

Anyhow, I'd like to see a mod that prevents posting or submittal of register.php?do=addmember until a minute or more after it's been displayed. This might not stop Xrumer and other spambots, but it will slow them down; a way at getting back at them. The mod seems relatively simple, but I lack the skills to program it. Any takers?

EDIT: Yes, I know about the other hacks to prevent spam. I get very little spam on my board, thanks to a strong CAPTCHA and an extensive emailblacklist, among other security measures. I'm just looking to slow the bots down. If enough people install such a mod, we could dramatically slow the rate of spamming, and makethe bots less effective.

[Moparx]

This is an excellent idea.

[Snake]

That's excellent. Thanks! :)

[amagab]

Marvelous! I installed this mod and a couple of hours later I got a notification in my email about a spammer being prevented from registering. It took the spammer 4 seconds to go between the pages.....I don't know anyone that fast.

Bloody awesome!

Thanks!

[MichaelGoldman]

good idea, going to install now. Sick and tired of all the bots on my forum :D

btw, i think 15 sec is way too high.. it takes a bot less than a second to fill in the fields, decode captcha and press the submit button. :)

[scottct1]

Great if this works I nominate it as Mod of the Month. :D

[amagab]

Maybe I spoke too soon. This mod just blocked an attempt by a @ukr.net address and then one minute later that darn same person spammed my site.

How did that happen?

[amagab]

Maybe I spoke too soon. This mod just blocked an attempt by a @ukr.net address and then one minute later that darn same person spammed my site.

How did that happen?

Sorry, I just realized that spammer registered before I installed this mod.

Thanks!

[EyeCrave]

Installed

[amagab]

It's pretty cool. In the one day that I've had it installed, this mod has blocked about 12 spambot attempts. However, the last attempt took 14 seconds to move between the pages so I assume that if they change their spambot to 16 seconds they would make it through and then I would have to change the mod to a higher number.

Anyway, I love this mod. :)

[Brew]

I just received my first email about a potential spammer:

The following user name with email address was blocked by the Is Bot mod: osceshop - osceshop@cashette.com (XX seconds transpired)


Needless to say it's feels good that one didn't get away without getting trapped :)

Could you please add more info into the mails?

Maybe the IP addy? Resolved too perhaps?

Anything else you can think of as well ;)

Great mod dude...hats off to ya....

edit: how about auto ban too? or maybe posting to a special forum with the details as well?

[KURTZ]

just a question, 15 seconds are enough? maybe 20 are better?

[Caerydd]

Perhaps a way to change the time without re-importing the product every time?

Other than thank you very much, and installed!

[amagab]

Again, I have to give my many thanks to the developer of this Mod. It blocks about 8 spambot registrations a day on my site. I'm using a similar mod on my phpBB2 site and both mods have saved me and my moderators plenty of anguish.

[chick]

Good gawd... works awesome... even though I have other spam measures in place... they do not catch everything.

This mod, installed just 1 hour ago just caught me a mail.ru spammer.... Thank you.

The following user name with email address was blocked by the Is Bot mod: ivagsales - ivagsale@mail.ru (5 seconds transpired)

[Brew]

One more idea for this:

How bout the option to add Groups who receive the email too?

This is such a great mod I think it deserves a consideration for being part of the core vB.

:)

[KURTZ]

Good gawd... works awesome... even though I have other spam measures in place... they do not catch everything.

This mod, installed just 1 hour ago just caught me a mail.ru spammer.... Thank you.

have you settled the time to 5 secs instead 15?

[chick]

I left it at 15 seconds, and during the night, caught MORE.

The following user name with email address was blocked by the Is Bot mod: deosaest - deosaest@cashette.com (1 seconds transpired)

The following user name with email address was blocked by the Is Bot mod: presley - presley@meta.ua (2 seconds transpired)

The following user name with email address was blocked by the Is Bot mod: DosugXT - dosug-x@nm.ru (1 seconds transpired)

WOW I am so happy, these were getting by before and I am running 3 other mods to prevent spam but this one is catching them.

[chick]

I have to add this should be vb CORE as the other member stated above. This is fantastic. I am nominating for Mod of the month.

[everd]

also nominated for MOTM. catching 10 spammers a day.

[ConqSoft]

Nice mod. How long before the spammer applications start adding a delay though? :)

[chick]

3 more

The following user name with email address was blocked by the Is Bot mod: adultdvt - adult@spivare.com (2 seconds transpired)

The following user name with email address was blocked by the Is Bot mod: Kghikeds - nilucoqog@mail.ru (3 seconds transpired)

The following user name with email address was blocked by the Is Bot mod: FeregeRR - anlrei_izrazov@mail.ru (7 seconds transpired)

I love this mod.

[chick]

1,071 VIEWS of this mod and only 26 replies? wtf. This mod has made my day!!

[KURTZ]

finally INSTALLED ... :D

[richTV]

thank you. :)

just to verify....

after adding that line to the registration template and uploading the product, there is no listing of it in the vBulletins Options menu.

correct?

[amagab]

Yes, the only place I saw it was in the product listing.

[chick]

correct

[richTV]

thank you. :)

[chick]

This one didn't get by, it was blocked but the time factor of 13 seconds on this one concerns me. I wonder what a good time from would be to bump it from 15 seconds to 20 seconds?

The following user name with email address was blocked by the Is Bot mod: WebDocMan - webpharmastoreman@cashette.com (13 seconds transpired)

[amagab]

I haven't seen any spambot attempts the last few days (I had over 50 attempts the first two weeks) so I wonder if they are re-grouping and coming with a new attack.

[SVTOA]

This is a great idea.
What about also putting some sort of javascript timer in the registration agreement that generates a phrase that says something like "Unless you are Evelyn Wood, you could not possibly have read that agreement in such a short time! Please go back and read the registration terms before proceeding further"

[calorie]

Thanks for the thanks and nominations. :D

Maybe I'll add more info to the webmasteremail if I have the time. Anyway, just a tip... If you get a lot of the same domains showing up, go to vB Options -> User Banning Options and add the email there, if you want an added layer of protection from users/bots coming from those domains, just in case this mod doesn't stop them.

If you want to edit the seconds after import, just go to the Plugin Manager and edit the Is Bot plugin located at the register_addmember_process hook. There's no need to reimport each time. As for JavaScript, the bots probably ignore it so it'd have no effect on them.

[TTG]

Great addition .. clicked install

Thanks calorie

[KURTZ]

thx for the tip calorie :D

good job!

[chick]

Well I hate to tell you but the vb options are BS... I have all the above email Addy's in there, 3 fold, before I installed your program and they got by. So far your mod seem to work the best.

[Ramsesx]

One hour after install --> FreeMovies - weff90@mail.ru
Very useful hack, thank you. :)

[Betablocker]

Installed

Thank you

[amagab]

I don't know what I've done without this mod. It seem as though they don't bother one of my sites anymore but now their attacking one of my other sites.....good thing I have this mod installed there as well. :D

[Julie]

Looks like a cool thing. *Installed*

[TheFrienzNet]

Awesome, thanks!

[chick]

I don't know what I've done without this mod. It seem as though they don't bother one of my sites anymore but now their attacking one of my other sites.....good thing I have this mod installed there as well. :D

Isn't it awesome? I know I've made posts about this mod and I can't say enough. I catch 3 to 10 during each night with this mod.... while I'm sleeping the spammers around the world are at work.

[JWalker05]

Installed. Great mod. :up:

Has stopped 4 bots already...

My only suggestion would be to add the attempted registrants IP to the email.

Other than that. Thanks! :)

[chick]

My only suggestion would be to add the attempted registrants IP to the email.


IT IS in the email sent to admin... here is one

E-mail Address : cukr1@seznam.cz
Birthday : August 26, 1975
Referrer: N/A
IP Address: 195.47.51.92

[DaPro]

This mod does great work, absolutely a life saver. However, is there a way to STOP the emails?

[Kingzor]

This mod does great work, absolutely a life saver. However, is there a way to STOP the emails?


Goto the plugin manager find the hook on "register_addmember_process" by "Is bot" and change

vbmail($vbulletin->options['webmasteremail'], $isbot_subject, $isbot_message, true);


to


//vbmail($vbulletin->options['webmasteremail'], $isbot_subject, $isbot_message, true);


That should turn off emails.


Now I have a question to ask the author, would it be possible to make it so emails are only sent if the users emails aren't blocked?

[007]

Are there any admin settings for this mod or not? I didn't see any but wanted to check them out if they are there. :)

[Nathan2006]

Thanks calorie

Looks great!

Will give it a go :)

Install

[MarcG]

installed...waiting to see how many emails will be waiting! thxs for the work. :)

OMG! within a few minutes...AndresWer - insurance50megs@mail.ru (5 seconds transpired)
Thanks again for coming up with this!

[shasto100]

Thanks, installed :)

[beishe8]

IT IS in the email sent to admin... here is one

The following user name with email address was blocked by the Is Bot mod:
Bolivarus - bld@music06.info (-58 seconds transpired)

That is all in my email...

[glorify]

Nice work. Caught 5 in 8 hours.

Thank you.

[dooch]

Many thanks just what i needed!

[Cryo]

Great mod. Is there any way to change it from sending an email to sending the admin a PM? That would be a lifesaver for me.

[Gizmo999]

I've now started adding the mail domain used to my banned list, most seem to use a .ru or similar but i'm not getting the IP address in the email notification, what do I need to do to get this please?

[Webzcas]

Within 5 minutes of installing this mod on my two VBulletin Forums I got this email:

The following user name with email address was blocked by the Is Bot mod: wiolafronn - wiolafronn@inmail24.com (5 seconds transpired)

This is so going to help my forum moderators!

[Rogue_SSEi]

Been looking for help against all the spammer bots and this looks like it help tremendously. Our rate of spam registrants has been slowly climbing even with all the blocks in place.

Installed :)

[oldford]

IT IS in the emailThe IP isn't in my emails either. Has this mod been updated recently to add the IP addresses?

Great hack BTW. I catch 6-10 a day.

[MikaP]

very great mod, thanks for it ;)

[Guest210212002]

Any chance of getting this to post to a forum when blocked, like the AE detector, rather than via email?

[WATRD]

Suppose I wanted to change the address that the mail from this mod goes to, but didn't want to change my admin mail...

I see the operative line;

vbmail($vbulletin->options['webmasteremail'], $isbot_subject, $isbot_message, true);

How would I format hardcoding foo@foo.com in place of the 'webmasteremail'?

[WATRD]

Suppose I wanted to change the address that the mail from this mod goes to, but didn't want to change my admin mail...

I see the operative line;

vbmail($vbulletin->options['webmasteremail'], $isbot_subject, $isbot_message, true);

How would I format hardcoding foo@foo.com in place of the 'webmasteremail'?


Got it.

vbmail("foo@foo.com", $isbot_subject, $isbot_message, true);

Allows the mail to go to foo@foo.com instead of the webmaster mail. We have the webmaster mail set up to go to a bit bucket, so that wasn't working for us.

[sph33r]

I have to praise this mod.. I switched over from phpbb over the weekend and I haven't had a bot sign up yet. I love it! Excellent work!

[TuTu]

I just wanted to add my thanks for this mod. This has saved us heaps of time.

[J.R. Rogers]

Excellent mod, THANKS!

What is the possibility of having this mod automagically update the vB banned email domain list with the attempted email address?

[itorrents]

thank you :)

[3z3k3l]

Wow, Within 5 minutes of installing this mod I got this email:

The following user name with email address was blocked by the Is Bot mod: Mellisa - margo77@web.de (8 seconds transpired)

I love this thing!!!!


I get 10-20 new sign ups a day, I wonder how many of them are bots.... I guess I will start to find out.

[J.R. Rogers]

:confused: Looking for some help. Installed this mod but nothing is happening. No emails and spammers are still getting through. I just ran an email test using the vbulletin diagnostics (set to email admin) and got the email fine. What am I doing wrong here? :confused: :confused:

[3z3k3l]

you may have spammers already signed up posting stuff...

[barnie]

Thank You soooooo much for this mod. It works fantastic. As like everyone else posting it stops like 5-10 a day on my site.

Thanks again as I really appreciate it. I was starting to get really annoyed with the number of spammers signing up constantly.

Cheers,

Steve

http://www.edmontongolf.com

[J.R. Rogers]

you may have spammers already signed up posting stuff...

No, these are new ones landing in the moderation queue. I have all new registrations going to that queue. Apparently this mod doesn't work if new registrations go into the moderation queue. :(

[bplinson]

Works great!!

I just got this email message sent by the product:

The following user name with email address was blocked by the Is Bot mod: samalvado - omega384@mail.ru (1 seconds transpired)

[Pottsy]

Likewise here. Been troubled recently by lots of bot registrations, and this mod is catching them all.

Thank you!

[amagab]

I think 1 out of 10 spambots slip by this plugin but that it not a bad thing. It's hard to beat them all and this plugin is as close as it gets. I run several sites and all together this plugin has stopped over 500 spambot registrations the last few months.

Best vB plugin available.

[almightyone]

it has got all mine for a little while now i am sure as traffic grows and more people find my forums some will get by would be nice if it logged the ip and sent it

[quiklink]

Woot! Caught my first one, but no IP. Nice mod, thanks!

[Pottsy]

A quick question - does the email come for registration attempts that may have been otherwise (captcha) unsuccessful?

[AnaB]

sounds like a great mod. I'm installing it. Getting sick of spam registrations here.

[quiklink]

It works great! Blocked 72 of em in the past 5 days since I installed it. Most of them from Russia.

[Paul M]

A quick question - does the email come for registration attempts that may have been otherwise (captcha) unsuccessful?Yes.

[v12kid]

installed, will monitor to see what it catches :)

[Torqued]

Excellent mod. I caught 10 spambots in the 1st 24 hours this mod was running.

I'd like to add another vote for including the IP address in the email - it would be nice to know if I'm getting spambots repeatedly from an ip address or ip range.

[Torqued]

Excellent mod. I caught 10 spambots in the 1st 24 hours this mod was running.

I'd like to add another vote for including the IP address in the email - it would be nice to know if I'm getting spambots repeatedly from an ip address or ip range.

Bumping to see if the author or anyone else could add IP address to the email?

I tried adding it, but I apparently didn't do it right.

I'm getting about 10-15 spambots/day and I suspect many of them are coming from the same ip addresses/ranges. It would be nice to be able to identify and block those IPs. :D

[WreckRman2]

Bumping to see if the author or anyone else could add IP address to the email?

I tried adding it, but I apparently didn't do it right.

I'm getting about 10-15 spambots/day and I suspect many of them are coming from the same ip addresses/ranges. It would be nice to be able to identify and block those IPs. :D

This is exactly what I was hoping to see added... then we can block that IP. It would be great if that the system automatically added the IP to the blocked list. Is this possible?

[webgod]

To include the IP in the email.

Go to the Plugin Manager in your AdminCP
Click edit for "register_addmember_process" under Is Bot product

Find:
$isbot_email = htmlspecialchars_uni($vbulletin->GPC['email']);Below it add:

$isbot_ipaddy = IPADDRESS;next find:
. ' (' . $isbot_timediff . ' ' . $vbphrase['isbot_seconds_transpired'] . ')';REPLACE it with:

. ' (' . $isbot_timediff . ' ' . $vbphrase['isbot_seconds_transpired'] . ')'
. ' The IP Address is: ' . $isbot_ipaddy ;

[Torqued]

webgod:

Thanks, I'll give this a shot.. I just had a bot try to register 8 times w/ the same email address. :mad:

[webgod]

webgod:

Thanks, I'll give this a shot.. I just had a bot try to register 8 times w/ the same email address. :mad:

this is the email contents you should see:
The following user name with email address was blocked by the Is Bot mod: Reporter - asxosoooxoux@mail.ru (4 seconds transpired) The IP Address is: 87.118.102.23

if there's enough interest, I could modify it so the IP is added to the Ban IP list

[Torqued]

this is the email contents you should see:


if there's enough interest, I could modify it so the IP is added to the Ban IP list

webgod:

I don't know if autobanning them would be such a good idea. While I've had a ton from .ru and .ro domains, I have also had a fair number from domains like comcast.com and other "valid" ISP's.

Thanks for the IP addy modifications, though... it's working great!!!!!! :up::D

[webgod]

webgod:

I don't know if autobanning them would be such a good idea. While I've had a ton from .ru and .ro domains, I have also had a fair number from domains like comcast.com and other "valid" ISP's.

Thanks for the IP addy modifications, though... it's working great!!!!!! :up::D

The IP address that is listed, is the address of the user's PC and is almost never related to their email domain.. unless they are registering directly from their email server (not possible with apublic company like comcast, et all.)

[quiklink]

The IP address that is listed, is the address of the user's PC and is almost never related to their email domain.. unless they are registering directly from their email server (not possible with apublic company like comcast, et all.)

True, but it's quite often a non-static IP address that they are using. So the IP they have today isn't necessarily the one they are using tomorrow, making IP bans useless in that case and risking locking out non-offenders instead.

[Centrix]

Let me get this straight

this prevents those bots who post loads of links to viagra sites and stuff to register on my site? those things annoy me so badly

[almightyone]

Let me get this straight

this prevents those bots who post loads of links to viagra sites and stuff to register on my site? those things annoy me so badly

it times how long it takes from one page to the enxt to complete the registration and if it is under 15 seconds it blocks them a human can not fill the forms in as fast as a bot does

[stratisdan]

Let me get this straight

this prevents those bots who post loads of links to viagra sites and stuff to register on my site? those things annoy me so badly

Really. I'm installing this mod now.

[webgod]

True, but it's quite often a non-static IP address that they are using. So the IP they have today isn't necessarily the one they are using tomorrow, making IP bans useless in that case and risking locking out non-offenders instead.


That's exactly why I'm not a big fan of IP banning, unless you IP WHOIS and find that it's a static IP.


I'd say 90% of residential internet users have a Dynamic IP (changes frequently) so IP banning isn't very useful.

[webgod]

Well the Bots are getting smarter.:mad:


just had the following occur:

@ 7:52am CST:
The following user name with email address was blocked by the Is Bot mod: jaulovvoys - ulovvoys-1@1chuan.com (5 seconds transpired) The IP Address is: 124.154.185.4


@ 7:56am CST:
The following user name with email address was blocked by the Is Bot mod: jaulovvoys - ulovvoys-1@1chuan.com (6 seconds transpired) The IP Address is: 122.145.38.99


@ 7:58am CST
There is a new user, jaulovvoys



Email Address : ulovvoys-1@1chuan.com
IP Address: 172.179.223.47



He got through.. note the IP address is different for all three attempts!

[perfphysio]

excellent idea indeed. This combined with the alternate to captcha mod is going to make my life sooooooooo much easier. No more free mobile phones, playstations and friggen discounted nike trainers. Well at least I hope so.

Congrats on making this great addition :)

[Brew]

Well the Bots are getting smarter.:mad:


just had the following occur:

@ 7:52am CST:


@ 7:56am CST:


@ 7:58am CST



He got through.. note the IP address is different for all three attempts!

I figured it would only be a matter of time.

At least you KNOW this user is a spammer or at least a very potential one. I'd ban him straight away.

[kira]

This is excellent, calorie, thank you so much. In the last five days it's prevented 35 bot registrations. I moderate all new registrations, and it's a pleasure to have saved so much time now that I don't have to check on as many fishy new users.

Three cheers to you! :)

[stratisdan]

This is excellent, calorie, thank you so much. In the last five days it's prevented 35 bot registrations. I moderate all new registrations, and it's a pleasure to have saved so much time now that I don't have to check on as many fishy new users.

Three cheers to you! :)


Ditto. It's made it much easier to combat the spam bots. :up:

[Munro]

I love this hack. It's blocked over 800 signups in just one month. One suggestion I would like to make is for the blocked email addresses to be automatically added to the ban list.

[Pottsy]

I love this hack. It's blocked over 800 signups in just one month. One suggestion I would like to make is for the blocked email addresses to be automatically added to the ban list.

This to me makes a lot of sense. I only have 280 or so a month - but just occasionally some keep trying until they get through. If someone uses a bot to have a go at my site just the once, then I'm happy to block that email account for ever!

[Torqued]

Looks like the bots are trying to get smarter:

Blocked by IsBot:: omicheBiope - rxvcujbver6_12@mail.ru (rxvcujbver6_12@mail.ru) (1 seconds) The IP Address is: 204.11.33.94 (http://204.11.33.94/)
Blocked by IsBot:: omicheBiope - rxvcujbver6_12@mail.ru (rxvcujbver6_12@mail.ru) (2 seconds) The IP Address is: 204.11.33.94 (http://204.11.33.94/)
Blocked by IsBot:: omicheBiope - rxvcujbver6_12@mail.ru (rxvcujbver6_12@mail.ru) (5 seconds) The IP Address is: 217.197.114.13 (http://217.197.114.13/)
Blocked by IsBot:: omicheBiope - rxvcujbver6_12@mail.ru (rxvcujbver6_12@mail.ru) (7 seconds) The IP Address is: 203.64.120.192 (http://203.64.120.192/)
Blocked by IsBot:: omicheBiope - rxvcujbver6_12@mail.ru (rxvcujbver6_12@mail.ru) (2 seconds) The IP Address is: 201.130.192.36 (http://201.130.192.36/)
Blocked by IsBot:: omicheBiope - rxvcujbver6_12@mail.ru (rxvcujbver6_12@mail.ru) (5 seconds) The IP Address is: 201.130.192.36 (http://201.130.192.36/)
Blocked by IsBot:: omicheBiope - rxvcujbver6_12@mail.ru (rxvcujbver6_12@mail.ru) (13 seconds) The IP Address is: 211.99.194.151 (http://211.99.194.151/)

[kira]

Ooh creepy, Torqued -- that same bot hit my forum this morning too, at 6:21 EST, trying five times to get past IsBot.

But IsBot vanquished it! Yay for IsBot. :)

[BillP]

Installed it on Pirate4x4.com and perfectunion.com, great mod!

[jasculs]

This is seriously the best mod ever...Everyone needs to install this mod because it has saved me a ton of headaches already with spammer....I don't get any spammers anymore really...How this mod was never nominated for "Mod of the Month" yet is beyond me.

*Nomitated*

[BillP]

Same from me. I administer two sites, one small and one huge, and it's stopping 95-98% of the spammers dead in their tracks.

:up::up::up:

[wilburshere]

question im still getting bots

once you import xml file what do ya do next there is no install instructions that i can see

[michael_S]

Installed! I am really liking this mod. Blocked 5 bots today. They were getting pretty bad for a while there. This has slowed it down a bit for me. Thanks a lot.

[David Bott]

I just installed this on AVSFORUM which is ver 3.6.8. I have not read anything on ver 3.6.8 here thus am I wondering....Will it work? :) I did a test register and the registration did work, but I am not fast enough to test it as me looking like a BOT. :)

So, thoughts on 3.6.8?

[michael_S]

Yes, I have it installed and working on 3.6.8

[wilburshere]

:eek::eek: found it cool works now need to edit template :up::up:

[kira]

Still working splendidly for me. But I have a question. I don't really need to see the "User Blocked" email. Is it possible to turn off email notifications? (Or is there some reason this might be unwise?)

I think it would be great if there were some way to choose how to get notified of these attempts -- perhaps in addition to email notification, another option might be writing to a log file.

Anyway it's just a minor annoyance, and if turning off notification isn't possible, I can always continue to delete the messages. More importantly, I really can't praise this mod enough. It's stopped hundreds of spambots from signing up on my forum. Thanks again, calorie!

[misuse]

Working awsome! Lets hope the bots don't figure out how to slow down...

[Hicksatpd]

Great idea, but if I'm the guy who makes spam bots, and I pick up on this, I tell my spam bots to take 120 seconds to register.....

[beishe8]

Great idea, but if I'm the guy who makes spam bots, and I pick up on this, I tell my spam bots to take 120 seconds to register.....

120 seconds to register and leave the posts after that period?
Would not be practical...
1 000 forums * 120 seconds = 120 000 seconds
120 000 / 3 600 = 33.33 hours

Hit and run is very important for them.

[beishe8]

...I did a test register and the registration did work, but I am not fast enough to test it as me looking like a BOT. :)

1) The default time difference is set to 15 seconds. If you want to change that time to
something else, open the product-isbot.xml file, look for the following line, and change
15 to some other number in seconds:

if ($isbot_timediff <= 15) // difference in seconds

Are you fast enough to register in ~149 seconds? :)

For the testing purpose make it ~150

[beishe8]

Those guys with the bots are reading this forum...
15 seconds not sufficient any more.
New registrations appeared on our forum with Polish (Warszawa) IPs.
25 seconds did the trick:

The following user name with email address was blocked by the Is Bot mod:
therrorne - ***********@********.pl (16 seconds transpired)

Edit:
Looks like I have to change my opinion about that 120 second...:o
The following user name with email address was blocked by the Is Bot mod:
Illereuct - homionelm@gawab.com (24 seconds transpired)

[BaconDelight]

Well, it's working like magic at my forum, and I've got it set to 4 seconds. Not only is it blocking bots, after having it installed for 3 months, I've actually stopped receiving attempts at all!

Before installing this mod, I was getting ~20-30 bot registrations per day, and was getting 15-20 blocked attempts when I first installed it. Now I literally get none.

True, I also switched to the more advanced version of the image verification, but this mod definitely aided in a big big way.

[pitzerwm]

I'm new, to VB so a noobie question. How does the bot get past the email confirmation requirement before posting?

[KURTZ]

The following user name with email address was blocked by the Is Bot mod: VerftgMtyff - tdutyyuttd@inet.ua (1 seconds transpired)

superb!

[BaconDelight]

I'm new, to VB so a noobie question. How does the bot get past the email confirmation requirement before posting?
For the most part they can't, but there are mods that open up some holes in the permissions that can allow them to do so.

But even assuming the email verification is working 100%, their accounts still get created, leaving the job of clearing out all of those stupid users. This mod prevents them from even getting that far.

[KURTZ]

another one ...

The following user name with email address was blocked by the Is Bot mod: FrthGtery - gfghdfhgdfhg@inet.ua (1 seconds transpired)

[Quarterbore]

I am been fighting a serious issue with a underdeveloped site that the bots took control of without me noticing.... One of the ways I have been fighting this has been to log registration attempts.

Attached is the registration log for about 7-days on one of my sites... Note, each one of these registration failues would have been one to many spam posts! Note that the time posted in this is the registration times! Also note I am using the NoSpam question hack as well as several other hacks as well. Also, my list of banned e-mail and IP addresses is huge but they still keep comming!

I have a thread with what I am trying to look at the following link to see if there are other ways we can make the spammers life much more difficult!

https://vborg.vbsupport.ru/showthread.php?t=158544

[primesuspect]

Excellent mod, I use it on all the sites I administrate. Thank you very much for making our lives that much easier!

One request I have is the ability through GUI to change the email address or turn off entirely the ability to email the administrator when a bot is blocked. On some of my sites I am getting over 50 a day and the emails are annoying. :)

Keep up the good work!

[kira]

One request I have is the ability through GUI to change the email address or turn off entirely the ability to email the administrator when a bot is blocked. On some of my sites I am getting over 50 a day and the emails are annoying. :)

Seconding this! (Actually I mentioned this earlier too.)

Question to those who know PHP better than I do (which is, like, almost everyone here!): as a temporary fix, would commenting out the following line in the product help to stop the email notifications?

vbmail($vbulletin->options['webmasteremail'], $isbot_subject, $isbot_message, true);

I'm thinking of trying it but I don't want to break the product and cause a flood of bot registrations again.

[TheMilkCarton]

This can return a false positive if somebody messes up their registration info, gets an error message, clicks back, and then quickly changes whatever was wrong and hits Submit again.

However, installing the AjaxReg hack has helped this infinitely, since it uses AJAX to check every field. I do have one field though that requires A-Z input, and I'm thinking about removing it from the registration page so that this won't happen EVER.

Is there any way to keep the time from recounting itself if a user were to click back upon getting an error message?

What about putting is_bot_time1 on the Verify Age page instead? If a user clicks back to fix an error, the time won't be recounted anymore. The only problem I can see is if a bot could keep clicking back and then they'd go past the time limit, but I'm not sure how bots handle an error message?

I was also thinking how does this work with "Time Zone Registration Prevention" hack? I thought about changing the execution order so this hack goes first..

--------------------------

Well, I changed the execution order of that hack to go after this one.. but I can't really test it out since I'm not a bot.. :)

I do want to say that I think this mod is great. In the past 11 hours it has blocked 30 registrations, although CAPTCHA would have stopped all of these. HOWEVER, for the sake of testing this I've disabled CAPTCHA on the registration page! I have a few other measures in place though, so I really doubt any bots are going to get through even with CAPTCHA disabled. If all goes well over the next few days I may keep CAPTCHA disabled entirely.. I think not having CAPTCHA makes the registration page a little less daunting, especially with the settings I had for it. (I could hardly ever read the letters myself!).

I was thinking about possible expansions to this mod... How hard would it be to add a query that updates the "Banned Email Addresses" field with the domain of the spammer when they've been denied registration? It would of course check to make sure it's not already listed, it could be turned on/off, and also have a whitelist of emails NEVER to ban, like @gmail.com or @yahoo.co.uk. I've been brainstorming and it doesn't seem that hard to do.. I think adding a query right to the register_addmember_process plugin could work. The value for the email is passed through that plugin, and that's all we'd need to write an UPDATE query to add the email.

------

Haha, in the time it took me to edit this it blocked another spammer. :)

[TheMilkCarton]

Well, this mod seems pretty dead, and I doubt the dev would add this to the actual product, but I thought it was important to show the IP.

Change register_addmember_process to:

$vbulletin->input->clean_array_gpc('p', array(
'isbot_time1' => TYPE_UINT
));

if ($vbulletin->GPC['username'] && $vbulletin->GPC['email'])
{
$isbot_time1 = $vbulletin->GPC['isbot_time1'];
$isbot_time2 = TIMENOW;
$isbot_timediff = intval($isbot_time2 - $isbot_time1);

if ($isbot_timediff <= 15) // difference in seconds
{
$isbot_username = htmlspecialchars_uni($vbulletin->GPC['username']);
$isbot_email = htmlspecialchars_uni($vbulletin->GPC['email']);

$isbot_subject = $vbphrase['isbot_user_blocked_from_registering'];
$isbot_message = $vbphrase['isbot_the_following_name_email_blocked']
. ': ' . $isbot_username . ' - ' . $isbot_email
. ' (' . $isbot_timediff . ' ' . $vbphrase['isbot_seconds_transpired'] . ')';
$isbot_message .= "\n\r\n\rAttempt was made from: ". IPADDRESS ."";

vbmail($vbulletin->options['webmasteremail'], $isbot_subject, $isbot_message, true);

eval(standard_error(fetch_error('noregister')));
}
}

I think it helps decide whether or not I should just give in and ban a certain IP range.. my forum isn't exactly international so it really doesn't matter to me. I also think the IP in combination with the other things in the email will help you decide if it's a bot or if it's legit, since the problem I described in the post above can possibly lead to a lot of false positives.

[GrendelKhan{TSU]

wow sounds like just what I need!! thanks (don't know how I missed this!)

[BadgerDog]

There are three (3) register templates with the phrase:

<input type="hidden" name="url" value="$url" />

Which is the correct one to add th new text line after?

Thanks ... :)

Regards,
Badger

Edit: Ignore question. As a test, I added it to the template called "register" only and it must have worked, as after about an hour, I got this:

The following user name with email address was blocked by the Is Bot mod: mubssnono - jastyfestap@mail.ru (2 seconds transpired)

I have the setting at 5 seconds. Is that about right based upon what I've been reading here?

[mystic10]

how do i edit..when i click on on the xml it shows all the codes but i cant edit them

[mystic10]

where do i exactly put this sorry not sure where to put please guide:

Change register_addmember_process to:

PHP Code:
$vbulletin->input->clean_array_gpc('p', array(
'isbot_time1' => TYPE_UINT
));

if ($vbulletin->GPC['username'] && $vbulletin->GPC['email'])
{
$isbot_time1 = $vbulletin->GPC['isbot_time1'];
$isbot_time2 = TIMENOW;
$isbot_timediff = intval($isbot_time2 - $isbot_time1);

if ($isbot_timediff <= 15) // difference in seconds
{
$isbot_username = htmlspecialchars_uni($vbulletin->GPC['username']);
$isbot_email = htmlspecialchars_uni($vbulletin->GPC['email']);

$isbot_subject = $vbphrase['isbot_user_blocked_from_registering'];
$isbot_message = $vbphrase['isbot_the_following_name_email_blocked']
. ': ' . $isbot_username . ' - ' . $isbot_email
. ' (' . $isbot_timediff . ' ' . $vbphrase['isbot_seconds_transpired'] . ')';
$isbot_message .= "\n\r\n\rAttempt was made from: ". IPADDRESS ."";

vbmail($vbulletin->options['webmasteremail'], $isbot_subject, $isbot_message, true);

eval(standard_error(fetch_error('noregister')));
}
}

[BadgerDog]

Well, this mod seems pretty dead, and I doubt the dev would add this to the actual product, but I thought it was important to show the IP.

Change register_addmember_process to:

Thanks ... :up:

I made that change completely replacing existing plugin code with yours....

Regards,
Badger

[TheMilkCarton]

Mystic, You edit the plugin after it's been installed. Go to the Plugin Manager.

Badger, 5 seconds is extremely low. I constantly have bots taking up to 14 seconds (I have it set at 15), and my other hacks catch the rest that take over 15 seconds.

[BadgerDog]

Mystic, You edit the plugin after it's been installed. Go to the Plugin Manager.

Badger, 5 seconds is extremely low. I constantly have bots taking up to 14 seconds (I have it set at 15), and my other hacks catch the rest that take over 15 seconds.

Roger that ... :up:

I'll raise it to 15 seconds....

BTW, what other hacks to you use to catch the rest?

Thanks .. :)

Regards,
Badger

[mystic10]

thanks milkcarton very kind of you to reply

[Lionel]

if there's enough interest, I could modify it so the IP is added to the Ban IP list

That would be great to auto ban both IP and email address. Because they keep on trying over and over. I've got mine set at 5 seconds. The way those bots seem to work, they try first, then they retry with a delay. If they get banned the first time, then all would be good.

[Lionel]

ok, this is how I auto ban them. I set mine to 5 seconds

In the Is Bot plugin at register_addmember_process, right before

eval(standard_error(fetch_error('noregister'))); Put$db->query_write("UPDATE " . TABLE_PREFIX . "setting SET value = IF(value <> '', CONCAT(value, ' ', $isbot_ipaddy) WHERE varname ='banip'");

$db->query_write("UPDATE " . TABLE_PREFIX . "datastore SET data = IF(data <> '', CONCAT(data, ' ', $isbot_email) WHERE title ='banemail'");And let them try again with a longer time frame :-)

[TheMilkCarton]

You must have fast bots because mine usually take over 5 seconds on the *first* time.

After studying over 200+ of the last few days' attempts, I've realized it's meaningless to ban a specific IP or a specific email.. They ALWAYS change and even if they do re-attempt it's always from a different IP.

After getting several hundred attempts, I've also realized they are ALL covered by already very comprehensive banlist, and they ALL register from a specific timezone... so I might set the Execution Order of the timezone registration prevention hack higher than this, just so I don't get so many freaking emails.

What I have noticed is that there are a few select bots that always attempt with the exact same username. I'm already blocking them otherwise, so it's pointless to try banning them by username, though.

Also, Lionel...

Do you keep CAPTCHA on with all the options enabled? This mod isn't really doing anything for you then.. :p Probably 50% of your bots are taking over 5 seconds to register, and the thing that's keeping them from your forum is the CAPTCHA. I guess it can be useful with the things you've added to it, but you're probably getting a bunch of useless emails (unless of course you turned those off).

I, on the other hand, have disabled CAPTCHA (to make registration easier!) and with my suite of mods I've managed to avoid several hundred attempts in the past few days! I let one slip through on purpose to test my anti-spam mods, and those work well, too. :)

[Mr.Sinnev]

Eine gute sache!!!Bis jetzt funktioniert er einwandfrei....Danke:up:

[Saviour]

Installed on 3.6.8 PL2 with CAPTCHA enabled...we'll see what's what...and post accordingly.

Thanks for this hack.

[mano1.com]

could you tell em if this works on 3.5.4?

thank you!

[fringehead]

Hi there,

I installed this mod and haven't gotten a single email yet I have had several bot signups. Is there anyway to check if this is working? I'm using 3.6.8 Patch Level 2.

Thanks,

Sean

[amagab]

Really strange, did the bots stop? I had this mod installed for several months and I was blocking about 10-20 bots every day. Now I dont get anymore emails about blocked bots? Anyone else experiencing this?

[fringehead]

Hi there,

I installed this mod and haven't gotten a single email yet I have had several bot signups. Is there anyway to check if this is working? I'm using 3.6.8 Patch Level 2.

Thanks,

Sean

Sorry I didn't do the template mod so I should be set now!

[leitel]

Thank you for such a useful mod. Even with captcha and random reg questions, I was STILL getting bot registrations!!!!

With this mod I am trapping several bot attempts daily.

Thanks! :)

[fringehead]

IsBot is an awsome MOD! It blocked 12 bots today and we still have 5 hours left! I think the bot traffic is increasing.... Definitely a very useful tool!!

Sean

[juan71287]

Question: Instead of blocking the user, can we get a PM telling us who the user is? Cause eventually they will just delay the bots.

Thanks.

[ribone]

Thanks, this add-on is great and saving me some 30 - 60 minutes a day in admin time which I spent deleting 'spam' members.

[tamiyausa]

This has to be the bast Hack I have installed so far in 10 days it has stopped 200+ bots from registering!

[rurbaniak]

Great hack, saving me lots of time and effort, thanks a lot!

[Simon Moon]

As simple as this is, it saves a TON of time and has stopped pretty much all automatic spam bots. Thanks a lot!

[Aldarow]

This mod is a blessing from the skies!

One question, though - any chance to disable the "user blocked" e-mails?

[Simon Moon]

This mod is a blessing from the skies!

One question, though - any chance to disable the "user blocked" e-mails?

Just comment out the mail sending line in the plugin and you are good.

[beishe8]

This mod is a blessing from the skies!

One question, though - any chance to disable the "user blocked" e-mails?

Oh I love those emails ! I would not disable it for a thousand dollars!
I have a filter which transfers all of them to a folder.
When I see that some of them is near the time limit: increase it.
From Ukraine and Poland: They are relatively slow.10-24 secs.
Russia: The best! 1-5 secs.

[Simon Moon]

Tweaking the timer is not a too good idea. If you make it too long, you will start catching legit users. In other words be very very careful with it.

[Aldarow]

Just comment out the mail sending line in the plugin and you are good.

I'm guessing that's the line that starts with "vbmail".

Yeah, I enjoyed those e-mails at first as well (serves you right, spammers!), but then me and the mails have decided to part ways :)

[tpn87]

Wow... this plugin has saved me so much time with bogus registrations. Thanks so much for this!

[KURTZ]

i still love this mod! :P

The following user name with email address was blocked by the Is Bot mod: AllAdobeOEMSoftDownload - somesingoemforu@gmail.com (1 seconds transpired)

on Beta 4!

[WreckRman2]

ok, this is how I auto ban them. I set mine to 5 seconds

In the Is Bot plugin at register_addmember_process, right before Put$db->query_write("UPDATE " . TABLE_PREFIX . "setting SET value = IF(value <> '', CONCAT(value, ' ', $isbot_ipaddy) WHERE varname ='banip'");

$db->query_write("UPDATE " . TABLE_PREFIX . "datastore SET data = IF(data <> '', CONCAT(data, ' ', $isbot_email) WHERE title ='banemail'");And let them try again with a longer time frame :-)

Exactly what I was hoping for however when I add this code it returns an SQL error:

Database error in vBulletin 3.6.4:

Invalid SQL:
UPDATE setting SET value = IF(value <> '', CONCAT(value, ' ', ) WHERE varname ='banip';

MySQL Error : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') WHERE varname ='banip'' at line 1
Error Number : 1064
Date : Wednesday, February 13th 2008 @ 12:16:03 AM
Script : http://rchangout.com/forums/register.php?do=addmember (mhtml:{AA30B5E0-9CB8-4E4E-9150-9044267AEF47}mid://00000323/!x-usc:http://rchangout.com/forums/register.php?do=addmember)
Referrer : http://rchangout.com/forums/register.php (mhtml:{AA30B5E0-9CB8-4E4E-9150-9044267AEF47}mid://00000323/!x-usc:http://rchangout.com/forums/register.php)
IP Address : 64.184.169.176
Username : Flienceintito
Classname : vB_Database

[WreckRman2]

I'm not sure what IF(value <> '', does however I got errors from it.

I also had to change $isbot_ipaddy to $isbot_ip

I then had to change $isbot_ip to '$isbot_ip' , otherwise it would return an error splitting up the IP address.
------

So I ended up with this and it works fine... Thanks!

$db->query_write("UPDATE setting SET value = CONCAT(value, ' ', '$isbot_ip') WHERE varname ='banip'");

[Boofo]

i still love this mod! :P

The following user name with email address was blocked by the Is Bot mod: AllAdobeOEMSoftDownload - somesingoemforu@gmail.com (1 seconds transpired)

on Beta 4!

With the reCAPTCHA, is this still needed on beta 4? And what is your time setting at?

[KURTZ]

With the reCAPTCHA, is this still needed on beta 4? And what is your time setting at?

yes, i've reCAPTCHA enabled, and you just saw that this hack still blocks "something" ... damn i don't remember the time that i've settled ... maybe 5 or 3 seconds ...

[Boofo]

With reCAPTCHA, I doubt they would have gotten through. I have Guests sitting at "Registering" constantly in the Who's Online but no one has registered that wasn't legit.

[KURTZ]

Bobby i don't know ... you can see what's happened on my site ...

[KURTZ]

other two blocked ... :D

The following user name with email address was blocked by the Is Bot mod: AnaebSpone - anaebspone@loanforums.biz (0 seconds transpired)

The following user name with email address was blocked by the Is Bot mod: sombdodablaby - inefarege@bk.ru (3 seconds transpired)

[Boofo]

I think what is happening is this hack is catching them before they have a chance to go at reCAPTCHA. If you didn't have this installed, reCAPTCHA would stop them, if you have it enabled. It never hurts to have 2 lines of defense. ;)

[Eagle Creek]

Although the idea looks nice I'm affraid it will block real members. What do you consider 'impossible'?

[KURTZ]

I think what is happening is this hack is catching them before they have a chance to go at reCAPTCHA. If you didn't have this installed, reCAPTCHA would stop them, if you have it enabled. It never hurts to have 2 lines of defense. ;)

trust me, i've reCAPTCHA enabled, and like you say, i've never got troubles with the bots ... i've installed this hack only cause i remember the great job that it does on the 3.6.x version ... however, maybe you're right Bobby ... i'm not an expert ... :)

[cmedic101]

Great Job!! Thank you

[AdrianH]

Although the idea looks nice I'm affraid it will block real members. What do you consider 'impossible'?

I have this installed alongside No Spam and Guest Tracking, I see dozens of bots a day trying to register and fail, it has never stopped any genuine member signing up.

My forum used to be on phpbb software and with all mods available I was spending hours a week killing spammer/bot accounts........ Not one single spammer/bot has succeeded in signing up with this mod installed.

[Saviour]

I use this mod, as well. Stops quite a few bots...every day.

Let's say...in the worst case scenario...that it did happen to block a new member. That person has the opportunity to use your contact form to let you know about any registration issues they may be having. Do you think a bot that keeps getting blocked is going to contact you and say..."Hey, I want to spam your site, but I'm having a helluva time trying to register."

This mod is the best thing since sliced bread...and I mean that most sincerely...

[Critterracing]

hi everyone
i stumbled across this post in hopes of finding a fix to these bots. ive been trying to get it installed to no avail.

can someone help with the installation of this mod?

thanks
Aldo

[bainsey]

this is the best spam bot, we had a bug in one plugin so installed one by one, since we disabled this we have 10 new porn accounts a day, got to get this back in place :D

[tpearl5]

Since installing this hack in feb 2007 it has blocked over 11,000 bots!!

I'm currently testing it out on 3.7.

[J105C]

Since installing this hack in feb 2007 it has blocked over 11,000 bots!!

I'm currently testing it out on 3.7.
Where do you find that information? I cannot seem to find anything under ACP for this hack either.

[sdavis2702]

This just might be the most excited hack I've installed! Great job!

[dave9720]

Installed this mod on my forum, Unable to stop the bots. 95 in the last 24 hours. I checked to see if this mod was on and adjust time to 30 secs. Any help would be appreciated.

$vbulletin->input->clean_array_gpc('p', array(
'isbot_time1' => TYPE_UINT
));

if ($vbulletin->GPC['username'] && $vbulletin->GPC['email'])
{
$isbot_time1 = $vbulletin->GPC['isbot_time1'];
$isbot_time2 = TIMENOW;
$isbot_timediff = intval($isbot_time2 - $isbot_time1);

if ($isbot_timediff <= 30) // difference in seconds
{
$isbot_username = htmlspecialchars_uni($vbulletin->GPC['username']);
$isbot_email = htmlspecialchars_uni($vbulletin->GPC['email']);

$isbot_subject = $vbphrase['isbot_user_blocked_from_registering'];
$isbot_message = $vbphrase['isbot_the_following_name_email_blocked']
. ': ' . $isbot_username . ' - ' . $isbot_email
. ' (' . $isbot_timediff . ' ' . $vbphrase['isbot_seconds_transpired'] . ')';

vbmail($vbulletin->options['webmasteremail'], $isbot_subject, $isbot_message, true);

eval(standard_error(fetch_error('noregister')));
}
}

[scan-pa]

set it to 12 sec to 15 sec.

[dave9720]

set it to 12 sec to 15 sec.

Changed to 12 sec. Still getting in. Don't think this mod is working on my forum, There is no emails. Currently on 3.6.10 with php5:confused:

[sdavis2702]

Got my first one :)

The following user name with email address was blocked by the Is Bot mod: Whassyoraky - xrumer@micro.lt (7 seconds transpired)

I love it!!!!

[CoreyT]

Been using this mod for a year or so.
I get anywheres from 50 to 75 emails per day from the forum server letting me know it caught a spammer.
I have it set to the default 15 seconds.

Most are from Russia, here is an example.
Not sure if this one is from Russia though.
The following user name with email address was blocked by the Is Bot mod: Viagra_Kaufen - thesun@yalta.krim.ws (2 seconds transpired)

I give this mod two thumbs up.

[AdrianH]

Installed this mod on my forum, Unable to stop the bots. 95 in the last 24 hours. I checked to see if this mod was on and adjust time to 30 secs. Any help would be appreciated.

$vbulletin->input->clean_array_gpc('p', array(
'isbot_time1' => TYPE_UINT
));

if ($vbulletin->GPC['username'] && $vbulletin->GPC['email'])
{
$isbot_time1 = $vbulletin->GPC['isbot_time1'];
$isbot_time2 = TIMENOW;
$isbot_timediff = intval($isbot_time2 - $isbot_time1);

if ($isbot_timediff <= 30) // difference in seconds
{
$isbot_username = htmlspecialchars_uni($vbulletin->GPC['username']);
$isbot_email = htmlspecialchars_uni($vbulletin->GPC['email']);

$isbot_subject = $vbphrase['isbot_user_blocked_from_registering'];
$isbot_message = $vbphrase['isbot_the_following_name_email_blocked']
. ': ' . $isbot_username . ' - ' . $isbot_email
. ' (' . $isbot_timediff . ' ' . $vbphrase['isbot_seconds_transpired'] . ')';

vbmail($vbulletin->options['webmasteremail'], $isbot_subject, $isbot_message, true);

eval(standard_error(fetch_error('noregister')));
}
}

It has worked flawlessly in v3.6.8/.9/.10 and now v3.7 for me, are you sure you installed
correctly? I do know someone that edited the.xml and imported it but neglected to add the template edited that is required.

8 bots stopped within the last 90 minutes here.

[dave9720]

It has worked flawlessly in v3.6.8/.9/.10 and now v3.7 for me, are you sure you installed
correctly? I do know someone that edited the.xml and imported it but neglected to add the template edited that is required.

8 bots stopped within the last 90 minutes here.

Installed again same thing, This mod only has one product-isbot.xml. Just uploaded to my acp and check to see if it is active. Didn't edit anything.:confused:

[AdrianH]

Installed again same thing, This mod only has one product-isbot.xml. Just uploaded to my acp and check to see if it is active. Didn't edit anything.:confused:

That is why it is not working then.......... read the "README" you have to edit a template.

Is Bot Installation
================================================== ==========================================

1) The default time difference is set to 15 seconds. If you want to change that time to
something else, open the product-isbot.xml file, look for the following line, and change
15 to some other number in seconds:

if ($isbot_timediff <= 15) // difference in seconds

2) In the vB register template find:

<input type="hidden" name="url" value="$url" />

And afterwards add the following:

<input type="hidden" name="isbot_time1" value="$isbot_time1" />

3) Import the product-isbot.xml file as a product via the ACP

================================================== ==========================================
Obviously, use at your own risk. Enjoy!

[scan-pa]

30 sec. will let most bots in.....

15 seconds and under is the recomendation. Reg Bots are super quick, aprox 7 - 18 sec, per reg page.

turn it down a few sec.

[dave9720]

Thanks CareyCrew & scan-pa for the info. Edited the template and time to 7 secs. So far so good no spiders.:D

Spoke to soon, Still comeing in. I have 4 skins and paste this into all 4 reg. templates.

[droid101]

This thing has saved me so much moderation time... it's ridiculous. This is by far the best mod I have with regards to cutting down my admin time. Ten more thumbs up.

[bobs409]

Works great! :up: Caught 4 spambots on the first night.

Thanks so much for this great mod!


Bob

[bc3tech]

mine had been working well, been receiving e-mails just fine, and now just recently i've not been getting e-mails and bots are getting in.

i checked my templates and re-imported the product, also checked the hooks. all seems to be in place.

any ideas?
30 sec. will let most bots in.....

15 seconds and under is the recomendation. Reg Bots are super quick, aprox 7 - 18 sec, per reg page.

turn it down a few sec.
am pretty sure this is incorrect. The code is written such that if they get in UNDER the time you specify they're flagged as a bot. so a higher time should nab more at the risk of getting legit users, however.
if ($isbot_timediff <= 15) // difference in seconds
{
$isbot_username = htmlspecialchars_uni($vbulletin->GPC['username']);
$isbot_email = htmlspecialchars_uni($vbulletin->GPC['email']);

$isbot_subject = $vbphrase['isbot_user_blocked_from_registering'];
$isbot_message = $vbphrase['isbot_the_following_name_email_blocked']
...
}

[Joe Blow]

Awesome mod! Thank you! :up:

[bc3tech]

one thing i'd like to see in the future, or if anybody knows how to do it, is the IP address of the offender put into the e-mail that is sent.

then, you couple this mod w/ the IP No Register mod and you can ban repeat offenders from even trying.

[Boofo]

one thing i'd like to see in the future, or if anybody knows how to do it, is the IP address of the offender put into the e-mail that is sent.

then, you couple this mod w/ the IP No Register mod and you can ban repeat offenders from even trying.

I did that to mine 2 minutes after I installed it. All you need to add is IP: IPADDRESS

[bc3tech]

Well the Bots are getting smarter.:mad:


just had the following occur:

@ 7:52am CST:


@ 7:56am CST:


@ 7:58am CST



He got through.. note the IP address is different for all three attempts!
note the same e-mail address each time. this is why the auto-ban e-mail is a good option.
I did that to mine 2 minutes after I installed it. All you need to add is IP: IPADDRESS
yup found that in some previous posts after more searching. thanks though.
also implemented the auto ip & auto e-mail banning. we'll see how it goes!

[Boofo]

Can you point me to the auto email and IP banning?

[Clayton]

Can you point me to the auto email and IP banning?


ditto here, more interested in email banning

:up:

[nova4708]

This is an amazing plugin. I've just come back to find out how to get it to stop sending me emails, because in the couple weeks since I've installed it, it's blocked over 500 bot signups!

I'm so glad I added this! The spam on the site has been dramatically reduced, giving the mods just that much less to worry about. Fantastic!

[Devices]

Can you point me to the auto email and IP banning?

Yes its earlier in this thread a few times. Around page 6, 7 or 8 iirc.

[scan-pa]

does anyone know how to add these lines of code to the product or 2 plugins to send ip info? I think this is the code needed to get the ip and host info, but I do not know how to add it to the plugin.

$fipaddress = 'IP Address: ' . IPADDRESS . "\r\n";
$iphostname = "Host: " . @gethostbyaddr(IPADDRESS) . "\r\n";

[scan-pa]

Yes its earlier in this thread a few times. Around page 6, 7 or 8 iirc.

page numbers vary by what each person has it set to in the User CP options.

I have mine set to 40 posts per page.

[Boofo]

Actually, it should be:

@gethostbyaddr($_SERVER['REMOTE_ADDR']);

[scan-pa]

Actually, it should be:

@gethostbyaddr($_SERVER['REMOTE_ADDR']);

Thanks Boofo, that fixed it.

Many Thanks.

[MeMySelfNi]

Actually, it should be:

@gethostbyaddr($_SERVER['REMOTE_ADDR']);

Where exactly is that suppose to go, within the plugin when you go to edit it?

[berry05]

now the default is 15 seconds....15 seconds for what?

[Lynne]

now the default is 15 seconds....15 seconds for what?
15 seconds for them to register. Basically, if they take more than 15 seconds to register, then the assumption is they are not a bot and are allowed to register.

[berry05]

so i should raise it above 15 seconds huh?

[scan-pa]

12 - 15 seems to be ok time.

most bots are 1 sec. to 8 sec. Have never had one take longer yet, and I block over 30+ of these spam bots every day.

The best time I can get to do the reg page with 1 click pasting, took me just over 15.81 sec.

[berry05]

but its humanly impossible to do a register page in 15 seconds or less..

[NeitherSparky]

Installed this (and another bot-befuddling mod) yesterday after installing 3.7 and getting flooded with bots, and I got my first Is Bot email today. Thank you. :)

[Ak47]

What a great mod, InstalleD. :D.

[berry05]

omg! this mod works great! block at least 20 a day!! no lie!! problem is some are still getting through...how do i turn this sucker up so that none get through? my default is at 15....do i chnage is higher or lower?

[supercookie]

Hi,

stupid question: I have enterered 45 seconds - my test registration is denied with the words:

user blocked from registration

"Entschuldigung, aber zurzeit sind keine neuen Registrierungen möglich."

-> "Sorry, no registrations at the moment"

Why? What do I have to change?

Best regards
Marc

[Fonzi]

There were no bots getting through until I upgraded to 3.7, now I'm flooded with them. I reinstalled IsBot and they're still getting through. Any ideas why?

Thanks

[berry05]

change 45 seconds back to 15 supercookie
:D

[Boofo]

Mine stopped working for some reason. I can't see the bots just leaving me alone now.

[Idawg]

I have multiple 3.7 boards with is-bot installed and I dont get hammered by them.. It COULD be the way I upgrade the forums.. I uninstall all the 3.6 mods (minus the photogallerys and such). Then I delete all the code except for attachments ect, upload 3.7.x and upgrade. I then install the new mods.. NO BOTS.. I got hammered on the first board I upgraded, but I did the above and reinstalled isbot and no more bots

I dont know, maybe it is my dumb luck or something :D

[SmartOneVision]

Very Smart Idea :up:, for me just this hack was able to stop the spam posts , thx a lot

[noppid]

All a spammer has to do to beat this is look for a form field, send it and use a false time stamp. It may work for a while, but it's too easy to beat.

Ya need to grab something from the registering user when they click the forum rules to register and store it in the DB for comparison later privately on form submit. ;)

[Alfa1]

Recently an online spam script was posted on vb.org. It processed a mass of vb forums and paused after every step. So even though this hack is a very helpful addition, it wont stop all spam.

[Boofo]

That is where reCAPTCHA comes in handy.

[noppid]

Gotta have more than one line of defense, right?

[Boofo]

Better safe than sorry.

[Alfa1]

Since installing this mod yesterday, I have hundreds of spam bots banging on my door(WOL), but they cant seem to get in. So a big thumbs up. I googled the bot IP's and most of them lead me to www.stopforumspam.com which is really handy.
This hack may also be very helpful as an extra level of security:
https://vborg.vbsupport.ru/showthread.php?t=176481&highlight=stopforumspam

[TheInsaneManiac]

Does this work with 3.7?

[Boofo]

Yes, it does, although it has stopped working on my site for some reason. I haven't gotten an email for this hack for over 2 months and I know the bots are still trying.

[NeitherSparky]

It works on my site, I'm running 3.7.2.

[Alfa1]

I am not getting any emails on vb 3.7.1 PL2

[Pottsy]

Yes, it does, although it has stopped working on my site for some reason. I haven't gotten an email for this hack for over 2 months and I know the bots are still trying.

Did you remember the manual template edit? I forgot mine after a mass revert when upgrading to 3.7 :o

[Quarterbore]

I am getting a lot of bots that are registering with a location of "1" so I want to add a simple line of code to the Is Bot plugin for "register_addmember_process" that will check the location and if it says "1" I wanted them blocked.

So, here is the code:

Find:

$vbulletin->input->clean_array_gpc('p', array(
'isbot_time1' => TYPE_UINT
));

AFTER ADD:

if ($vbulletin->GPC['userfield']["field2"] == 1)
{
eval(standard_error(fetch_error('noregister')));
}

EDIT: OK, I confused someone on my own site by what was posted here. What you need to edit is the PLUGIN code as follows:

AdminCP >> Plugins & Products >> Plugin Manager >> Product : Is Bot

Then, edit the plugin for "Is Bot" attached to the "register_addmember_process" plugin

Easy as pie!

[Lee G]

That guys a trouble maker over at your site Quaterbore.
Name him and shame him :D

Thanks for making the extra bits clear

And this hack works well with 3.7.2 pl1 :up:

Stopping about 20+ spam bots a day

[makaiguy]

[Clicking "Installed" ...]

Have had this in place for a while and was receiving no emails, although the number of spammer registrations definitely appeared to be reduced -- thanks to a recent post I realized I had not made the required template modification.

[makaiguy]

It's been about an hour since enabling the notification emails and I've received 8 notices. This is more spammers than I would typically have had register in a whole day before installing Isbot. Could the bots be detecting the registration failure and resubmitting rather than moving on?

What happens if the "no register" error notice is not displayed? Would the regs still be blocked?

[makaiguy]

I note that MOST of these blocks would already have been caught by my prohibition of accepting registrations from a handful of spammer email domains (notably mail.ru and @gawab.com). Is there a different hook that could be used that would only come into play AFTER the registratrion has passed through vB's own registration checks? It might cut down on the number of emails considerably.

[BadgerDog]

I've already posted the fact that I installed this mod on our v3.67pl1 system, but I wanted to reiterate my appreciation to the author.... :)

It's incredible how much time this mod saves me from what I had to do before, in order to try and keep "bots" and spammers out of our system. It seemed like I was spending hours every day, just trying to add IP's and email addresses to the "banned" lists, but they kept coming.

Now, I get dozens of emails every day, showing how many of these "bots" got stopped and the stress of running the system is way lower...

Thanks calorie... :up:

If I could give you a hug, I would ... but, it doesn't mean we're going steady ... :D

Regards,
Badger

[gfxhelp.com]

It works, but when it's under the set time I get..

Warning: fsockopen() [function.fsockopen]: unable to connect to mail.domain.com:25 (Connection refused) in [path]/includes/class_mail.php on line 604

Although it does work and gives the registration disabled message. Anyone else get this or is it just me?

[tommykjensen]

I don't know if this has been asked but is it possible to modify this so the IP address is included in the email? I would like to add the IP addresses of the spambots to my .htaccess file to block them completely.

[NeitherSparky]

I don't know if this has been asked but is it possible to modify this so the IP address is included in the email? I would like to add the IP addresses of the spambots to my .htaccess file to block them completely.

The original post with this info ought to be linked to in the body of the thread...but it isn't so:

To include the IP in the email.

Go to the Plugin Manager in your AdminCP
Click edit for "register_addmember_process" under Is Bot product

Find:

$isbot_email = htmlspecialchars_uni($vbulletin->GPC['email']);

Below it add:

$isbot_ipaddy = IPADDRESS;

next find:

. ' (' . $isbot_timediff . ' ' . $vbphrase['isbot_seconds_transpired'] . ')';

REPLACE it with:

. ' (' . $isbot_timediff . ' ' . $vbphrase['isbot_seconds_transpired'] . ')'
. ' The IP Address is: ' . $isbot_ipaddy ;

[tommykjensen]

Thanks.

[trigatch4]

I have a couple decent sized forums and block about 50/each per day. That means 50 emails. I don't want to DISABLE the emails but would LOVE to just get ONE email every day recapping all the attempts that were blocked.

Anyone know how to get this done?

[TheComputerGuy]

vbmail($vbulletin->options['webmasteremail'], $isbot_subject, $isbot_message, true);

Remove that line...see what happens

[R-D]

This one made me laugh, I was seriously not expecting to see this:

The following user name with email address was blocked by the Is Bot mod: {cigarette|cheap cigarette|discount cigarette|marlboro cigarette|camel cigarette|cigarette store|cigarette cases|buy cigarette|online cigarette|cigarette smoking|cigarette coupon|cigarette smoke|newport cigarette|wholesale cigarette |cigarette holder|cigarette lighter|cigarette girl|cigarette boat|accessorie cell cheap cigarette phone|buy cigarette online|cigarette prices|cheapest cigarette|doral cigarette|cigarette machine|cheap cigarette online|free cigarette coupon |coffee and cigarette|marlboro cigarette web site|clove cigarette|cheap marlboro cigarette|first cigarette|winston cigarette|camel cigarette web site|cigarette fag smoking|salem cigarette|cigarette rolling machine|kool cigarette|dirt cheap cigarette|cigarette cheaper|cigarette tobacco|cigarette sale|woman cigarette|cigarette tax|marlboro cigarette coupon|buy cheap cigarette|effects of cigarette smoking|light cigarette |cigarette brand|cig cigarette smoker smoking|free cigarette|cigarette ads|leather cigarette cases|candy cigarette|cigarette ingredient|romance and cigarette|newport cigarette coupon|discount cigarette online|american spirit cigarette|marlboro cigarette official web site|cigarette filter|cigarette pack|basic cigarette|dunhill cigarette|camel cigarette official web site|cigarette box|cigarette carton|duty free cigarette|seneca cigarette|cigarette lighter adapter|cheap newport cigarette |quit smoking cigarette|lucky strike cigarette|parliament cigarette|buy cheap cigarette online|smoking cigarette tobacco|ingredient in cigarette|in cigarette|cigarette sales|long cigarette|cigar cigarette|girl smoking cigarette|cigarette papers|cigarette card|tax free cigarette} - cwsfaf-t@yahoo.co.uk (7 seconds transpired) The IP Address is: 222.73.45.8

[NeitherSparky]

Lol, classy. ;)

[crazymook]

this has blocked 16 for me in a 3 hour span and i just installed it. however i registered a test account myself and it blocked me....so i might have to change the time

[eyeoftiger]

2) In the vB register template find:

<input type="hidden" name="url" value="$url" />

And afterwards add the following:

<input type="hidden" name="isbot_time1" value="$isbot_time1" />

I just can't find where VB register template is, could you please help me located where this is???

[eyeoftiger]

Any help?

[eyeoftiger]

Hello? ? ? ? ? ?

[TheDoug]

Admin CP -> Style & Templates -> Style Manager. In drop down, choose Edit Templates. Scroll down to find "Registration Templates »", and double click on it to expand. Double click on "register". Find referenced line and add mod code after.

ps. This is not "support on demand". Give it more than 15 minutes.