Huge Spike in Guests on Board

[hunter22375]

I have WAY more guests on my board than usual. I normally run about 600+ and right now I am at over 3800!!!!!! Also, I am receiving about 500 undeliverable emails a day in my inbox as if people attempted to sign up with a bogus email and could not confirm it. Neither the board or my third party member management system show all these failed sign ups and I have human verification turned on using Captcha. Has anyone had this happen to them? Is it some sort of an attack to overwhelm my board?

[Bluemax712]

One thing to check is make sure your MySQL server isn't exposed or at least limit outside connections to it.
There is a relatively new vulnerability that is trivial to pull off if your server hasn't been patched yet.

http://www.h-online.com/open/news/item/Simple-authentication-bypass-for-MySQL-root-revealed-Update-1614990.html

[hunter22375]

I read the article and, for the most part, have an idea of what I had an idea of what it was saying. What my question then becomes is, why aren't all these new fake members showing up in vB or my third party member management system? Because regardless if a member fails to confirm their email because they provided a bogus one, their screen name still shows up and they get added to the total member amount.....which has not changed along with the hundreds of undeliverable emails I have been receiving.

[Bluemax712]

I only mentioned the MySQL vulnerability thinking if it is open to outside connections
it could be attracting people looking to break in.

Do you use Glowhost Spam-O-Matic (highly recommended)
https://vborg.vbsupport.ru/showthread.php?t=248042&highlight=Spam-O-Matic

It will block a lot of bots and has a good logging system telling you what it's doing

[hunter22375]

Thanks, I don't pretend to know alot about server management so I appreciate the help. I'm not even sure if how I described the issue made sense...lol. I will look into that. Thanks again.

[Andy]

I have human verification turned on using Captcha.

Which captcha are you using? The Question & Answers or the one that requires entering in a few characters?

[hunter22375]

Which captcha are you using? The Question & Answers or the one that requires entering in a few characters?

The one that requires entering characters.

[Andy]

The one that requires entering characters.

That's the problem. It's been cracked years ago. Here's what I suggest you do.

https://www.vbulletin.com/forum/showthread.php/377906-How-to-prevent-spammers-from-registering-on-your-forum

[CAG CheechDogg]

That's the problem. It's been cracked years ago. Here's what I suggest you do.

https://www.vbulletin.com/forum/showthread.php/377906-How-to-prevent-spammers-from-registering-on-your-forum

I disagree with you Andy, if that was the problem I would have it on my site as well. I only use the reCaptcha with characters and I have had no problems with it.

He has to make sure his Publick and Private Keys are valid first of all.

I don't even know where you got that it got cracked years ago, lol.

hunter22375 if you need further assistance with this contact me via pm buddy, there are other ways to stop this from happening in your forums.

[Andy]

I disagree with you Andy, if that was the problem I would have it on my site as well. I only use the reCaptcha with characters and I have had no problems with it.

He has to make sure his Publick and Private Keys are valid first of all.

I don't even know where you got that it got cracked years ago, lol.



Please type this into google.com

reCaptcha cracked site:vbulletin.com

[Bluemax712]

Any system will eventually be cracked and then patched
http://arstechnica.com/security/2012/05/google-recaptcha-brought-to-its-knees/

I am wondering if VBulletin Recapture ever needs updating manually
or is all the code maintained at google and automatically updated to the latest
without intervention on our part?

I find the best way is combination:
1) use promotion system to limit permissions of newbies until a certain number of posts
2) use Glowhost Spam-O-Matic (except dont' use the username verification)

[hunter22375]

I made some changes...we'll see what happens. If they worked, my "most users online ever" amount will be way off. I looked for a place to edit that number and came up empty handed. Does anyone know where I can edit it?

[CAG CheechDogg]

I have been using reCaptcha for over 3 years now and not once have I had any problems, I have used it on joomla, kunena, wordpress and many other applications that take it.

--------------- Added 1340880394 at 1340880394 ---------------

I made some changes...we'll see what happens. If they worked, my "most users online ever" amount will be way off. I looked for a place to edit that number and came up empty handed. Does anyone know where I can edit it?

You might be able to find that record using phpMyAdmin from you cPanel

[NathanJT]

I read the article and, for the most part, have an idea of what I had an idea of what it was saying. What my question then becomes is, why aren't all these new fake members showing up in vB or my third party member management system? Because regardless if a member fails to confirm their email because they provided a bogus one, their screen name still shows up and they get added to the total member amount.....which has not changed along with the hundreds of undeliverable emails I have been receiving.

I have the same issue. New user email notifications being sent to me and then when I go into admincp to search for them they don't exist. Mine is small scale compared to yours but of the dozen new user emails I received last night I can only find 4 in the DB.

[edit] What I have noticed though, in the main, is that the IP's these sign ups are coming from are COLOs. Now it could be that the ISP in question has a POP there but it seems odd that all of a sudden it's servers doing this rather than rooted PC's.