No, it's not posted here.

Yes - I have only been testing with successful regs - so that explains it.
Will be waiting on the new version with the logging, stats and hopefully successful regs in the thread too :)

Thanks again.

It would be good if the thread posting used the time limits. If it seems like the other stuff is going to take a while, maybe I'll make another update with that change.

Well I did get this one Registration Rejected email while testing that didn't show up in thread. I missed a field filling it out

============================================
At 03:36 AM 26th February 2013 (default forum time) a registration attempt was rejected because:

- The registration time was greater than the minimum of 25 seconds (28)
- Error from vB: You have left a required field blank.
- Error from vB: The two email addresses that you entered do not match.
================================================== ========

Hmm...yeah, I don't remember offhand, but I think that might be because it wasn't rejected based on the time. But my intention was that you should be able to get those notices as well. I'll take a look at that.

ETA: now that I think about it a little, I guess there could be a question of whether or not that should generate a notice. Because in that case it's probably a user who made a mistake and will try again, so I'm not sure if people would want a notice about that.

Also I'm going to change those error messages a little. That first one isn't an error, it's just saying that the time check was OK, but the way it reads is confusing.

I do like how it shows so much info - didn't know I was so close to the minimum time.

Yes an option to enable all the extra reporting would be great!

This mod won't works for me.

The mod is turned on (time limit=30 sec), but spammers can get through. So I tried it on my own, filled out the registration form in ~10 sec. and the result was a successful registred new user :(

I am using vBulletin 4.2.0 Patch Level 3. I turned off all other plugins, which may influence your plugin. I also tried to change the action options if the registration form is filled out too quickly - but with no success.

Any ideas where is the problem?

/Edit:
I have never used any similiar plugins to prevent spam registrations...

Mea culpa :)

I just find the problem, and it is not your fault! I was using the wrong PHP Version (5.4). With this Version vB is not fully compatible, so I changed again to 5.3 - and everything is working now :)

Thanks for letting me know. I'm going to check to make sure that this mod is compatible with PHP5.4.

Don't worry, because vB 4.2 isn't also fully compatible with PHP 5.4 (especially the wysiwyg editor).

But I have a suggestion:
I am using the notification via a seperate thread. It's a little bit distracting, that a post is created for every blocked spam account. My system blocked only in 1 hour 191 Spam Users :D So I have 191 new postings, most of them don't using the real registration form. They only use a PHP Post Command for trying to register.

It would be nice, if it is possible that only every day/week/month a post is created with a detailed statistic of blocked users or like its done as shown in the screenshot

Yes, I think most everyone who has a serious spammer problem ends up turning on the notices only to see if it works, then turns them off. But I'm already working on a version that will be able to show statistics. It's a little more complicated because with notices the mod can just send a notice and it's done, but with stats it needs to save information to the database.

Do you suggest using PCRE with this or no?

Sorry, I don't know what you mean. Are you talking about having a field match a certain pattern?

This in the vB standard registration.

Oh, OK. Well, it's up to you if you want to use that to control what usernames are allowed. If you were using it to somehow filter out spammers then yes, there's no reason you shouldn't continue to use it. This mod attempts to filter out bots by the amount of time taken to fill out the form, so it shouldn't be affected by that setting.

I don't know how the Bots get past the PCRE thing but they do. My thought was maybe that added to the time for them to register and I should take it off to keep the Bot in your suggested time frame of 20 seconds.

I'll try both ways, right now just waiting for my first notification of your mod stopping one. After I see it works and what not I'll hook you up with a little thank you ;)

When you say they're "getting past the PCRE thing", you mean before this mod was installed, right? (Or are you saying this mod was somehow letting them past)? Those patterns can be a little tricky, maybe the one you're using isn't quite right or something.

It shouldn't make any difference. I guess when a user fills out the form it does a call back to the server to check the name, but a bot would bypass that.

That PCRE thing is the deal where you have to read two words printed out blurry and what not then type them in to continue; and yes the BOTs go right past this outside your Hack. They have to scam them somehow; which must take an extra second or two.

I just installed 10 minutes ago and haven't got and email from your Hack or a post in a designated thread; yet. We usally have 20 to 50 Bots and hour; so I'm wondering if your Hack is stopping them and I'm not getting notified. I'll wait a bit longer and then maybe try a test or two.

I have the PCRE thing off to start with on your Hack.

This sounds like you're talking about ReCAPTCHA, which is something different than the PCRE thing. But yes, bots will get by reCAPTCHA. To answer your original question, you can use that in addition to this mod, but you really should use "question and answer" human verification with some simple questions instead of reCAPTCHA.


That does sound like maybe something's wrong. It would be a good idea to do a test registration.

I'm on vB 4.1.4 I see nothing about ReCAPTCHA in User Registration Options, just this PCRE thing under Username Regular Expression.

I am certain now your Hack is blocking, but I'm getting no notifications. I fiddle with it and look around at other areas.

Click on "Human Verification Options" under The Settings menu on the left in the admincp. What you described is definitely the reCAPTCHA human verification. Then PCRE shouldn't cause anything to change on the registartion page.

As for the notifications, make sure you've set "Send Email Notification For Each" to Yes, and that your email address is correct (and also, "Post Notification to Thread" to Yes for thread posting). Also, if you entered anything for "Limit Notifications By Registration Time", maybe try taking it out temporarily and leaving the field blank, just to see if that changes anything.

I haven't tested it except with the latest vb4.2.0, so I guess it is possible that there's an issue with earlier versions.

When I trigger your Hack block I get this:

Instead of the URL redirect I entered and no notifications, still working on it.

Did you enter a userid in the "Notification User ID" field (at the end of the Spambot Stopper options)? That might be it - it just needs the iserid of someone to post as (such as your own username).

If that's the problem then I guess I need to check for a blank field there before trying to post a notice.

Edit: sorry, that field takes a userid (number), not a name.

I entered my ID and it converted it to 1.

I pulled that option and the email notification then did a test registration with 80 seconds and did't get blocked.

Give me a bit more to work on it, not giving up yet.

I'm not sure what you mean - it shouldn't get converted.


What do you have your min and max times set to? I have it set so that if the difference between the min and max times isn't at least 60 seconds it will ignore the max. I did that because otherwise I thought it was too easy to set it so that there was no time window (or the window was too small). But now that I look at it, it isn't obvious unless you click on the help icon next to that option.

To be honest the max time is probably not useful in stopping bots at this point. I wanted to add it so that there was something preventing reuse of old timestamps, but it's almost certain that no one is trying to do that at this point.

If you can't get it to work, there are a couple other mods that work the same way that you could try (although I think this is the only one for vb4 that posts notices to a thread).

At first I did the default of 20, but to test I set it at 80.

I changed to answer verification and turned yours off, I want to see what happens there first and then come back to yours.

Yes the ID was converted to 1, I even did it again because I was like WTH is a 1 doing there and it instantly took it back to 1 again.

Oh, right - that's probably because the field is set to "positive integer", so if you try to enter anything other than that it ignores your input and goes back to what was there before. In any case, if your userid is 1, that's what you want.

It doesn't matter how many times I enter my real ID, I hit save and it goes to 1 everytime.

I have to leave for lunch and do a little work later, I will get through this. It's probably more me than anything, give 24 hours and I'll let you know what's up.

https://vborg.vbsupport.ru/external/2013/03/26.jpg

Yeah, that's kind of my mistake in that the field type is set to "positive integer" and so it will change to 1 if something invalid is entered (so there's no way to leave it blank). But if you're trying to enter another number (including only the characters 0-9) it should work (I mistakenly said before that it should be a "user name", but it can only be a number).

Thanks for creating this great mod. We switched from a similar one that keeps changing names, and you have all the features that it had - and even more.

Keep up the great work!:up:

OK, so how would I know what number to enter 0-9?

I have it all working like I want except for this Thread Notification.

Here is part of the URL: .php?34222-Blocked-Bots

So I use 34222 for Thread ID, right?

That only leaves me with how to determine User ID Number, sorry for not knowing what you mean here.

Exactly. I didn't explain it very well, I just meant you should enter a number and no letters or symbols.


Same idea. If you go to your profile the url. should have your userid followed by a '-' then your use name. You want to enter only the number.

Sweet! TY Will advise.

That was it! I do suggest a more simple help of what numbers you expect for idiots like myself ;) That's right I consider this my fault and take full blame.....

You Hack works perfect as described, combined with a Question for Verification this has taken me from near 500 Bots a day to 0. What a fantastic thing!!!!

A few spelling mistakes in the xml
the word form should be forum seems a lot so will not post all

Thanks, I'll check it over for the next release.

I installed this and my registrations dropped right off. I was like whoa what the heck!!!

I was then "OMG" when I started looking at previous registrations. I actually had a member named "Cialis" with a email from some pharmacy. DOH!

This mod is really keeping those spammers away!

Thanks again for it!

I am seeing many, many, many blocked registrations that I never even knew were going on so I take it most of these were already being blocked by my other security. Still it is decent to have another layer and to see evidence of it working.

I never realized the sheer amount of false registrations that were being blocked from my forum. There were at least 45 in the past 12 hours. this allows me to look for any that are using the same ip so I can go and block them.

I changed the max time down from 25 to 15. It seems like someone should be able to fill out the forms fairly quickly and 25 seemed too long. What are you guys using??

Great work here!!

25 does seem to be cutting it pretty close to normal human time
-even I can almost type that fast.

I've been running it at 20 without problems.

Over the past 100 attempts:
The slowest spammer I've seen was 13 seconds
most are in the 1-3 second range

PS
54 installs and only 12 votes for MOTM - come on people :up:
https://vborg.vbsupport.ru/showthread.php?t=295624

25 seconds seems to be the sweet spot -- we started at 15 and most people took longer than that so it should be ok here. Autocomplete and safety measures for humans do play a factor in determining that number, though.