vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vBulletin 3.8 Add-ons (https://vborg.vbsupport.ru/forumdisplay.php?f=235)
-   -   Anti-Spam Options - Is Bot: Registration Time Check (https://vborg.vbsupport.ru/showthread.php?t=135094)

calorie 12-29-2006 10:00 PM

Is Bot: Registration Time Check
 
1 Attachment(s)
This mod calculates the time it takes to go between these two pages:
  • /forum/register.php?do=register
  • /forum/register.php?do=addmember
The point is to try and prevent bots from registering at your forum when the time between the two pages is humanly impossible, assuming that humans actually take the time to complete the registration page.

Should a user be blocked from registering at your forum, an email will be sent to your vB webmasteremail address and the user will see the vB noregister phrase message, so no screenshot is necessary.

projectego 12-30-2006 08:46 AM

Excellent idea - I'm sure this will make every admin's job alot easier! :)

imported_Pigs 12-30-2006 10:12 AM

Thanks,
Another cool tool..

Distance 12-30-2006 12:19 PM

Very good idea!! Excellent infact for sites that attract alot of bots

KURTZ 12-30-2006 12:34 PM

reserved :)

Cyburbia 12-30-2006 02:21 PM

Thanks! This has the potential to be a great mod. Here's my original post with the request:

Quote:

I've discovered that the Xrumer/Botmaster spambots will submit register.php?do=addmember just seconds after register.php?do=register. While humans take a minute or more to fill out the registration form, bots do it instantly. Here's some evidence from my logs:

87.240.15.25 - - [16/Dec/2006:07:00:41 -0500] "POST /forums/register.php?do=register HTTP/1.0" 200 22180 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
87.240.15.25 - - [16/Dec/2006:07:00:45 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22579 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
87.240.15.25 - - [16/Dec/2006:07:00:49 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22576 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
87.240.15.25 - - [16/Dec/2006:07:00:57 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22579 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
87.240.15.25 - - [16/Dec/2006:07:01:00 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22579 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"


Note the times: 07:00:41, 07:00:45, 07:00:49, 07:00:57, 07:01:00. Five hits in 19 seconds.

Here's one that just rolled in a few seconds ago. The IP (193.69.180.120) is a Swedish proxy.

193.69.180.120 - - [16/Dec/2006:15:10:15 -0500] "POST /forums/register.php?do=register HTTP/1.0" 200 22177 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
193.69.180.120 - - [16/Dec/2006:15:10:19 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22860 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
193.69.180.120 - - [16/Dec/2006:15:10:22 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22861 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
193.69.180.120 - - [16/Dec/2006:15:10:25 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22861 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
193.69.180.120 - - [16/Dec/2006:15:10:29 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22860 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"


Five hits between 15:10:15 and 15:10:29 - 14 seconds.

I think that it attempts to break the captcha, fails, and tries again. After four or five failed attempts, the bot is programmed to give up and move on to the next victim.

Anyhow, I'd like to see a mod that prevents posting or submittal of register.php?do=addmember until a minute or more after it's been displayed. This might not stop Xrumer and other spambots, but it will slow them down; a way at getting back at them. The mod seems relatively simple, but I lack the skills to program it. Any takers?

EDIT: Yes, I know about the other hacks to prevent spam. I get very little spam on my board, thanks to a strong CAPTCHA and an extensive emailblacklist, among other security measures. I'm just looking to slow the bots down. If enough people install such a mod, we could dramatically slow the rate of spamming, and makethe bots less effective.

Moparx 12-30-2006 07:34 PM

This is an excellent idea.

Snake 12-30-2006 09:26 PM

That's excellent. Thanks! :)

amagab 12-31-2006 09:28 PM

Marvelous! I installed this mod and a couple of hours later I got a notification in my email about a spammer being prevented from registering. It took the spammer 4 seconds to go between the pages.....I don't know anyone that fast.

Bloody awesome!

Thanks!

MichaelGoldman 12-31-2006 11:59 PM

good idea, going to install now. Sick and tired of all the bots on my forum :D

btw, i think 15 sec is way too high.. it takes a bot less than a second to fill in the fields, decode captcha and press the submit button. :)

scottct1 01-01-2007 12:59 AM

Great if this works I nominate it as Mod of the Month. :D

amagab 01-01-2007 01:06 AM

Maybe I spoke too soon. This mod just blocked an attempt by a @ukr.net address and then one minute later that darn same person spammed my site.

How did that happen?

amagab 01-01-2007 01:15 AM

Quote:

Originally Posted by amagab (Post 1148337)
Maybe I spoke too soon. This mod just blocked an attempt by a @ukr.net address and then one minute later that darn same person spammed my site.

How did that happen?

Sorry, I just realized that spammer registered before I installed this mod.

Thanks!

EyeCrave 01-01-2007 01:27 AM

Installed

amagab 01-01-2007 06:30 PM

It's pretty cool. In the one day that I've had it installed, this mod has blocked about 12 spambot attempts. However, the last attempt took 14 seconds to move between the pages so I assume that if they change their spambot to 16 seconds they would make it through and then I would have to change the mod to a higher number.

Anyway, I love this mod. :)

Brew 01-02-2007 05:13 AM

I just received my first email about a potential spammer:

The following user name with email address was blocked by the Is Bot mod: osceshop - osceshop@cashette.com (XX seconds transpired)


Needless to say it's feels good that one didn't get away without getting trapped :)

Could you please add more info into the mails?

Maybe the IP addy? Resolved too perhaps?

Anything else you can think of as well ;)

Great mod dude...hats off to ya....

edit: how about auto ban too? or maybe posting to a special forum with the details as well?

KURTZ 01-02-2007 11:38 AM

just a question, 15 seconds are enough? maybe 20 are better?

Caerydd 01-02-2007 12:44 PM

Perhaps a way to change the time without re-importing the product every time?

Other than thank you very much, and installed!

amagab 01-07-2007 01:20 AM

Again, I have to give my many thanks to the developer of this Mod. It blocks about 8 spambot registrations a day on my site. I'm using a similar mod on my phpBB2 site and both mods have saved me and my moderators plenty of anguish.

chick 01-07-2007 02:25 PM

Good gawd... works awesome... even though I have other spam measures in place... they do not catch everything.

This mod, installed just 1 hour ago just caught me a mail.ru spammer.... Thank you.

Quote:

The following user name with email address was blocked by the Is Bot mod: ivagsales - ivagsale@mail.ru (5 seconds transpired)

Brew 01-07-2007 02:55 PM

One more idea for this:

How bout the option to add Groups who receive the email too?

This is such a great mod I think it deserves a consideration for being part of the core vB.

:)

KURTZ 01-07-2007 02:58 PM

Quote:

Originally Posted by chick (Post 1152649)
Good gawd... works awesome... even though I have other spam measures in place... they do not catch everything.

This mod, installed just 1 hour ago just caught me a mail.ru spammer.... Thank you.

have you settled the time to 5 secs instead 15?

chick 01-08-2007 07:00 AM

I left it at 15 seconds, and during the night, caught MORE.

The following user name with email address was blocked by the Is Bot mod: deosaest - deosaest@cashette.com (1 seconds transpired)

The following user name with email address was blocked by the Is Bot mod: presley - presley@meta.ua (2 seconds transpired)

The following user name with email address was blocked by the Is Bot mod: DosugXT - dosug-x@nm.ru (1 seconds transpired)

WOW I am so happy, these were getting by before and I am running 3 other mods to prevent spam but this one is catching them.

chick 01-08-2007 07:04 AM

I have to add this should be vb CORE as the other member stated above. This is fantastic. I am nominating for Mod of the month.

everd 01-08-2007 01:18 PM

also nominated for MOTM. catching 10 spammers a day.

ConqSoft 01-08-2007 01:20 PM

Nice mod. How long before the spammer applications start adding a delay though? :)

chick 01-09-2007 11:23 AM

3 more

The following user name with email address was blocked by the Is Bot mod: adultdvt - adult@spivare.com (2 seconds transpired)

The following user name with email address was blocked by the Is Bot mod: Kghikeds - nilucoqog@mail.ru (3 seconds transpired)

The following user name with email address was blocked by the Is Bot mod: FeregeRR - anlrei_izrazov@mail.ru (7 seconds transpired)

I love this mod.

chick 01-09-2007 07:12 PM

1,071 VIEWS of this mod and only 26 replies? wtf. This mod has made my day!!

KURTZ 01-09-2007 10:41 PM

finally INSTALLED ... :D

richTV 01-11-2007 03:31 AM

thank you. :)

just to verify....

after adding that line to the registration template and uploading the product, there is no listing of it in the vBulletins Options menu.

correct?

amagab 01-11-2007 04:26 AM

Yes, the only place I saw it was in the product listing.

chick 01-11-2007 06:36 AM

correct

richTV 01-11-2007 06:44 AM

thank you. :)

chick 01-12-2007 04:41 PM

This one didn't get by, it was blocked but the time factor of 13 seconds on this one concerns me. I wonder what a good time from would be to bump it from 15 seconds to 20 seconds?

The following user name with email address was blocked by the Is Bot mod: WebDocMan - webpharmastoreman@cashette.com (13 seconds transpired)

amagab 01-12-2007 05:07 PM

I haven't seen any spambot attempts the last few days (I had over 50 attempts the first two weeks) so I wonder if they are re-grouping and coming with a new attack.

SVTOA 01-12-2007 08:24 PM

This is a great idea.
What about also putting some sort of javascript timer in the registration agreement that generates a phrase that says something like "Unless you are Evelyn Wood, you could not possibly have read that agreement in such a short time! Please go back and read the registration terms before proceeding further"

calorie 01-12-2007 08:51 PM

Thanks for the thanks and nominations. :D

Maybe I'll add more info to the webmasteremail if I have the time. Anyway, just a tip... If you get a lot of the same domains showing up, go to vB Options -> User Banning Options and add the email there, if you want an added layer of protection from users/bots coming from those domains, just in case this mod doesn't stop them.

If you want to edit the seconds after import, just go to the Plugin Manager and edit the Is Bot plugin located at the register_addmember_process hook. There's no need to reimport each time. As for JavaScript, the bots probably ignore it so it'd have no effect on them.

TTG 01-12-2007 09:13 PM

Great addition .. clicked install

Thanks calorie

KURTZ 01-12-2007 09:14 PM

thx for the tip calorie :D

good job!

chick 01-12-2007 10:24 PM

Well I hate to tell you but the vb options are BS... I have all the above email Addy's in there, 3 fold, before I installed your program and they got by. So far your mod seem to work the best.


All times are GMT. The time now is 07:14 PM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01573 seconds
  • Memory Usage 1,820KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (4)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (2)pagenav_pagelink
  • (1)pagenav_pagelinkrel
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (40)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 

Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete