Spammers Registering Even After I Turned Registration Off ... How ?
 

Hi guys,

I've been getting spammed with new registrations alot even though I have the normal processes in place to stop them (the popular anti spam plugs etc). However what's really weird now is even if I turn off registration in the VB Admin, spammers are still registering to the site.

How is that even possible ?

When you turn registration off is it really going off? have you tried to register yourself after turning it off?

Have you installed all the latest security patches?

Yes tested it and I can't register atm. I have latest securitys patches installed. Baffled !

PM me a link and i'll have a quick look later today when im at home.

Do you have facebook connect enabled? I'm not sure if disabling registrations stops people from linking to a facebook account.

simom PM sent.

kh99 they Ive disabled facebook connect to see if that helps.

bump

ive long said something is up. My Q&A questions cant be guessed by a bot and they always get in. For years people have said "Oh a human must enter your answer" ya right.

Have you checked the web server logs to see if they're doing it through register.php, or if there's anything strange in the logs?

Maybe you could try this and see if it helps: https://vborg.vbsupport.ru/showthread.php?t=297834

which logs are you refering too ? vbulletin or server ?

Kevin is talking about your server access_logs. If you don't know where they are, ask your host.

Are you sure these users registered after you turned it off and they aren't simply spammers that registered a few days ago and are now spamming the site?

k I'll take a look at the server log. They are registering now and constantly. I've just installed the rename reg page plugin and turned reg back on.

Will report back. but still confused as to how spammers were/are able to register ever after I turn reg off in admincp

Yeah, like Lynne says, if you haven't already, make sure that they are new registrations on not old ones that never posted. As for the logs (assuming they are new registrations), I was thinking get the registration ip of one of them, and then search the web server access logs to see which scripts they accessed.

ETA: Also if you haven't already you might try disabling all plugins. Maybe an addon is inadvertently allowing registration even though you have it turned off.

They are new reg's I'm getting constant email alerts.

I'm looking at the log now and trying to make sense of it.

They are obv using proxies to register as each reg has a new IP.

--------------- Added [DATE]1371585348[/DATE] at [TIME]1371585348[/TIME] ---------------

It's stange because they are able to register even with filling in custom required reg fields that I've set as required.

I've just disabled all plugins to see the resuts - good idea.

Do you have any primary Users Awaiting Email Confirmation..

90725

I would check if your mysql server is exposed either directly via port 3306
or do you have any web- based management tools like Webmin/ Cpanel or PhpAdmin installed?

Has any solution been found for this? We just received 4500 registrations yesterday, all spammers. They have found a weakness. We turned off the registrations now but we are trying to find out how they are getting by the verification system.

Thanks

Have you installed any plugins to stop spammers if not then you should

My issue was I had a lot of spammers registrations that signed up in dec 2012. They didn't activate their accounts until recently via the email confirmation. So have a look at your 'Users Awaiting Confirmation' group and if necessary clean/dump it. This is what happened to me and I was so confused as I'd turn off registations yet they were still registering, but they wern't actually registering at that point, they were simply activating accounts that they registered in the past. Take a look at the signup date of some of the new accounts as look at the registration date.

--------------- Added [DATE]1371744162[/DATE] at [TIME]1371744162[/TIME] ---------------

BTW thanks to everyone who chipped in on this post to help really cool. One question tho, I want to either mass move all the 90000 spammers from 'Users Awaiting Email Confirmation' to either 'Banned by Moderators' group or just delete them. THe problem is in the prune users option in the backend it only seems to do it in around 1000 at a time. Then I have to do it again. This is really time consuming is there a better way ? I've heard running direct database commands is risky.

Yes, spam-o-matic is moderating nearly all of their threads but we can't find how to easily delete over 6000 spammers that have registered in the last 2 days.

Can't prune/move more than 1000 users at a time in the admincp. The "users awaiting email confirmation" usergroup has more than 6000 new users from the past 2 days. No way to get that log under 1000 and no way to manually tick 1000 checkboxes without modifying code with javascript.

You would need access to your php.ini file in order to change max_input_vars to something larger than 1000.

I edited admincp/user.php to change the "Join Date is Before" parameter for do=prune to search after a certain date so I can limit the results to those from 2 days ago until now. With the help of a macro to tick 999 checkboxes at a time, over 10k accounts now banned and things are back under control.