[pattycake]

the time between registering has long since been defeated by XRumer. They even have a setting of waiting 5, 10, 15, 20, and 30 seconds.

Even if XRumer couldn't get around it like they already have, there is still something wrong in the registration process that is allowing people to validate without knowing the validation code. Thats the issue at hand. Not how to reduce spam, etc... but... how are they bypassing the validation. Something in VB is letting them in.

If you want to at least make XRumer stumble, and this is straight from XRumer:

http://www.blackhatworld.com/blackha...r-posters.html

1. edit the footprints
2. edit the code that detects fields
3. make a custom human verification field
4. don't auto approve accounts

ie, Edit the footprints - XRumer goes to your index.php and looks at the meta tag to see if and what version of vbulletin is being run. Go edit that meta tag and you won't get found by a script. I even changed mine to display "phpBB 1.4" so that they use the wrong script on my site.

ie: Make a custom human verification field - I have a radio button field in registration.
Spammer Check: Are you a script/bot to help you scam (default is YES). Or are you a real; human being?
Every one of the 500+ scripts that has hit my site has failed that question. I could automatically delete their acct iof they don't answer correctly but just to be safe, I don't automatically delete the account - I coded it so they are set to a Coppa user meaning... they cannot post, and have to be manually validated. All legit members bypass that Coppa stuff.

Wanna know another method? Change the name of "register.php". The XRumer script uses "register.php" - if it doesn't exist, it fails If you are using a Linux box, just capitalize the first letter so that it is "Register.php". Yes, there are numerous code changes that need to be made to handle the new name but it's fairly easy to "grep" and find all occurances of "register.php" in vBulletin. It took me less than 10 minutes to make all of the changes.

One more method: Change the regsitartion to use Ajax... All versions of XRumer implode when they hit that code.

Still though, the original question still exists - how are they able to validate without knowing the validation code?









.
.