The Arcive of Official vBulletin Modifications Site.It is not a VB3 engine, just a parsed copy! |
|
|
#1
|
||||
|
||||
Timed delay of register.php?do=addmember posting to slow spambots
I've discovered that the Xrumer/Botmaster spambots will submit register.php?do=addmember just seconds after register.php?do=register. While humans take a minute or more to fill out the registration form, bots do it instantly. Here's some evidence from my logs:
87.240.15.25 - - [16/Dec/2006:07:00:41 -0500] "POST /forums/register.php?do=register HTTP/1.0" 200 22180 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)" 87.240.15.25 - - [16/Dec/2006:07:00:45 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22579 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)" 87.240.15.25 - - [16/Dec/2006:07:00:49 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22576 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)" 87.240.15.25 - - [16/Dec/2006:07:00:57 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22579 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)" 87.240.15.25 - - [16/Dec/2006:07:01:00 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22579 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)" Note the times: 07:00:41, 07:00:45, 07:00:49, 07:00:57, 07:01:00. Five hits in 19 seconds. Here's one that just rolled in a few seconds ago. The IP (193.69.180.120) is a Swedish proxy. 193.69.180.120 - - [16/Dec/2006:15:10:15 -0500] "POST /forums/register.php?do=register HTTP/1.0" 200 22177 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" 193.69.180.120 - - [16/Dec/2006:15:10:19 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22860 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" 193.69.180.120 - - [16/Dec/2006:15:10:22 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22861 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" 193.69.180.120 - - [16/Dec/2006:15:10:25 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22861 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" 193.69.180.120 - - [16/Dec/2006:15:10:29 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22860 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" Five hits between 15:10:15 and 15:10:29 - 14 seconds. I think that it attempts to break the captcha, fails, and tries again. After four or five failed attempts, the bot is programmed to give up and move on to the next victim. Anyhow, I'd like to see a mod that prevents posting or submittal of register.php?do=addmember until a minute or more after it's been displayed. This might not stop Xrumer and other spambots, but it will slow them down; a way at getting back at them. The mod seems relatively simple, but I lack the skills to program it. Any takers? EDIT: Yes, I know about the other hacks to prevent spam. I get very little spam on my board, thanks to a strong CAPTCHA and an extensive emailblacklist, among other security measures. I'm just looking to slow the bots down. If enough people install such a mod, we could dramatically slow the rate of spamming, and makethe bots less effective. |
|
|
X vBulletin 3.8.12 by vBS Debug Information | |
---|---|
|
|
More Information | |
Template Usage:
Phrase Groups Available:
|
Included Files:
Hooks Called:
|