Suspicious request emails sent from Forum

[Art Andrews]

From time to time, I get an email from my forum titled "Suspicious Request"

It almost always pertains to someone trying to register on the site, but never really supplies enough information to know what the exact problem is or even what is generating this email. I did my research and only see two other people who have brought this up in the two threads linked below:

http://www.vbulletin.com/forum/forum...icious-request

http://www.vbulletin.com/forum/forum...input-register

Neither seemed to get answers on the source of the email although vBulletin indicated it was a plugin and not the core software. One person thought it was cPanel, but that isn't the case because we don't run cPanel.

The content of a typical email looks something like this:

Cinput: register


Forum: http://www.therpf.com

IP: 183.160.121.253
User-agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Request: /?page=login&cmd=register
User: Unregistered

GET: array (
  'page' => 0,
  'cmd' => 'register',
  'pagenumber' => 0,
)

POST: array (
  'ajax' => NULL,
)

COOKIE: array (
  'bb_lastvisit' => 1384691004,
  'bb_sessionhash' => '7ee094053fd45c1989c8e41c6f80afb7',
  'PHPSESSID' => 'vh8f9aq3v5t6p2gpu0mf2kdoc0',
  'bb_lastactivity' => 0,
  'vbulletin_collapse' => NULL,
  'bb_referrerid' => NULL,
  'bb_userid' => NULL,
  'bb_password' => NULL,
  'bb_threadedmode' => NULL,
  'bb_userstyleid' => NULL,
  'bb_languageid' => NULL,
  'bb_skipmobilestyle' => NULL,
  'bb_fbprofilepicurl' => NULL,
  'bb_forum_view' => NULL,
  'vbulletin_sidebar_collapse' => NULL,
)

We use a number of plugins, but I can't find any that seem to be responsible for these emails. Does anyone have any idea what is generating them?

[tbworld]

If you have access to shell commands on your server, you can use 'grep' to search your files.

[Art Andrews]

I have full access to the server, but I am not sure what I would searching for.

[Lynne]

I can tell it isn't from the software, but I don't know exactly what it's from. I would guess it's from some server script.

[Art Andrews]

Could it possibly be tied to people trying to register with the facebook connect feature?

[ForceHSS]

Do you have tapatalk installed