Trying to learn about spammers and bots - some interesting results!

[Quarterbore]

I have been very busy with a couple projects and work the past few months and I have one vbulletin forum that is not very active that I had not checked in on for about 2-months (big mistake but I am going to make the most of it).

During the 2-3 month period my site but have been included onto every spam bot posting list as I had in the order of 2000 NEW MEMBERS (by far mostly bots) and about 10,000 new posts and threads (porn, drugs, a real mess!).

So, I got an e-mail from a visitor/member making me aware of the problem and the past week I have been locking the site down to keep the bots out. To do this I have added the following hacks that have been posted here at vBulletin.org:

NOSPAM
Is Bot
IPNoRegister
SpamBuster
Prevent Spam Posts
Timezone block (suggested in this thread)

Now, when I added these various tools to the site I still had problems with bots getting onto the site. I learned that the bots automatically come to my site to register and post their spam BUT there is a human component that allows these bots to "learn" from their experience.

Specifically, in my logs I could see where the bots would get rejected (because they could not answer the NoSpam question. The bots would take a few seconds to be rejected and sometimes I would see a slower pinging of the registration page were I assume a person making a list of questions and answers that were programed into the bots.

After this, the bots were able to get onto the site and corectly answer the NoSPam question. At this point the Spambuster and Prevent Spam Posts worked together to self moderate the spam.

Now, to supplement these three tools, I then took the problem e-mail domains and ip addresses and added them to the vbulletin blocking mechanism as well as my own IPNoRegister hack.

Now, in order for me to understand how this was happening I also rewrote parts of the hacks above and included a little code that logs all registration attempts. Over the past 2-weeks I have not had a single post get posted in my site that I did not want and as near as I can tell I have not impacted members I wanted.

In the following two posts I will share two of my logs. Note that I have removed some registration info for cases were the person was a real member but you can see that in the logs! I hope this info helps someone that has also been infested with these dambed bots learn something that can be used to keep them out!