Timed delay of register.php?do=addmember posting to slow spambots

[Cyburbia]

I've discovered that the Xrumer/Botmaster spambots will submit register.php?do=addmember just seconds after register.php?do=register. While humans take a minute or more to fill out the registration form, bots do it instantly. Here's some evidence from my logs:

87.240.15.25 - - [16/Dec/2006:07:00:41 -0500] "POST /forums/register.php?do=register HTTP/1.0" 200 22180 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
87.240.15.25 - - [16/Dec/2006:07:00:45 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22579 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
87.240.15.25 - - [16/Dec/2006:07:00:49 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22576 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
87.240.15.25 - - [16/Dec/2006:07:00:57 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22579 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
87.240.15.25 - - [16/Dec/2006:07:01:00 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22579 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"

Note the times: 07:00:41, 07:00:45, 07:00:49, 07:00:57, 07:01:00. Five hits in 19 seconds.

Here's one that just rolled in a few seconds ago. The IP (193.69.180.120) is a Swedish proxy.

193.69.180.120 - - [16/Dec/2006:15:10:15 -0500] "POST /forums/register.php?do=register HTTP/1.0" 200 22177 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
193.69.180.120 - - [16/Dec/2006:15:10:19 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22860 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
193.69.180.120 - - [16/Dec/2006:15:10:22 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22861 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
193.69.180.120 - - [16/Dec/2006:15:10:25 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22861 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
193.69.180.120 - - [16/Dec/2006:15:10:29 -0500] "POST /forums/register.php?do=addmember HTTP/1.0" 200 22860 "http://www.*****/forums/register.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"

Five hits between 15:10:15 and 15:10:29 - 14 seconds.

I think that it attempts to break the captcha, fails, and tries again. After four or five failed attempts, the bot is programmed to give up and move on to the next victim.

Anyhow, I'd like to see a mod that prevents posting or submittal of register.php?do=addmember until a minute or more after it's been displayed. This might not stop Xrumer and other spambots, but it will slow them down; a way at getting back at them. The mod seems relatively simple, but I lack the skills to program it. Any takers?

EDIT: Yes, I know about the other hacks to prevent spam. I get very little spam on my board, thanks to a strong CAPTCHA and an extensive emailblacklist, among other security measures. I'm just looking to slow the bots down. If enough people install such a mod, we could dramatically slow the rate of spamming, and makethe bots less effective.

[delaen1]

What if people type fast? I can fill out a standard sign-up form in about 15 seconds or so. You'd probably end up blocking just as many legit people as bots. I would think a 10 second wait or so would be sufficient.

[Cyburbia]

Originally Posted by delaen1

What if people type fast? I can fill out a standard sign-up form in about 15 seconds or so. You'd probably end up blocking just as many legit people as bots. I would think a 10 second wait or so would be sufficient.

You mean you can fill out the username, password, password confirmation, email address, email address confirmation, captcha, additional required fields like real name and location, time zone, DST setting, and recieve admin email fields in 15 seconds?

I checked out my log files, and very, very few legitimate users take less than a minute to fill out the registration form. The bots, on the other hand, only take seconds. If I have that one-in-a-hundred user like you, who's a speed reader and 250 WPM typist, I guess they would have to wait a while 40 or 45 minutes until they can hit the "submit" button.

Besides, wouldn't a good mod allow the admin to set the timing?

IMHO, a mod like this would be a lot more useful than the gazillion "Who has read the FAQ in the past 24 hours"-style stats mods.

[calorie]

https://vborg.vbsupport.ru/showthread.php?t=135094

[delaen1]

Originally Posted by Cyburbia

You mean you can fill out the username, password, password confirmation, email address, email address confirmation, captcha, additional required fields like real name and location, time zone, DST setting, and recieve admin email fields in 15 seconds?

I didn't realize you had that many additional required fields to fill out or that you were counting the email verification time in there.

And yes, I can fill out a standard username, password, password confirm, email/email confirm and captcha in about 15 seconds. I can only type about 50 WPM, but like a lot of people I can type those few things a boatload quicker than everything else since I have to do it often.

EDIT: Actually, not vbulletin captchas. Those usually take me about 4 times to get right since 80% of them are unreadable for even humans.

[Cyburbia]

Fantastic! Let me try out the mod, and see what it looks like in the logs.