Miscellaneous Hacks - Stop the Registration Bots

Control your vBulletin forum registration process and stop the registration bots.

This mod will check the the time it takes for a vBulletin registration form to be submitted. If the form is submitted faster then humanly possible, the registration will be denied and the admin contact will be emailed about the event. The time is settable

We will start the registration on the forum rules page in two ways. First we will add a custom hidden field with a hash. Second we will insert a randomly named hidden field with a random value. This should make it a bit difficult to program a bot since the field names on all sites will be different as well as the values.

We will use a second set of random hidden fields on the form page as well to add to the confusion.

Time stamps to check the time spent on registration submission are stored in a DB table and private.

A registration will have to come through the Rules page and the form. Every Site will be different.

Installation is very easy.

There are two templates to edit.
One database table is added.
Three hooks are utilized.
Includes uninstall code.
Adds to vBulletin options.
Set time frame option.
Includes Phrases.
Sends Mail to Admin.
No files to upload.
XML product install.
Instructions attached in zip.

Demo usage and view source at http://www.riderinfo.com/

Compatibility
This hack is known to work on vBulletin 3.6.11 PL1 and will likely work back a few versions in the 3.6.x vBulletin series. Of course it works on 3.7.x as posted too.

HISTORY
1.2.2
added admin email on/off setting
moved hook code to files to reduce overhead.
1.2.1
Added Enable/Disable setting.
Fixed coppa includes file probem
Added file upload instructions to readme file.
1.2.0
Added JS timer to registration button.
Added enable/diable for email.
Removed ACP settings for random fields on rules and reg form pages and automated.
Reworded Pharses in ACP.
Recoded rules form and reg form edits.
Renamed variables for better code following.
Added more DB fields per user reg for tracking random automation.
New Hook on start_registration for functions.
Added new functions file. includes/stb_functions.php.
1.0.3
Changed input user name on rules form to random named hidden field with hash value.
Removed \n chars from email phrases.
All changes to registration are transparent to the folks registering.
Renamed DB username field to hash.
New hook on register_signup.
1.0.2
Added new Pre Reg Name hidden field to register form edits and ACP.
Added code to deal transparently with user deciding to change name after pre submitting it.
1.0.1
Fixed typo, changed 36000 to 3600 in product file.
1.0.0
Original Release.

[Vaupell]

installed on 3.8 easy and works like a charm..

[King Fly]

yeah this has to be easily one of the best mods i have installed

i used to have at least 10 bots per day signing up

now i get none

and the emails stopped coming after like 2 weeks so im good with that

[GR-Flame]

Installed.

I did notice a typo in the admincp options:

Enable checks for registraion bots?

Forget to cross all your Ts? lol

[RS25com]

Any possibility to add an IP ban to the system, such as the login strikes system that gives you a number of attempts before locking you out? Just the other day I had over 38,000 attempts at creating a new account. After 5 tries, I would like to add the IP address to a 1 to 24 hour ban list. If it could update the .htaccess file that would be even better (to reduce the load on the server).

[losteddesirees]

will be nice to hear new updates about your great addon ( just upgrade my forum to 3.80 and its seems something go wrong ) lets hope I`ll not have too much to fight with spams anymore

[farplane dragon]

Originally Posted by RS25com

Any possibility to add an IP ban to the system, such as the login strikes system that gives you a number of attempts before locking you out? Just the other day I had over 38,000 attempts at creating a new account. After 5 tries, I would like to add the IP address to a 1 to 24 hour ban list. If it could update the .htaccess file that would be even better (to reduce the load on the server).

This,

Or at the very least, the option to view the IP of the user that got blocked?

[RS25com]

The reality is that the ajax.php file simply needs to have some code put into it. I'm fine with hard-coding something.

if ($_POST['do'] == 'imagereg')
{
	$vbulletin->input->clean_gpc('p', 'hash', TYPE_STR);

	$xml = new vB_AJAX_XML_Builder($vbulletin, 'text/xml');

	if ($vbulletin->options['hv_type'] == 'Image')
	{
		require_once(DIR . '/includes/class_humanverify.php');
		$verify =& vB_HumanVerify::fetch_library($vbulletin);
		$verify->delete_token($vbulletin->GPC['hash']);
		$output = $verify->generate_token();
		$xml->add_tag('hash', $output['hash']);
	}
	else
	{
		$xml->add_tag('error', fetch_error('humanverify_image_wronganswer'));
	}
	$xml->print_xml();
}

Anyone who hits this section of the file more than 5 times in a minute can go goodbye as far as I am concerned.

[FamilyCorner]

Installed, thanks so much!

[Vaupell]

uhh uninstalled, had 3 people sending me mail / pm registration did not work for them.
the secound i disabled the mod it worked, they could register.

It always after forum rules said, missing field.
when i tryed registering alts, worked fine, but saw it on my laptop
didnt work. so not sure how or why, but disabled.

still love the mod.

[SEOvB]

I dont think its fully 100% 3.8 compatible from what I'm seeing so far.