Anti-Spam Options - Automatically deny registration for users with multi-dotted email address

On my forum many bots have multi-dotted email address so I wanted to avoid them to create a new account on my forum.

The way to do this is create a new plugin to recognize these multi-dotted email address provided at time of registration and delete them automatically.

Steps:

• Create a new plugin using hook userdata_start

• Use this code:

$this->validfields['email'][VF_CODE] = '
    $max_dots = 1;
    if ($retval = $dm->verify_useremail($data))
    {
        $parts = explode("@", $data);
        if (is_array($parts) && substr_count($parts[0], ".") > $max_dots)
        {
            $dm->error("bademail");
            $retval = false;
        }
    }
    return $retval;
';

It only checks the part before the '@', so set $max_dots to the number of dots you will allow (I think one dot in an email name probably isn't unusual, but that's up to you). Also, this uses the default 'bademail' phrase, but if you'd rather have a special error messages for "too many dots" you can create a phrase and use the varname in place of 'bademail'.

Special thanks to kh99 who provided this solution.

[kh99]

Originally Posted by djbaxter

Slight modification to prevent commas, semicolons, and colons, since I got another Chinese bot this morning trying to register with the email "liantianha,ofangjiancong@gmail.com"...

Hmm, that's interesting because that code should still be calling the existing is_valid_email() function, which does a preg_match using some complicated pattern which looks like it doesn't allow commas in the name (or semicolons, for that matter). Maybe it's not calling that function like I think it is.

ETA: no, I'm wrong somewhere, because commas are allowed even if I disable this plugin. So, good addition.

ETA: actually it looks like it's a vb bug, a problem in that pattern. It contains "+-/" which allows characters from + through /, which are "+ , - . /". The effect is only to allow commas when they shouldn't be allowed (the - should be escaped, or listed first or last).


(I missed your post, nhawk - did you beat me to it?)

[dilbert]

I'm not knocking the mod, but what about people with legitimate periods in their email?
An interesting note for Gmail users, the number of periods is irrelevant.
myusername@gmail.com it the same as
my.user.name@gmail.com or
m.y.u.s.e.r.n.a.m.e@gmail.com.

[Boofo]

Most likely, if you're using:

m.y.u.s.e.r.n.a.m.e@gmail.com

then you are spamming.

[djbaxter]

Originally Posted by dilbert

I'm not knocking the mod, but what about people with legitimate periods in their email?
An interesting note for Gmail users, the number of periods is irrelevant.
myusername@gmail.com it the same as
my.user.name@gmail.com or
m.y.u.s.e.r.n.a.m.e@gmail.com.

It's your choice but you can set the number of allowed periods here:

PHP Code:

$max_chars = array("." => 1, "," => 0,  ";" => 0, ":" => 0); 


Change that =>1 to =>2 or =>3 or whatever. Actually, on reflection, I went back and changed it to 2 on my forums.

But Boofo is correct: if you have more than 1 or 2 you're probably up to no good anyway.

Added: This works fine on a vBulletin 3.87 forum as well as 4.x.

[dilbert]

OK, just pointing out that at least Gmail ignores any periods before the @.

[Boofo]

And that is exactly why you see a lot of gmail spammer addresses.

[dilbert]

Yeah but...
They are the same address. Try it if you have Gmail. Send yourself something with a few extra periods before the @, it will still be delivered.
I don't want to keep taking this off-topic though.

[djbaxter]

Originally Posted by dilbert

Yeah but...
They are the same address. Try it if you have Gmail. Send yourself something with a few extra periods before the @, it will still be delivered.
I don't want to keep taking this off-topic though.

No. Gmail may ignore them but most email clients and servers do not. And either way, it's a signal for spam that personally I want to eliminate/prevent.

[The Rocketeer]

Originally Posted by Boofo

If you use email verification, that should catch the phony email addresses so they wouldn't be able to register, anyway.

Are you sure Boofo?:erm: I use email verification (require clicking the activation link in the email sent after registration). However we get quite some bogus email members who are able to register. So you could use a bogus email to register.

wish there was better ways to prevent spammers..

was sent here from here https://vborg.vbsupport.ru/showthread.php?t=283667

[djbaxter]

Originally Posted by The Rocketeer

Are you sure Boofo?:erm: I use email verification (require clicking the activation link in the email sent after registration). However we get quite some bogus email members who are able to register. So you could use a bogus email to register.

wish there was better ways to prevent spammers..

was sent here from here https://vborg.vbsupport.ru/showthread.php?t=283667

Answered in that thread at https://vborg.vbsupport.ru/showpost....22&postcount=3