Spam bot (I think) from multiple IP addresses

[nadreg]

Hi all,

Starting from about 1 week ago, I started getting a lot of traffic from "direct users" hitting my forum. I looked deeper into this, and noticed the following behaviour:

1. The traffic is going almost completely to the register.php page
2. I am not seeing a lot of "fake" registrations on my site, and by fake I mean the man/male standard crap that these things register with.
3. As for the IPs that this traffic is coming from, it's from primarily these countries: Thailand, Turkey, Brazil, South Korea. Traffic from these destinations is very rare on my site, which is primarily about India.

Has anyone seen an attack like this before? The traffic from multiple locations is what baffles me. Is this a sophisticated attack, or is IP spoofing that easy to do these days?

I'm thinking of installing the Is Bot hack to prevent further registrations, by the way. I read some good reviews on it.

Any help is sincerely appreciated.

[Dismounted]

<a href="http://www.vbulletin.com/forum/showthread.php?t=288234" target="_blank">Forum Robot Spam Prevention Suggestions</a>

[nadreg]

Hi,

Thanks for the thread, and I had read it before. My question was more to the behaviour that these bots seem to be exhibiting. The patterns I am seeing are:

1. The countries the attacks seem to be coming from are: Thailand, Turkey, South Korea, Poland, Vietnam. There are more, but these are the top 5.
2. Previously, the bots were hitting the registration page, but now are just parked on the homepage. I suspect a scraping going on, but haven't seen any content show up on other sites yet.
3. The traffic to the homepage really picked up 4/1 onwards.

What I've done so far is:
1. Install bot-trap, which has been somewhat effective. but it doesn't trap these bots, since they don't seem to be crawling the site.
2. Ban ips as I identify through iptables.

Unfortunately, neither of these seem to be too effective with this attack.

Has anyone seen a similar pattern, and if so, how did you deal with it?

Thanks!

Hanson's suggestion is the only thing we can do here, because a simple script can not block everything coming from the outside of your own computer... best thing is to require email verification and one of the authentication system that exists already...

remember that now with the spam bots, 25 to 50% of them are not bots but humans paid to post...