SpamBots xRummer et al, bypass validate code??

[pattycake]

Well,... I just installed a demo version of xRumer and ran it, using my website as a test. The "demo" version of the program uses an email address of:
xrumeremailYOYYY@maildomainJJKUJ.com
Username: XRumerYGQYY

Obvioulsy, this is an invalid email address.

Guess what??? It got signed up.... no validation email, no "vaidation code"... and yet there he was, a new member at my site.

[Max Taxable]

Did you have settings in that demo for a delay?

--------------- Added [DATE]1351210745[/DATE] at [TIME]1351210745[/TIME] ---------------

Okay... I did what you did. Got the XRumer demo, and then disabled ALL anti-spam and human verifications on my board, except for the email verification, and let it rip.

Nothing happened. Registration failed, although in the logfile XRumer THINKS it successfully registered.

So, I'm starting now to think your scripts are somehow compromised making it a one-board problem.

[pattycake]

Nope... no "settings for delay" in demo version. I wonder if it's in the real-mc-coy paid versions?

what version do you have?

[Max Taxable]

Originally Posted by pattycake

Nope... no "settings for delay" in demo version. I wonder if it's in the real-mc-coy paid versions?

You asserted it was:

Originally Posted by pattycake

the time between registering has long since been defeated by XRumer. They even have a setting of waiting 5, 10, 15, 20, and 30 seconds.

Originally Posted by pattycake

ok... whatever, I'm just telling you that the new XRumer has an option to use the delay. YMMV

And my assertion is, the time delay is SO relatively new and SO underused, they likely don't even know about it. Not trying to be snarky, just trying to discover the truth of the matter.

Interestingly, with all of my anti-spam and human verification active, XRumer reported it did successfully register (it did not) and said it was logged in and "probably" posting. BUT - it said there were "extra protections on this forum."

what version do you have?

It says "5.0 palladium" and the file version is 5.0.0.747

[pattycake]

ditto here... if I activate my spam code, it stops xRumer... I had to disable all of that to run the test above. As yours, the logs shows "extra protections on this forum".

I am going to put a sniffer on the line and watch the process to see what it is sending.

btw: I did install "IsBot" and it's definitely doing a job. I added a few calls to a database so I could keep track of failed (and "allowed in") attempts. I have a several log entries showing a time of: (1350415378 seconds transpired). All are the exact same "1350415378". I wonder if thats their fix? I changed the name of the vars to something else and haven't seen an entry like that since.

[Max Taxable]

Originally Posted by pattycake

ditto here... if I activate my spam code, it stops xRumer... I had to disable all of that to run the test above. As yours, the logs shows "extra protections on this forum".

I am going to put a sniffer on the line and watch the process to see what it is sending.

btw: I did install "IsBot" and it's definitely doing a job. I added a few calls to a database so I could keep track of failed (and "allowed in") attempts. I have a several log entries showing a time of: (1350415378 seconds transpired). All are the exact same "1350415378". I wonder if thats their fix?

Wait, perhaps I misunderstand. You were telling us the XRumer registered anyway, bypassing the email validation and indeed, a new account was showing up on your forum. Am I misunderstanding?

Also, IsBot is obsolete as of three days ago - I commissioned a coder here to update it with AdminCP controls and more features, find that here for vB3.x.x:

Bot Blocker 3.x.x

And for v4:

Bot Blocker 4.x.x

[pattycake]

Correct... isBot and my own custom "spam killers" were already stopping xRumer but I wanted to get to the bottom of this so I disabled isBot and all of my custom scripts... then I ran xrumer and, it did indeed create a new account.

After I confirmed that it created the new account, I re-enabled isBot and my custom scripts.

Tomorrow I will install the sniffer and then we'll see exactly whats going on.

Also, IsBot is obsolete as of three days ago - I commissioned a coder here to update it with AdminCP controls and more features, find that here for vB3.x.x:

awesome... I'll give it a try. thanks for the heads up.

[Max Taxable]

Originally Posted by pattycake

Correct... isBot and my own custom "spam killers" were already stopping xRumer but I wanted to get to the bottom of this so I disabled isBot and all of my custom scripts... then I ran xrumer and, it did indeed create a new account.

After I confirmed that it created the new account, I re-enabled isBot and my custom scripts.

Tomorrow I will install the sniffer and then we'll see exactly whats going on.

I would be checking my vB folders and files for something amiss...

[pattycake]

Originally Posted by Max Taxable

I would be checking my vB folders and files for something amiss...

the only thing different from the original installation is some coding I did in register.php to disallow certain email hosts. Other than that, all code is the original, all folders are the same, etc. It's a clean install.

No worries, the sniffer will show everything.... everything coming in, and everything going out.

[Max Taxable]

Well, I'm not really worried, since I verified I don't have this issue. Just trying to be helpful.