Anti-Spam Options - Spambot Stopper - Prevent Spambots from Registering

What is it?
----------------------------
This mod rejects registrations where the form is filled out in less than a minimum time. You can configure one of the following actions to be taken when an automated registration is detected:

- Show a "No Permissions" page
- Display the "Successful Registration" message but without creating an account
- Redirect the user to any URL you choose
- Reload the registration page with an error message of your choosing

You can also provide a list of email addresses to be notified each time a registration is blocked.

Added for version 1.1.1: Time delay enforcer, maximum time option, time limits to cut down on email notifications, posting to a thread.

In the future, I'd like to add some simple logging and statistics, and a summary type of email notification (because people seem to quickly get tired of the single emails).

Note: I coded this myself from scratch, but I would like to acknowledge a couple of previous mods that used this same idea, by users Calorie and noppid, and maybe others. In any case, I believe this one adds some features that the others don't have.

Other advantages: no ads or links, no abuse of update notifications, no disappearing features, no threats to delete the mod (it will never be deleted, at least by me). Also, translations are allowed.

Installation:
----------------------------
1) If you have "Is Bot", "Stop the Registration Bots", "Spammers Suck!", or another mod that works on registration time, note any admincp settings for that mod then uninstall it.

2) Import the product XML file from the Product Manager.

3) Go to Settings > Options > Spambot Stopper Options and configure the desired settings.

4) IMPORTANT: try to register a new user to make sure that there are no problems with humans registering. If you want, you can also temporarily set the minimum time to a higher value (like 60 seconds) and test to see if the spammer rejection is working.



History:
----------------------------
1.1.1 (Feb 16, 2013)

• Added timer for enforcing minimum time
• Added maximum registration time limit
• Added time limits for email notifications
• Added posting notificatiosn to a thread

1.0.1 (Feb 01, 2013)

• Fixed bug
• Added check for fake timestamps

1.0 (Jan 31, 2013)

• Initial Release

[kh99]

Sort of like max said, bots don't use the button at all. The button and the enabling/disabling only apply to a user using a browser. If you were to write a program to connect to a vbulletin site and submit a registration, you could simply ignore those things.

I would have to look at the code to figure out where you could add code to do something with the ip addresses. I'll look when I get a chance.

[Max Taxable]

Originally Posted by Phaedrus

I thought it disabled the button so that it couldn't be clicked.

Right. This is to prevent accidentally trapping a legitimate human. Therefore this Mod does nothing at all against human spammers. It's not designed to address those and doesn't claim to.

How do I get it to move IP addresses to the Miserable users?

I strongly advise against doing this. Today's spammer IP might be tomorrow's legitimate user, the way the spammers are now able to spoof legitimate ISPs.

[Phaedrus]

This mod rocks, it's blocked a ton of them. I'll have to do much less pruning in the future.

[sv1cec]

You could add a little piece of code, to add the bot's IP address to your banned IP addresses list, but the question is why?

The bots will not come back as humans, to register in your site. Their ... business plan is to attack as many sites as possible in the shortest possible time. That's the same reason, why they do not make their programs wait for 60 seconds, before hitting the "register" key.

I had such a routine in my antispam filter, in vB 3.0.xx. More than 60,000 IP addresses attempted to register (yeah, I was saving them in a table), in two and a half years (March 2nd, 2011 to November 23, 2013). Several of them came back more than one times. Always they were stopped by the "too quick registration" filter.

Unless you are prepared to run a special consolidation program, to identify similar IPs, it's not worth it entering the bots IPs in the banned IP addresses list.

What I would suggest, is that you use more than one traps for the bots. For example, this one, the one that checks the IP/email of the registering person against known spammers databases, as well as other traps. For example, use a special field in the registration form (for example, the registering person's country). Most bots do not bother entering that correctly. If you compare that field, with the location of the IP address, you can trap these bots.

So far, in my updated (vBulletin 4.2.2) site, about 98% of stopped bots are trapped by this mod, another 1.8% is stopped by comparing their IP/email to StopForumSpam database (there is a hack for that) and the rest .2% is trapped by my other filters.

[Max Taxable]

Originally Posted by sv1cec

You could add a little piece of code, to add the bot's IP address to your banned IP addresses list, but the question is why?

The bots will not come back as humans, to register in your site. Their ... business plan is to attack as many sites as possible in the shortest possible time. That's the same reason, why they do not make their programs wait for 60 seconds, before hitting the "register" key.

I had such a routine in my antispam filter, in vB 3.0.xx. More than 60,000 IP addresses attempted to register (yeah, I was saving them in a table), in two and a half years (March 2nd, 2011 to November 23, 2013). Several of them came back more than one times. Always they were stopped by the "too quick registration" filter.

Unless you are prepared to run a special consolidation program, to identify similar IPs, it's not worth it entering the bots IPs in the banned IP addresses list.

What I would suggest, is that you use more than one traps for the bots. For example, this one, the one that checks the IP/email of the registering person against known spammers databases, as well as other traps. For example, use a special field in the registration form (for example, the registering person's country). Most bots do not bother entering that correctly. If you compare that field, with the location of the IP address, you can trap these bots.

So far, in my updated (vBulletin 4.2.2) site, about 98% of stopped bots are trapped by this mod, another 1.8% is stopped by comparing their IP/email to StopForumSpam database (there is a hack for that) and the rest .2% is trapped by my other filters.

Yep always have more than one arrow in the quiver, so to speak.

Banning IPs is so 20th Century - today the botnet admins have the software set to spoof legitimate providers IPs anyway. Banning a spammer IP today means a legitimate user can't register tomorrow.

[sv1cec]

Still, maybe I had 10 complaints from people whose IP was banned and they were innocent. But those were dynamic IPs, so it doesn't mean they were banned in error.

A never ending war, that's what we are involved in, folks!

[Max Taxable]

Originally Posted by sv1cec

Still, maybe I had 10 complaints from people whose IP was banned and they were innocent. But those were dynamic IPs, so it doesn't mean they were banned in error.

One is one too many. Today there's nothing gained by banning IPs, it's ineffective and it's only going to block legitimate people.

A never ending war, that's what we are involved in, folks!

Yup.

Our challenge and meter is much more difficult than the spammers. Ours is, stopping the spammers without blocking or annoying legitimate people.

But... We are smarter and also better looking then the spammers, this is why they are bottom feeders to start with.

[sv1cec]

Originally Posted by Max Taxable

But... We are smarter and also better looking then the spammers, this is why they are bottom feeders to start with.

Can I show that to my wife?

[gxfreebies]

Installed this last night. works great on both my forums. using 4.2.0 PL3 and 4.2.2. Think they are great. Been looking for this a long time. Took me a while to find it. Glad I did.
You guys have a lot great ideas for combining to stop the spammers,thanks for sharing that.
I do however, have a question. I can't seem to get the registering member out of the moderation when registering. How do you guys do that. I want my members to be able to go right on in and start being active, not wait on me to accept them.
I have the random question, the email verification to activate, then it puts them into moderation to be accepted. How the heck do I get around that last part. What setting am I missing. I figure it is something simple I just havent seen. Please any insight would be grateful, I am going nuts trying to figure it out.

[Barcham]

It sounds to me like you have Moderate New Members set to 'YES' in your User Registration Options.