register.php being attacked

[jo-jo]

I've had to turn registration off on my vBulletin because someone is hammering away at register.php, and eating up bandwidth. In just 12 days they ran up 380GB of bandwidth.

I was running 4.0.3; upgraded to 4.2, and have tried .htaccess, and vB Bad Behaviour to no avail.

How can I stop this malicious attack?

[TheLastSuperman]

They are more than likely using some type of program such as xRumer or similar...

Check your logs, also check your session table, see if there are similar ip's trying to register at the same time.

Once you find out the ip or several ip addresses simply ban them via htaccess, you may also want to contact your host about this to see if they have any server level alternatives depending on your hosting account type.

I've seen this before, using some methods outlined here I was able to reduce this then the clients host helped as well - https://vborg.vbsupport.ru/showthread.php?t=276547 scroll down to find "Session Table Issues?" and see if that helps.

[jo-jo]

Thank you for the response.

A lot of that is gibberish to me though. I'll have to set aside another day to try and learn up on this stuff.

This is so incredibly frustrating. Especially since my site is a hobby site that I offer up to the local community (Island4x4 dot com). The site doesn't generate a lot of revenue. Mainly just pays the hosting bills. I'd say I make about 10 cents an hour administrating it.

Starting to regret the day I installed vBulletin.

Someone needs to invent a way to send an electric shock across the Internet for these unscrupulous types. They are driving me insane.

[jo-jo]

It appears that the main culprit(s) was coming from IE6 browser. I had 89,000 hits on register.php in 3 days. I've blocked IE6 users, and am now down to about 300-400 hits on that file in the same time frame.

[ForceHSS]

<a href="https://vborg.vbsupport.ru/showthread.php?t=294164" target="_blank">www.vbulletin.org/forum/showthread.php?t=294164</a>