Stop the Registration Bots on your vBulletin Forum

[Greg]

Control your vBulletin forum registration process and stop the registration bots.

This mod will check the the time it takes for a vBulletin registration form to be submitted. If the form is submitted faster then humanly possible, the registration will be denied and the admin contact will be emailed about the event. The time is settable

We will start the registration on the forum rules page in two ways. First we will add a custom hidden field with a hash. Second we will insert a randomly named hidden field with a random value. This should make it a bit difficult to program a bot since the field names on all sites will be different as well as the values.

We will use a second set of random hidden fields on the form page as well to add to the confusion.

Time stamps to check the time spent on registration submission are stored in a DB table and private.

A registration will have to come through the Rules page and the form. Every Site will be different.

Installation is very easy.

There are two templates to edit.
One database table is added.
Three hooks are utilized.
Includes uninstall code.
Adds to vBulletin options.
Set time frame option.
Includes Phrases.
Sends Mail to Admin.
No files to upload.
XML product install.
Instructions attached in zip.

Demo usage and view source at http://riderinfo.com/forums/register.php

Compatibility
This hack is known to work on vBulletin 3.6.11 PL1 and will likely work back a few versions in the 3.6.x vBulletin series. Of course it works on 3.7.x as posted too.

Reported to work on vBulletin 3.8.2 as of May 2009.

Download here for vB 3.8.x: Stop the Registration Bots

Download here for vB 4.2.0 PL3: Stop the Registration Bots for vB 4.2.0

[bigH2O]

I finally had to install this mod. Was running smooth at linuxrigs until the man bots found me.

The mod works great, but if I could offer a couple of suggestions to think about when considering future features.

Can we limit the number of emails sent to the administrator to one per failed address? These bots seem to continue to hammer the registration process for hours after it fails. I'm getting 8 -10 emails about failed registration for each bot. The mod has stopped 14 bot registrations in the last 12 hours, and at 8-10 emails for each bot you can see how that can create a log jam of email.

Of course I can turn notification off, and for now most likely will, but it would be nice to have that information handy for analysis and comparison. I've already determined a couple of second level domains that will be permanently banned, and without the info from those emails I wouldn't have been able to discover that data, which begs the second option... can this data not just be logged to the server for comparison whenever you want? Even if these were just logged to a flat text file that I could pull off of the server whenever I felt like it, that'd be fine.

I'm sure either of these suggestions will muddy up the template mods more than they already are, which of course are already in the list of stuff to do for every upgrade (sigh), but I thought it was worth throwing out anyway.

[Greg]

Those are all doable and have been suggested. If I code a database and settings, it will be a premium version and probably cost $10.00 or so.

[bigH2O]

That sounds more than reasonable.

Just had one get through though. It had been pounding on the registration since early this morning... got probably 10 or more notifications of that particular user being blocked as a possible bot. They were fairly consistent in taking 2 seconds to process registration throughout all of those blocks, but I just got an email that that user was now a New User on the site. Typical man bot from typical .pl address. Wonder if they're getting smart?

[Greg]

I think they see the failures and come in by hand now and then. As you have seen, it's made us/me quite a target.

[bigH2O]

LOL... but would somebody noticing a bot script failing and coming in to register manually still think to fill out their public profile the same way? It's always the same information. "Profile" is always "Man", "Location" is usually "Ethiopia", but not always... usually an African country though. "Interests" is always the same as the User Name, and "Occupation" is always the same as the "Location" field. You'd think a human spammer filling that out wouldn't even bother with their profile. We don't require it for registration.

[Greg]

I've never really thought about how or why they do it. But yeah, that's hard to sort out logic wise. If I see too many bots on WOL, I manually change the codes sometimes. But as with anything, it's a measure. If they want in, they will get in.

But since it's, in my opinion for the most part, an effort in futility, I have to wonder why they continue. The payoff is not good that I can tell.

[Dave]

Latest study has shown that spammers get one sale for every 12 million views/emails.

Thats a sale ratio of trash, the reason it will never stop is because its all 100% automated after someone fills our that first form and presses the Go button

[Ohiosweetheart]

Greg, I asked this as vb.org but figured I'd go to the source here too

Do you plan to, or have you throught about, adding an option so that admins can choose not to receive the email? Many of my clients are asking for this.

(btw I recommend this mod to almost all of my new clients)

[Greg]

I will try and add that and post it for ya'll. Thank you very much!