Recent Flood of rogue registration attempts.

[JGRnava]

Earlier this year we had a lot of rogue registration attempts. Then for the last couple of months or so, that stopped. A few days ago it started again. Three today. These are mostly from foreign sources with email addresses that fail the click back and ignore the site membership requirements.

Is this something related to some issue with vBulletin earlier or does it mean that our site is being targeted. Thank you.

[Wayne Luke]

It means people are trying to register and spam your site. We have no idea why they would target your site. It happens and is part of running a website with registration. We get spam on this site daily. We delete it and ban the people who post it.

[JChaz]

Like all of us with open registration forums, these attempts are common, its nothing really to get too concerend about, but something you can keep on top of.

Checking new registrations on a daily basis takes a minute of your time. Any new registrations that are suspicious I generally just hit the delete button. Those that look genuine and have registered with an IP address which resolves to something I know, will be given a week to confirm regsitration before I grab the e-mail address and remind them they need to confirm registration. If I don't get a reply - the delete button is applied!

[Carrfixr]

Like all of us with open registration forums, these attempts are common, its nothing really to get too concerend about, but something you can keep on top of.

Checking new registrations on a daily basis takes a minute of your time. Any new registrations that are suspicious I generally just hit the delete button. Those that look genuine and have registered with an IP address which resolves to something I know, will be given a week to confirm regsitration before I grab the e-mail address and remind them they need to confirm registration. If I don't get a reply - the delete button is applied!

The Ipv6 addresses are not supported by the software. They come back as invalid when checking them. Yes many use services to mask their IP but it's still a lost tool that I miss

[Wayne Luke]

IPv6 is supported by current versions the software.

It is not currently supported by vBulletin Cloud due to infrastructure issues between its servers and Cloudflare. Currently this IPv6 support is turned off on vBulletin Cloud and Cloudflare will return fake IPv4 addresses. We will re-evaluate enabling this support again in the future when there is better support in the Cloud infrastructure.

[Wayne Luke]

We've disabled the "pseudo-IP Address" for IPv6. This means that Cloud sites should start logging IPv6 addresses properly.

Please note, these will not display correctly in some locations such as the Member's List on the front end until your cloud site is upgraded to 5.5.6.

[Carrfixr]

We've disabled the "pseudo-IP Address" for IPv6. This means that Cloud sites should start logging IPv6 addresses properly.

Please note, these will not display correctly in some locations such as the Member's List on the front end until your cloud site is upgraded to 5.5.6.

So after the next update, IPv6 will be displaying correctly? And this would also be correct on a new users registration.

[Wayne Luke]

As far as I am aware, this should be active now. The IPv6 issue on Cloud was not related to the vBulletin software but the Cloud network infrastructure and Cloudflare.

[Carrfixr]

Just curious why all these IPv6 I assume IP’s are all coming back to India
example


2601:44:0:50a0:b482:220e:82d0:30e

2601:144:8100:5510:7959:36ed:4bfa:ac41

[Wayne Luke]

I don't know why you're getting that location. I get Philadelphia, Pennsylvania for the first IP address and Ridgely, Maryland for the second. Though they can actually track to anywhere in the world through VPNs and proxies.

Maybe the tool that you're using doesn't track IPv6 addresses properly. I used: https://www.iplocation.net/

[Carrfixr]

I guess it was the tool
https://www.ipfingerprints.com/

Thanks i'll use the one that you posted from now on. I'm aware of the proxies and vpn's, but it is still a valuable tool to run all ip's. Indonesia does not have these old cars there and many are spammers

[Carrfixr]

It's nice to have the IP stuff working again. Thanks

[imager]

I've given up on open registration and now moderate all new members before they can post. That still means they can register with abusive names that can still be viewed until the spam registration is deleted.

[Wayne Luke]

You can prevent specific usernames from being used under Settings -> Options -> User Registration Options.

[JLChane]

You can prevent specific usernames from being used under Settings -> Options -> User Registration Options.

Is there any top-level IP blocking in the Cloud or do we continue to block problem addresses individually, or both?