Spam bots defeat Recaptcha.

[NeitherSparky]

I installed Isbot and that one image verification mod last night, and I only got one registration since, this morning: "twigger4life" with a birthdate of Jan 1, 1980. I'm guessing this is a spammer from the birthdate. None of the spammers I got yesterday though had that birthdate but they spammed so yes, they were spammers. Anyways this one's activation email bounced so they won't be getting in anyways. Dunno if anyone else has gotten a registration from "twigger4life".

[paperthreads]

couple more:

user name: lrdldu
email: [email protected]
ip: 221.201.98.74
DOB: 01-01-1980

user name: LRKSFAG
email: [email protected]
IP: 58.240.239.198
DOB: 01-01-1980

[EcoForumZ]

Like Akismet? vBulletin Options -> Spam Management.

I will give this a try.

Added Akismet key and created test user and it worked! So far so good.

[setishock]

Did any one happen to notice this prior to getting spammed?
213.180.206.189
turbospider.yandex.ru

[vitalie]

just popped up today:
Tcrubuyuuie
email: [email protected]
ip address: 222.183.121.247
date of birth is Jan 1, 1980

I've got this one too today on my board from a different ip address (222.183.124.191). I've already banned a few beijiboy users ... .

All those requests came from China and all look the similar to this:

222.183.124.191 - - [04/Jun/2008:11:21:18 +0300] GET /register.php?do=signup HTTP/1.1 "200" 20122 "http://www.******.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; 
SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:21:26 +0300] POST /register.php?do=register HTTP/1.1 "200" 31520 "http://www.******.com/register.php?do=signup" "Mozilla/4.0 (compatible; 
MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:21:26 +0300] GET /image.php?type=regcheck&imagehash=c9ee867e0b4ed45254e16b9a4c85b4a0 HTTP/1.1 "200" 10320 "http://www.******.com/register.
php?do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:21:34 +0300] POST /ajax.php?do=imagereg&imagehash=c9ee867e0b4ed45254e16b9a4c85b4a0 HTTP/1.1 "200" 111 "http://www.******.com/register.php?
do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:21:34 +0300] GET /image.php?type=regcheck&imagehash=5568e8b5c6ea1e138248d590ecdba890 HTTP/1.1 "200" 10257 "http://www.******.com/register.
php?do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:22:01 +0300] POST /register.php?do=addmember HTTP/1.1 "200" 23886 "http://www.******.com/register.php?do=register" "Mozilla/4.0 (compatibl
e; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:22:07 +0300] GET /profile.php?do=editsignature HTTP/1.1 "200" 29979 "http://www.******.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 
 5.1; SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:22:15 +0300] POST /profile.php?do=updatesignature HTTP/1.1 "200" 29484 "http://www.******.com/profile.php?do=editsignature" "Mozilla/4.0 (
compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
o.com/help/us/ysearch/slurp)" "74.6.12.58"
222.183.124.191 - - [04/Jun/2008:11:22:47 +0300] GET /register.php?a=act&u=56&i=31984333 HTTP/1.1 "200" 24108 "-" "Mozilla/4.0 (compatible; Windows XP 5.1; MSIE 6)" "-"

[MR K]

I will give this a try.

Added Akismet key and created test user and it worked! So far so good.

what you mean with 'test user'?

[Andy Huang]

Any post made by viagra-test-123 will be blocked automatically.

[surfdude]

I have just done a birthday search on my site and about 40 users showed up. I deleted all after looking at the names and domains. Imagine my forums 'Today's Birthdays' list on 1st of January if I did not do this?

Also, vBulletin people know there is a problem but they have no choice other than to downplay it. Imagine if they said 'Yes, it is cleat to us there is a huge spam problem with our product but we can't fix it at the momets. Still, go and buy it!'.

There will be a sudden announcement of a fix, but until that day we have to look for a solution ourselves.

[Steve Machol]

Yeah, we know there's a problem that we can control and we are purposely trying to 'downplay' it. That must be it.

P.S. We are not responsible for ReCaptcha. It's a third-pary application that we allow you to use as only one of the available verification options our Developers have added.

[surfdude]

121,941 posts at time of writing?!? Slightly off topic.

[baghdad4ever]

i enable only picture verification

and also the same

there r many of them in my forum

and i dont know how to do?

[Jason Buchanan]

I have a guest lurking around trying the permissions pretty hard. they have yet to try and register. Their ip is 150.70.84.41 shows it's origin is Japan.

[ryansmith]

This is not a vB 3.7.x issue. I am running vB 3.6.10 and I've banned every username mentioned in this thread so far.

I just ran through my members list and deleted every suspicious username with a birthdate of Jan 1, 1980 and also did a quick scan of gmail.com, 21cn.com, and sina.com email addresses. I deleted about 30 members, all with 0 posts, who were either "User Awaiting Email Confirmation" or were approved but hadn't posted yet.

I've installed Prevent Spam and I've set it to flag any post that contains a URL. I also have new member moderation turned on so that I have to approve each new registration manually.

Between these two options I hope to stop a lot of this nonsense. This has only become a problem in the last week or two.

[Wayne Luke]

222.183.124.191 - - [04/Jun/2008:11:21:18 +0300] GET /register.php?do=signup HTTP/1.1 "200" 20122 "http://www.******.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; 
SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:21:26 +0300] POST /register.php?do=register HTTP/1.1 "200" 31520 "http://www.******.com/register.php?do=signup" "Mozilla/4.0 (compatible; 
MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:21:26 +0300] GET /image.php?type=regcheck&imagehash=c9ee867e0b4ed45254e16b9a4c85b4a0 HTTP/1.1 "200" 10320 "http://www.******.com/register.
php?do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:21:34 +0300] POST /ajax.php?do=imagereg&imagehash=c9ee867e0b4ed45254e16b9a4c85b4a0 HTTP/1.1 "200" 111 "http://www.******.com/register.php?
do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:21:34 +0300] GET /image.php?type=regcheck&imagehash=5568e8b5c6ea1e138248d590ecdba890 HTTP/1.1 "200" 10257 "http://www.******.com/register.
php?do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:22:01 +0300] POST /register.php?do=addmember HTTP/1.1 "200" 23886 "http://www.******.com/register.php?do=register" "Mozilla/4.0 (compatibl
e; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:22:07 +0300] GET /profile.php?do=editsignature HTTP/1.1 "200" 29979 "http://www.******.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 
 5.1; SV1; .NET CLR 2.0.50727)" "-"
222.183.124.191 - - [04/Jun/2008:11:22:15 +0300] POST /profile.php?do=updatesignature HTTP/1.1 "200" 29484 "http://www.******.com/profile.php?do=editsignature" "Mozilla/4.0 (
compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
o.com/help/us/ysearch/slurp)" "74.6.12.58"
222.183.124.191 - - [04/Jun/2008:11:22:47 +0300] GET /register.php?a=act&u=56&i=31984333 HTTP/1.1 "200" 24108 "-" "Mozilla/4.0 (compatible; Windows XP 5.1; MSIE 6)" "-"

This is most likely human... They reloaded the image verification three times. You're not even using recaptcha.

[EcoForumZ]

This is not a vB 3.7.x issue. I am running vB 3.6.10 and I've banned every username mentioned in this thread so far.

I just ran through my members list and deleted every suspicious username with a birthdate of Jan 1, 1980 and also did a quick scan of gmail.com, 21cn.com, and sina.com email addresses. I deleted about 30 members, all with 0 posts, who were either "User Awaiting Email Confirmation" or were approved but hadn't posted yet.

I've installed Prevent Spam and I've set it to flag any post that contains a URL. I also have new member moderation turned on so that I have to approve each new registration manually.

Between these two options I hope to stop a lot of this nonsense. This has only become a problem in the last week or two.

I had all kinds of spammers then I configured "Akismet" in admincp and it has captured all spammers ever since. It does all the work for you.


This is the best solution!


Try it!