Announcement

Collapse
No announcement yet.

Spam bots defeat Recaptcha.

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • I installed Isbot and that one image verification mod last night, and I only got one registration since, this morning: "twigger4life" with a birthdate of Jan 1, 1980. I'm guessing this is a spammer from the birthdate. None of the spammers I got yesterday though had that birthdate but they spammed so yes, they were spammers. Anyways this one's activation email bounced so they won't be getting in anyways. Dunno if anyone else has gotten a registration from "twigger4life".
    http://www.fosters-home.com/forum

    Comment


    • couple more:

      user name: lrdldu
      email: [email protected]
      ip: 221.201.98.74
      DOB: 01-01-1980

      user name: LRKSFAG
      email: [email protected]
      IP: 58.240.239.198
      DOB: 01-01-1980

      Comment


      • Originally posted by Wayne Luke View Post
        Like Akismet? vBulletin Options -> Spam Management.
        I will give this a try.

        Added Akismet key and created test user and it worked! So far so good.
        EcoForumZ
        New Member
        Last edited by EcoForumZ; Tue 3 Jun '08, 1:26pm.
        EbikeForum - Electric Bicycle Forum

        Comment


        • Did any one happen to notice this prior to getting spammed?
          213.180.206.189
          turbospider.yandex.ru
          ...

          Comment


          • Originally posted by paperthreads View Post
            just popped up today:
            Tcrubuyuuie
            email: [email protected]
            ip address: 222.183.121.247
            date of birth is Jan 1, 1980
            I've got this one too today on my board from a different ip address (222.183.124.191). I've already banned a few beijiboy users ... .

            All those requests came from China and all look the similar to this:

            Code:
            222.183.124.191 - - [04/Jun/2008:11:21:18 +0300] GET /register.php?do=signup HTTP/1.1 "200" 20122 "http://www.******.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; 
            SV1; .NET CLR 2.0.50727)" "-"
            222.183.124.191 - - [04/Jun/2008:11:21:26 +0300] POST /register.php?do=register HTTP/1.1 "200" 31520 "http://www.******.com/register.php?do=signup" "Mozilla/4.0 (compatible; 
            MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
            222.183.124.191 - - [04/Jun/2008:11:21:26 +0300] GET /image.php?type=regcheck&imagehash=c9ee867e0b4ed45254e16b9a4c85b4a0 HTTP/1.1 "200" 10320 "http://www.******.com/register.
            php?do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
            222.183.124.191 - - [04/Jun/2008:11:21:34 +0300] POST /ajax.php?do=imagereg&imagehash=c9ee867e0b4ed45254e16b9a4c85b4a0 HTTP/1.1 "200" 111 "http://www.******.com/register.php?
            do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
            222.183.124.191 - - [04/Jun/2008:11:21:34 +0300] GET /image.php?type=regcheck&imagehash=5568e8b5c6ea1e138248d590ecdba890 HTTP/1.1 "200" 10257 "http://www.******.com/register.
            php?do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
            222.183.124.191 - - [04/Jun/2008:11:22:01 +0300] POST /register.php?do=addmember HTTP/1.1 "200" 23886 "http://www.******.com/register.php?do=register" "Mozilla/4.0 (compatibl
            e; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
            222.183.124.191 - - [04/Jun/2008:11:22:07 +0300] GET /profile.php?do=editsignature HTTP/1.1 "200" 29979 "http://www.******.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 
             5.1; SV1; .NET CLR 2.0.50727)" "-"
            222.183.124.191 - - [04/Jun/2008:11:22:15 +0300] POST /profile.php?do=updatesignature HTTP/1.1 "200" 29484 "http://www.******.com/profile.php?do=editsignature" "Mozilla/4.0 (
            compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
            o.com/help/us/ysearch/slurp)" "74.6.12.58"
            222.183.124.191 - - [04/Jun/2008:11:22:47 +0300] GET /register.php?a=act&u=56&i=31984333 HTTP/1.1 "200" 24108 "-" "Mozilla/4.0 (compatible; Windows XP 5.1; MSIE 6)" "-"

            Comment


            • Originally posted by EcoForumZ View Post
              I will give this a try.

              Added Akismet key and created test user and it worked! So far so good.
              what you mean with 'test user'?

              Comment


              • Any post made by viagra-test-123 will be blocked automatically.
                Best Regards,
                Andy Huang

                Comment


                • I have just done a birthday search on my site and about 40 users showed up. I deleted all after looking at the names and domains. Imagine my forums 'Today's Birthdays' list on 1st of January if I did not do this?

                  Also, vBulletin people know there is a problem but they have no choice other than to downplay it. Imagine if they said 'Yes, it is cleat to us there is a huge spam problem with our product but we can't fix it at the momets. Still, go and buy it!'.

                  There will be a sudden announcement of a fix, but until that day we have to look for a solution ourselves.
                  New Member?!? My 'Join Date' thinks otherwise!
                  I surf, therefore I am. I think.

                  Comment


                  • Yeah, we know there's a problem that we can control and we are purposely trying to 'downplay' it. That must be it.

                    P.S. We are not responsible for ReCaptcha. It's a third-pary application that we allow you to use as only one of the available verification options our Developers have added.
                    Steve Machol, former vBulletin Customer Support Manager (and NOT retired!)
                    Change CKEditor Colors to Match Style (for 4.1.4 and above)

                    Steve Machol Photography


                    Mankind is the only creature smart enough to know its own history, and dumb enough to ignore it.


                    Comment


                    • 121,941 posts at time of writing?!? Slightly off topic.
                      New Member?!? My 'Join Date' thinks otherwise!
                      I surf, therefore I am. I think.

                      Comment


                      • i enable only picture verification

                        and also the same

                        there r many of them in my forum

                        and i dont know how to do?

                        Comment


                        • I have a guest lurking around trying the permissions pretty hard. they have yet to try and register. Their ip is 150.70.84.41 shows it's origin is Japan.

                          Comment


                          • This is not a vB 3.7.x issue. I am running vB 3.6.10 and I've banned every username mentioned in this thread so far.

                            I just ran through my members list and deleted every suspicious username with a birthdate of Jan 1, 1980 and also did a quick scan of gmail.com, 21cn.com, and sina.com email addresses. I deleted about 30 members, all with 0 posts, who were either "User Awaiting Email Confirmation" or were approved but hadn't posted yet.

                            I've installed Prevent Spam and I've set it to flag any post that contains a URL. I also have new member moderation turned on so that I have to approve each new registration manually.

                            Between these two options I hope to stop a lot of this nonsense. This has only become a problem in the last week or two.

                            Comment


                            • Originally posted by vitalie View Post
                              Code:
                              222.183.124.191 - - [04/Jun/2008:11:21:18 +0300] GET /register.php?do=signup HTTP/1.1 "200" 20122 "http://www.******.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; 
                              SV1; .NET CLR 2.0.50727)" "-"
                              222.183.124.191 - - [04/Jun/2008:11:21:26 +0300] POST /register.php?do=register HTTP/1.1 "200" 31520 "http://www.******.com/register.php?do=signup" "Mozilla/4.0 (compatible; 
                              MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
                              222.183.124.191 - - [04/Jun/2008:11:21:26 +0300] GET /image.php?type=regcheck&imagehash=c9ee867e0b4ed45254e16b9a4c85b4a0 HTTP/1.1 "200" 10320 "http://www.******.com/register.
                              php?do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
                              222.183.124.191 - - [04/Jun/2008:11:21:34 +0300] POST /ajax.php?do=imagereg&imagehash=c9ee867e0b4ed45254e16b9a4c85b4a0 HTTP/1.1 "200" 111 "http://www.******.com/register.php?
                              do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
                              222.183.124.191 - - [04/Jun/2008:11:21:34 +0300] GET /image.php?type=regcheck&imagehash=5568e8b5c6ea1e138248d590ecdba890 HTTP/1.1 "200" 10257 "http://www.******.com/register.
                              php?do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
                              222.183.124.191 - - [04/Jun/2008:11:22:01 +0300] POST /register.php?do=addmember HTTP/1.1 "200" 23886 "http://www.******.com/register.php?do=register" "Mozilla/4.0 (compatibl
                              e; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
                              222.183.124.191 - - [04/Jun/2008:11:22:07 +0300] GET /profile.php?do=editsignature HTTP/1.1 "200" 29979 "http://www.******.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 
                               5.1; SV1; .NET CLR 2.0.50727)" "-"
                              222.183.124.191 - - [04/Jun/2008:11:22:15 +0300] POST /profile.php?do=updatesignature HTTP/1.1 "200" 29484 "http://www.******.com/profile.php?do=editsignature" "Mozilla/4.0 (
                              compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
                              o.com/help/us/ysearch/slurp)" "74.6.12.58"
                              222.183.124.191 - - [04/Jun/2008:11:22:47 +0300] GET /register.php?a=act&u=56&i=31984333 HTTP/1.1 "200" 24108 "-" "Mozilla/4.0 (compatible; Windows XP 5.1; MSIE 6)" "-"
                              This is most likely human... They reloaded the image verification three times. You're not even using recaptcha.
                              Translations provided by Google.

                              Wayne Luke
                              The Rabid Badger - a vBulletin Cloud demonstration site.
                              vBulletin 5 API

                              Comment


                              • Originally posted by ryansmith View Post
                                This is not a vB 3.7.x issue. I am running vB 3.6.10 and I've banned every username mentioned in this thread so far.

                                I just ran through my members list and deleted every suspicious username with a birthdate of Jan 1, 1980 and also did a quick scan of gmail.com, 21cn.com, and sina.com email addresses. I deleted about 30 members, all with 0 posts, who were either "User Awaiting Email Confirmation" or were approved but hadn't posted yet.

                                I've installed Prevent Spam and I've set it to flag any post that contains a URL. I also have new member moderation turned on so that I have to approve each new registration manually.

                                Between these two options I hope to stop a lot of this nonsense. This has only become a problem in the last week or two.
                                I had all kinds of spammers then I configured "Akismet" in admincp and it has captured all spammers ever since. It does all the work for you.


                                This is the best solution!


                                Try it!
                                EbikeForum - Electric Bicycle Forum

                                Comment

                                widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.
                                Working...
                                X