Botnets injecting direct to register.php. HELP!

[Steve Machol]

This is different because these bots seem to be actually getting register.php to do something bad. Not sure what, but am sure that it involves sending out emails from our server.

Actually as I understand it all they are doiung is using a fake email address, and since you have vB set up to verify all emails during registration, you are getting bounced email notices for those fake address. This is exactly what vB is supposed to do in these situations.

Personally I doubt these are bots is you are using the human verification options you say you are. These are probably low-paid humans manually registering on behalf of spammers.

[XXP]

Thanks, but these guys are going straight to register.php. They don't come from a link from our site so only replacing the first step won't help -- they are going around that first step anyway. They are not being trapped by bad referer filters.

The loaded queries come from many different IP addresses. We've tried blocking the most egregious, but there are too many for this to be a practical prophylactic.

[Zachery]

You cannot get around any steps in register.php without manually completing them.

[Alfa1]

Could you have a look at the bounced emails and see if there is anything strange in that?

[XXP]

The largest number seem to be directed at a fake address; email-at-gmail-dot-com. Google isn't happy and is reporting that this address is receiving mail at too high a rate. Obviously not real and probably masking whatever the thing is really doing, but that's above my pay grade.

[XXP]

You cannot get around any steps in register.php without manually completing them.

Would be happy to show the support team a sample of the strings being sent directly to the script. Of course, would have to PM you to do that... LOL

[Trevor Hannant]

Or raise a Support Ticket....

[Alfa1]

The largest number seem to be directed at a fake address; email-at-gmail-dot-com. Google isn't happy and is reporting that this address is receiving mail at too high a rate. Obviously not real and probably masking whatever the thing is really doing, but that's above my pay grade.

What is in the email? Is it anything else then normal registration text?

[stonepilot]

* Not sure if this is related, I have a similar issue with 4.0.8 that I am about to open a thread on *