Spambots can make logins automatically

This is an open forum for any mojoPortal topics that don't fall into the other categories.

This thread is closed to new posts. You must sign in to post in the forums.
7/21/2009 5:05:01 AM
Magnetic_dud
Gravatar
Total Posts 251
View Posts

Spambots can make logins automatically

OMG, mojoportal has reached a point that someone has coded a spambot to make logins and create spam posts!

This means that mojoportal has an huge success! Joe, congrats! mojoPortal has become famous enough to bother the russian spammers!

Details:

registered on an "empty" website, with no forum, blog with 1 post and comments closed (who would register????? )

lol, the security question is #file_links[sitemap1.txt ,1]

IP is 24.7.149.128, is a known spammer

the spambot does not compute JS, does not appears on google analytics or woopra

it has a strange behaviour: first it crawle the pages from another ip, then registers with another IP

2009-07-21 09:41:56 GET /software-reviews.aspx - 81.20.109.86 Mozilla/4.8+[en]+(X11;+U;+Linux+2.4.22-30mdk-i686-up-4GB+i686;+Nav)
2009-07-21 09:42:00 GET /software-reviews.aspx - 24.7.149.128 Mozilla/4.8+[en]+(X11;+U;+Linux+2.4.22-30mdk-i686-up-4GB+i686;+Nav)
2009-07-21 09:42:02 GET /Secure/Register.aspx - 24.7.149.128 Mozilla/4.8+[en]+(X11;+U;+Linux+2.4.22-30mdk-i686-up-4GB+i686;+Nav)

note: /software-reviews.aspx is an empty page with no text

7/21/2009 5:15:59 AM
Joe Audette
Gravatar
Total Posts 18439
View Posts

Re: Spambots can make logins automatically

Hi,

I would set require email confirmation to true in Site Settings > Security, then it can't sign in unless it uses real email addresses and can respond to the email link.

Also whenever I see evidence of any kind of spam script in my logs I ban the ip address using Admin > Advanced Tools > Banned IP Addresses.

Curious how can you be sure its the same script or bot if its not the same ip address?

Best,

Joe

7/21/2009 5:26:25 AM
Magnetic_dud
Gravatar
Total Posts 251
View Posts

Re: Spambots can make logins automatically

because also the other ip is a known spammer 

also, it browse through the pages without giving the referrer

I guess how they found me

recently i got some traffic for the google query "powered by mojoportal", but is strange, i am not in the top100

maybe bots are bored, they go over page 10 

 

Well, I don't like when websites asks me to confirm my email, it looks like the webmaster is not trusting me. I know that the rule #1 is NEVER trust users, but I like to do a registration-less website 

You must sign in to post in the forums. This thread is closed to new posts.