Forum Moderators: phranque
My problem is that I've been receiving some rather wierd registrations over the past month. The best way of spotting one is via the username: They always contains 4 random characters followed by "0001". In addition, the password featues the same 4 random characters but an additional 2 random characters instead of the "0001". Eg:
Username: qoei0001
Password: qoeiei
In addition, these registrations manage to get through without entering a first or last name (although sometimes random names appear to be entered). This is a bit strange because there we use javascript to redirect anyone if they haven't given a first name.
After looking at the IP address of these registrations and performing trace routes, the majority of the appear to originate from CHINANET - most commonly in the Guangdong Province.
I've tried restricting as many IP address ranges in IIS as I can i.e. 61.139.*.* to 61.149.*.* and a few others but every day more seem to come through on different IP addresses i.e. today one came from 202.104... which was also CHINANET.
Is there anyway I can simply restrict the whole ISP. I'm not worried about losing any genuine registrants from CHINANET as my website is a UK site.
Also, does anyone know how and why these registrations could be happening in the first place?
Look forward to a response.
Simon
[edited by: smg2001 at 1:34 pm (utc) on Jan. 17, 2003]
Also, does anyone know how and why these registrations could be happening in the first place?
Why? No idea - are they actually using those registration in any way?
As for the how, my money is on a 'bot of some description which is simply bypassing all the client-side (javascript) validation...
This is a bit strange because there we use javascript to redirect anyone if they haven't given a first name.
If you only have client-side validation in place they wont affect any 'bot unless they were explicitly coded to understand javascript. You could probably attempt to stop it (or at least force them to supply all the details) by putting some server-side validation in place.
- Tony
One idea I had was to stop all usernames with xxxx0001 but this could inconvenience members as some are registered with this syntax. It seems that the only way of getting rid of the problem is to restrict the offending IP addresses - but how?
