How do I bar this type of hacker from my website?

[jezzer300]

Obviously there's some kind of robot running down a dictionary filling in what it believes are username/password fields on my website.

Each time it tries a dictionary word in the email box and what looks like an MD5 encrypted password in the next field.

Currently it's an annoyance, but it could be one of my password fields I really want to avoid these attacks, big or small.

How do I..

1. Stop this kind of bot from even deciding to try a username/password in the first place. Do you know what they look for to pick on a site?

One thing I thought of was to rename the form field to something other than "email", maybe it'll make it less appealing.

2. Detect this type of bot so I can block them. They seam to use a different IP address for each attempt, several times a day, every day.

[LeChuck]

You could implement a captcha on your page. Or maybe a question/answer system.

And yes, renaming the form might be a good idea.

[Anyango]

yes i would also recommend captcha . currentkly AFAIK this is one of the best methods to stop bots.

try

[en.wikipedia.org...]

[jezzer300]

Thanks, it's a good idea. But at the moment it appears it would put of people from leaving comments /feedback (and doesn't work for the visually impared). If things get worse I'll have to implement it.

I finally had a breakthrough. These bots obviously remember and return to a particular web address. I'll suffix any link to my feedback page with a date (encrypted), if the date is more than a few days old I'll return a block as it's obviously not a customer.

This is what I'll do, any other ideas would be welcome.