6

I help run quite a Drupal site (up to date) with around a few thousand registered users. More and more frequently I am finding users who have registered with usernames like the following (found 13 so far but I am going back through the history to see if there are anymore):

briantuffddwwjbsao
heiditsfacjsheiffg
vickikqskaiwlfnxcg

I am 99% certain these are not legit users and I have blocked their accounts for the time being. Oh and they have been authorised (clicking link in email).

When looking at the profile, in every case the first and last names are populated by the same text (the same as the first four or five characters of the username). The last part of the username is seemingly random characters (no numbers/special characters). I also note the address does usually exist (at least on gmaps) but I cant comment on the zip code/telephone being accurate (it doesn't seem so).

We do have a CAPTCHA implemented.

Has anyone else had experience with users registering on Drupal with this type of username? Are they legitimate or is it some sort of "bot"? Am I just being paranoid?

||improve this question
  • I would like to suggest a module that I wrote. It is called Spaces Enforced, can be found here and its success rate is about 98%. – Kartagis Oct 17 '14 at 14:12
10

Yes those are most likely bots; you can never be 100% sure but if you're seeing a pattern, and these users aren't contributing to the site in the same way regular users do, it's likely.

I think anyone who's ever administered a medium-large Drupal site has experienced this at one time or another. Standard tools for the arsenal include:

  • Botcha

    BOTCHA is a highly configurable non-CAPTCHA spam protection framework.

  • Spambot

    Spambot protects the user registration form from spammers and spambots by verifying registration attempts against the Stop Forum Spam (www.stopforumspam.com) online database. It also adds some useful features to help deal with spam accounts.

Both are very effective in my experience, though Spambot can get fairly intense on outgoing http requests if you get a lot of registration attempts. There are some others listed on the Spam control modules page too.

||improve this answer
  • Cheers, I was mostly looking for reassurance it wasn't normal. Will talk to the developers to see if we need to add any extra safeguards just now - it maybe a little premature as we haven't had a huge number too date (site is less than a year old but we do have a few thousand users and way less than 1% of the users are coming through in this format) – n34_panda Oct 12 '14 at 13:53
  • 1
    Mollom module can also help with spam accounts. – sheldonkreger Oct 13 '14 at 3:17
  • Mollom is costly. – AgA Oct 15 '14 at 5:09
  • Without URL receipe Botcha seems to be really working fine. – AgA Nov 8 '14 at 6:09
1

To contribute to Clive's accurate answer, you can also alternatively use the following modules:

In short, Mollom handles incoming posts intelligently, in much the same way a human moderator decides what posts are acceptable. Therefore, Mollom enables you to allow anonymous users to post comments and other content on your site.

Mollom in ways is similar to the Spambot module as recommended by Clive.

Honeypot uses both the honeypot and timestamp methods of deterring spam bots from completing forms on your Drupal site. These methods are effective against many spam bots, and are not as intrusive as CAPTCHAs or other methods which punish the user.

Personally I find Honeypot a very neat solution as it is a small module and I find it has a respectable success rate with my web sites.

||improve this answer
0

If your site is small then you can also limit the login name max length to be 10-12 characters max. This can be done by attaching a validator in hook_form_alter.

Moreover I guess these bots choose small sites only for attacks. I've never tested this but always want to add this.

The bots always choose such length with random words so as to be unique. So I don't think they will like to try with smaller login names.

||improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.