Weird usernames on my Drupal site

Question

I help run quite a Drupal site (up to date) with around a few thousand registered users. More and more frequently I am finding users who have registered with usernames like the following (found 13 so far but I am going back through the history to see if there are anymore):

briantuffddwwjbsao
heiditsfacjsheiffg
vickikqskaiwlfnxcg

I am 99% certain these are not legit users and I have blocked their accounts for the time being. Oh and they have been authorised (clicking link in email).

When looking at the profile, in every case the first and last names are populated by the same text (the same as the first four or five characters of the username). The last part of the username is seemingly random characters (no numbers/special characters). I also note the address does usually exist (at least on gmaps) but I cant comment on the zip code/telephone being accurate (it doesn't seem so).

We do have a CAPTCHA implemented.

Has anyone else had experience with users registering on Drupal with this type of username? Are they legitimate or is it some sort of "bot"? Am I just being paranoid?

Answer 1

Yes those are most likely bots; you can never be 100% sure but if you're seeing a pattern, and these users aren't contributing to the site in the same way regular users do, it's likely.

I think anyone who's ever administered a medium-large Drupal site has experienced this at one time or another. Standard tools for the arsenal include:

• Botcha

  BOTCHA is a highly configurable non-CAPTCHA spam protection framework.

• Spambot

  Spambot protects the user registration form from spammers and spambots by verifying registration attempts against the Stop Forum Spam (www.stopforumspam.com) online database. It also adds some useful features to help deal with spam accounts.

Both are very effective in my experience, though Spambot can get fairly intense on outgoing http requests if you get a lot of registration attempts. There are some others listed on the Spam control modules page too.

Answer 2

To contribute to Clive's accurate answer, you can also alternatively use the following modules:

• Mollom

In short, Mollom handles incoming posts intelligently, in much the same way a human moderator decides what posts are acceptable. Therefore, Mollom enables you to allow anonymous users to post comments and other content on your site.

Mollom in ways is similar to the Spambot module as recommended by Clive.

• Honeypot

Honeypot uses both the honeypot and timestamp methods of deterring spam bots from completing forms on your Drupal site. These methods are effective against many spam bots, and are not as intrusive as CAPTCHAs or other methods which punish the user.

Personally I find Honeypot a very neat solution as it is a small module and I find it has a respectable success rate with my web sites.

Answer 3

If your site is small then you can also limit the login name max length to be 10-12 characters max. This can be done by attaching a validator in hook_form_alter.

Moreover I guess these bots choose small sites only for attacks. I've never tested this but always want to add this.

The bots always choose such length with random words so as to be unique. So I don't think they will like to try with smaller login names.