5

I have a site where users send messages to one another using the Private Message module, and they are notified of messages by email.

On this site, there are a variety of spammers, scammers, and abusive users who attempt to register multiple accounts using disposable email addresses.

I know it's impossible to block every possible disposable email address domain, but is there anything in the Drupal world that can help me?

  • I considered white-listing valid domains, but my user base is too diverse for this.

  • The only project I could find on drupal.org has been abandoned.

  • There are third-party APIs such as this one.

At the moment, I'm blocking them manually using this code:

/**
 * Custom validation function from the Domain Registration module (1.0).
 *
 * Checks if the domain in the email address is on a list of blocked domains.
 * @param $form
 * @param $form_state
 */

function MYMODULE_domain_registration_user_register_validate(&$form, &$form_state) {
  $default_message = t('You are not allowed to register for an account on this site.  Contact support for more information.');
  $mail = explode('@', $form_state['values']['mail']);
  $exact_domains = array(
    'ad.drupaler.org',
    'drupaler.org',
  );
  $partial_domains = array(
    'pp.ua',
    'guerrilamail',
  );
  if (isset($mail[1]) && !empty($exact_domains)) {
    if (in_array($mail[1], $exact_domains) || MYMODULE_contactinfo_check_banned_words($mail[1], $partial_domains)) {
      form_set_error('account', variable_get('domain_registration_message', $default_message));
    }
  }
}
  • You should use a ReCaptcha in you registration form, if you aren't already, to get rid off all the robot/spider/automated spam registrations. – No Sssweat Jun 18 '16 at 7:04
  • @NoSssweat Alas, in my case, the problem is manually registered spam. – Patrick Kenny Jun 18 '16 at 7:04
1

Like you mentioned it is impossible to block all disposable domains.

If you want to end the madness, the most effective solution would be: Upon registration you send a confirmation link or code to a mobile phone number

Take a look at:

  1. SMS Framework module
  2. VoIP Drupal module

Using Unique field you could make sure that the phone number can only be used once.

Checkout: How to send SMS messages (Drupal Tutorial)

1

Your solution is good ( but I think sms verification is better solution),any way I improved your solution with integrate it with block-disposable-emai,have simple JSON BASE APIs

   /**
 * Custom validation function from the Domain Registration module (1.0).
 *
 * Checks if the domain in the email address is on a list of blocked domains.
 * @param $form
 * @param $form_state
 */

function MYMODULE_domain_registration_user_register_validate(&$form, &$form_state) {
  $default_message = t('You are not allowed to register for an account on this site.  Contact support for more information.');
  $mail = explode('@', $form_state['values']['mail']);
  $exact_domains = array(
    'ad.drupaler.org',
    'drupaler.org',
  );
  $partial_domains = array(
    'pp.ua',
    'guerrilamail',
  );

  $key     = '12345abcapikey'; //please get your own valid api key
  $request = 'http://check.block-disposable-email.com/api/json/'.$key.'/'.$mail[1]; 
  if (isset($mail[1])) {
  $response = file_get_contents($request);
  $dea = json_decode($response);
  if ($dea->request_status == 'success'){
    if ($dea->domain_status == 'block' && $dea->domain_type == 'dea_provider' && $dea->domain_is_handpicked == 1){
    // deny registration ...
              form_set_error('account', variable_get('domain_registration_message', $default_message));

    }

  }else{
    form_set_error('account', "try again");
   }
  }
  }
0

I'm facing the same problems so I create a Free API service that recognize disposable and temporary email address: Block Temporary Email

Email Endpoint:

GET https://block-temporary-email.com/check/email/example@simplemail.top

JSON response:

{
  "status": 200,
  "domain": "simplemail.top",
  "temporary": true,
  "dns": true,
}

This API is 100% free and have no limits.

This site provides a free and updated TXT list of disposable email providers too.

Disclaimer: I made this API

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.