Detecting XRumer - GoFuckYourself.com

SykkBoy · 09-29-2014, 12:33 PM

Our dating site has been getting hit pretty hard with profiles created by XRumer. I wouldn't care so much if they weren't so shitty ;-)

Is there a way to detect XRumer? I'd like to be able to autoblock as soon as we start seeing the profiles come in.

Ferus · 09-29-2014, 12:47 PM

Like most will say

Quote:

Take the time to create 15-20 Q/A and change them when the flood starts again.

No point in investing $XXXX, in a golden solution sold by security-pushers

SykkBoy · 09-29-2014, 12:57 PM

It looks like that's the way we'll be going, I was just hoping someone might have a decent blocking solution or detection solution so we can write our own blocker.

klinton · 09-29-2014, 01:25 PM

check out stopforumspam.org for latest XR IPs and used emails...

as someone above posted, the only efficient and smart way is to post a some specific questions and answers...and change/ modify them from time to time

Klen · 09-29-2014, 03:27 PM

Ferus suggestion sound quite fine to me,questions which can be answered by human only usually do the trick

RazorSharpe · 09-29-2014, 03:53 PM

Quote:

Originally Posted by SykkBoy

Our dating site has been getting hit pretty hard with profiles created by XRumer. I wouldn't care so much if they weren't so shitty ;-)

Is there a way to detect XRumer? I'd like to be able to autoblock as soon as we start seeing the profiles come in.

The solution we use (not a dating site):

We create a hidden field named "email" and we generate the field name for the real email address on-the-fly. Most automated softwares will fill in the hidden field and won't know how to handle the real email field. The beauty of changing the field name per page load makes sure people can't just manually update their software. We use a combination of hash and time stamp. Works well for us ...

sarettah · 09-29-2014, 04:21 PM

Quote:

Originally Posted by RazorSharpe

The solution we use (not a dating site):

We create a hidden field named "email" and we generate the field name for the real email address on-the-fly. Most automated softwares will fill in the hidden field and won't know how to handle the real email field. The beauty of changing the field name per page load makes sure people can't just manually update their software. We use a combination of hash and time stamp. Works well for us ...

That is quite a nice solution. Simple. Wish I had thought of that

.

_Richard_ · 09-29-2014, 04:27 PM

Quote:

Originally Posted by RazorSharpe

The solution we use (not a dating site):

We create a hidden field named "email" and we generate the field name for the real email address on-the-fly. Most automated softwares will fill in the hidden field and won't know how to handle the real email field. The beauty of changing the field name per page load makes sure people can't just manually update their software. We use a combination of hash and time stamp. Works well for us ...

HerPimp · 09-29-2014, 05:45 PM

Captcha does not work, for a penny people will type it out. Only use Q/A and get creative.

AmeliaG · 09-29-2014, 07:17 PM

Quote:

Originally Posted by RazorSharpe

The solution we use (not a dating site):

We create a hidden field named "email" and we generate the field name for the real email address on-the-fly. Most automated softwares will fill in the hidden field and won't know how to handle the real email field. The beauty of changing the field name per page load makes sure people can't just manually update their software. We use a combination of hash and time stamp. Works well for us ...

Ooh, that is a nice elegant solution!

SDSimon · 09-29-2014, 07:26 PM

Quote:

Originally Posted by SykkBoy

Our dating site has been getting hit pretty hard with profiles created by XRumer. I wouldn't care so much if they weren't so shitty ;-)

Is there a way to detect XRumer? I'd like to be able to autoblock as soon as we start seeing the profiles come in.

Hi SykkBoy.
Would HTaccess work here?

>>>Winners WIN because they NEVER GIVE UP!<<<

freecartoonporn · 09-29-2014, 07:26 PM

Quote:

Originally Posted by RazorSharpe

The solution we use (not a dating site):

We create a hidden field named "email" and we generate the field name for the real email address on-the-fly. Most automated softwares will fill in the hidden field and won't know how to handle the real email field. The beauty of changing the field name per page load makes sure people can't just manually update their software. We use a combination of hash and time stamp. Works well for us ...

this

we used to do hidden field technique but very simple way.
create a hidden field name it email and check serverside.
if filled then its bot else human.

but yours looks pretty interesting., theres one downside i can think of , is that , people have to retype email at every visit.

another way use javascript to hide field

RazorSharpe · 09-29-2014, 11:50 PM

Quote:

Originally Posted by freecartoonporn

this

we used to do hidden field technique but very simple way.
create a hidden field name it email and check serverside.
if filled then its bot else human.

but yours looks pretty interesting., theres one downside i can think of , is that , people have to retype email at every visit.

another way use javascript to hide field

Well considering that this is a registration form, the user should essentially only be filling this form in once so "every visit" shouldn't really be an issue.

just a punk · 09-30-2014, 12:17 AM

Quote:

Originally Posted by RazorSharpe

We create a hidden field named "email" and we generate the field name for the real email address on-the-fly.

Yep. I'm using the similar method on my sites since 2003. BTW, another good solution is to encrypt your signup form with JavaScript. It will stop 99% of spamboats that automatically searching for forms at your webpages.

just a punk · 09-30-2014, 12:28 AM

Also you can generate a special token (using the visitor's IP for example) and set it as a cookie when your registration form was visited. Then just check it when the form will be submitted. I was using this method long time ago to protect against so-called referrer spoofing. AFAIK this method is still being used by many high-trafficking websites like Pinterest.

Edit: Course ANY protection can be compromised but not by XRumer or regular spambots. The one will need to create a special software to bypass your protection. For example, this my WP plugin allows to automatically pin the post images to various pinboards including pinterest.com, sex.com and many others: http://www.cyberseo.net/xpinner/

freecartoonporn · 09-30-2014, 12:33 AM

Quote:

Originally Posted by CyberSEO

Yep. I'm using the similar method on my sites since 2003. BTW, another good solution is to encrypt your signup form with JavaScript. It will stop 99% of spamboats that automatically searching for forms at your webpages.

wont this stop ppl from joining if their javascript is disabled ?

just a punk · 09-30-2014, 12:36 AM

Quote:

Originally Posted by freecartoonporn

wont this stop ppl from joining if their javascript is disabled ?

Almost all sites now require JavaScript, so I don't see a problem with that. Even this board won't work as it should w/o JavaScript. Not even mention all these new responsive sites.

SykkBoy · 09-30-2014, 02:09 PM

Quote:

Originally Posted by RazorSharpe

The solution we use (not a dating site):

We create a hidden field named "email" and we generate the field name for the real email address on-the-fly. Most automated softwares will fill in the hidden field and won't know how to handle the real email field. The beauty of changing the field name per page load makes sure people can't just manually update their software. We use a combination of hash and time stamp. Works well for us ...

I like this, thanks

Also, going to test out the Q/A
captchas are pretty much useless and will just piss of actual users (although they're probably used to them by now)

we're also working with dynamic membera area/login pages.

Klen · 09-30-2014, 02:13 PM

Quote:

Originally Posted by SykkBoy

I like this, thanks

Also, going to test out the Q/A
captchas are pretty much useless and will just piss of actual users (although they're probably used to them by now)

we're also working with dynamic membera area/login pages.

Yeah i get pissed every time when i see monstrosity known as re-captcha.

09-29-2014, 12:33 PM	#1
SykkBoy Jesus loves bacon Industry Role: Join Date: Feb 2001 Location: Sin City, Motherfucker Posts: 19,969	Detecting XRumer Our dating site has been getting hit pretty hard with profiles created by XRumer. I wouldn't care so much if they weren't so shitty ;-) Is there a way to detect XRumer? I'd like to be able to autoblock as soon as we start seeing the profiles come in. __________________ Support my new movie “The Second Coming”

09-29-2014, 12:57 PM	#3
SykkBoy Jesus loves bacon Industry Role: Join Date: Feb 2001 Location: Sin City, Motherfucker Posts: 19,969	It looks like that's the way we'll be going, I was just hoping someone might have a decent blocking solution or detection solution so we can write our own blocker. __________________ Support my new movie “The Second Coming”

09-29-2014, 05:45 PM	#9
HerPimp Confirmed User Industry Role: Join Date: Mar 2006 Location: Earth Posts: 1,197	Captcha does not work, for a penny people will type it out. Only use Q/A and get creative. __________________

09-30-2014, 12:28 AM	#15
just a punk So fuckin' bored Industry Role: Join Date: Jun 2003 Posts: 32,386	Also you can generate a special token (using the visitor's IP for example) and set it as a cookie when your registration form was visited. Then just check it when the form will be submitted. I was using this method long time ago to protect against so-called referrer spoofing. AFAIK this method is still being used by many high-trafficking websites like Pinterest. Edit: Course ANY protection can be compromised but not by XRumer or regular spambots. The one will need to create a special software to bypass your protection. For example, this my WP plugin allows to automatically pin the post images to various pinboards including pinterest.com, sex.com and many others: http://www.cyberseo.net/xpinner/ __________________ Obey the Cowgod Last edited by just a punk; 09-30-2014 at 12:37 AM..

09-29-2014, 01:25 PM	#4
klinton So Fucking Banned Industry Role: Join Date: Apr 2003 Location: online Posts: 8,766	check out stopforumspam.org for latest XR IPs and used emails... as someone above posted, the only efficient and smart way is to post a some specific questions and answers...and change/ modify them from time to time

09-29-2014, 03:27 PM	#5
Klen Industry Role: Join Date: Aug 2006 Location: Little Vienna Posts: 32,235	Ferus suggestion sound quite fine to me,questions which can be answered by human only usually do the trick