How to solve the problem of Drupal website being maliciously registered by machine users

Many junk registrations @ sina.com are found on my Drupal site. Although the honeypot module has been enabled, this type of registration is not blocked.

Analysis:

Attackers may be familiar with the honeypot mechanism and can write scripts to achieve malicious registration.

In the Drupal system, by default, user registration logs are stored in the watchdog table. By analyzing the user logs in the watchdog table, you can collect the relevant information for reference.

Then, the user block module or other corresponding modules are used to shield the registration of the malicious IP address.


Solution:

Execute the following SQL statement on any mysql client:
Select count (hostname) as count, hostname from watchdog where type = "user" group by hostname order by count desc;

The following statistical results can be obtained:
| Count | hostname |
+ ------- + ----------------- +
| 53 | 173.208.222.90 |
| 31 | 173.208.222.42 |
| 20 | 173.208.222.146 |
| 4 | 216.244.84.43 |
| 2 | 61.219.177.117 |
| 2 | 173.208.253.83 |
| 2 | 217.168.16.33 |
| 2 | 109.73.170.223 |
| 2 | 5.101.140.233 |
| 1 | 180.180.77.131 |
| 1 | 183.207.224.51 |
| 1 | 222.44.86.167 |

We can see that there are a large number of accesses to the IP segment 173.208.222.0/24. We found that the ip address is located in the United States in www.ip138.com. Because the website is mainly for Chinese users, it can be determined that this is the ip source for malicious registration.

Drupal's default ip blocking policy does not support blocking IP segments. You can use the ip ranges module to block ip segments.


Additional considerations:

Using the Drupal module to block the issue, you can solve the problem by clicking the mouse, it is easier. At the same time, permissions can be granted to relevant personnel to reduce the burden on developers.


The best way is to shield the IP address on the server layer. nginx and apache have corresponding configurations to block access to the specified IP address and IP address segment. This method consumes less system resources. The disadvantage is that the configuration is troublesome and you need to log on to the server for operations.
 
Here we recommend a Chinese verification code template, if your Drupal site is for Chinese users:

Https://www.drupal.org/project/chinese_captcha