I am experiencing a spam registration exploit on a site I manage. so far 2500 spam users.

I have followed advice gained from http://www.dnnsoftware.com/wiki/page/replacing-registration-page-with-custom-and-blocking-the-default-register-page

Resultant Dotnetnuke.config settings:

  <blockrequests>
    <rule servervar="HTTP_URL" values="(?&lt;=\?)ctl=register|(?&lt;!\?)/register" operator="Regex" action="NotFound" location="" />
  </blockrequests>
 

but the URL http://www.martinboroughfair.org.nz/register.aspx still redirects straight to the new registration page.

 What might I have done wrong.

I have also included  denyquerystringsequence configs in the web.config to thwart some of the URLS hitting the site.

    <security>
      <requestFiltering>
        <denyQueryStringSequences>
          <add sequence="ctl=Register" />
          <add sequence="returnurl=http://www.online-casino-world.com" />
          <add sequence="UserProfile/tabid/324/userId/5066/Default.aspx" />
          <add sequence="register.aspx" />
          <!--added by Managed.com due to Registration exploit-->
        </denyQueryStringSequences>
      </requestFiltering>
    </security>

cheers

I have the problem.  You are way ahead of me on trying fixes.  I'm trying to get all my sites on the latest 7.3.4 before I tackle the bots.  For now I police the registration and then delete all unauthorized users daily; If I let them in I have to delete them one by one.  I get 50-100 a day.  I simply turned registration off on most sites.

Bob

Paul,

  What version of DNN are you running?  7.3.4 included some enhancements to return a 404 for non-existent users which should prevent most of your errors from occuring.  You might want to do some testing in QA environment to verify that this version resolves your issue.