• This forum has been archived. New threads and replies may not be made. All add-ons/resources that are active should be migrated to the Resource Manager. See this thread for more information.

BotScout to prevent SPAMBot registrations

Fred Sherman

Well-known member
I'll leave it to AnthonyCrea to give you all the reasons to use BotScout. I think its enough that reCAPTCHA may be compromised and stopforumspam was unavailable for a period of time.
1. Get API key: http://www.botscout.com/getkey.htm
2. Download xFBotScout.php
3. Edit appropriate values:
$APIKEY = '';​
$ALERT_EMAIL = 'your@email.com';
$ALERT_FROM = 'BotScout@your-domain.com';​
4. Upload to INSTALL_DIR/library/XenForo
5. From your ACP, create a new phrase called BotScout_Alert with whatever biatch slappin' text you want. No human being will ever see it. Mine is:
ALERT: SPAMbot Detection has been activated. User will not be registered.
6. Edit INSTALL_DIR/library/XenForo/ControllerPublic/Register.php:
Add After:
// BotScout.com "BotBuster" check
By FULL_PATH_INSTALL_DIR, I mean the full directory path, like /home/username/public_html/community, not the URL.
I know you guys still like screenshots, so here is the screen no human being should ever see.


Fred Sherman

Well-known member
My code is based almost entirely on the code at BotScout for other forums, modified to use xenForo error messages. In no way am I presenting this as an original work. I am simply standing on the shoulders of others to see a little further.

steven s

Well-known member
What is it checking?

What if it is a false positive? I've had my vB3 mod stop registrations based on an ip address which was a legit registration. I no longer check against the username list.
Then they would contact me so I could manually add them.

Fred Sherman

Well-known member
IP address, username and email address. You can check the database on their site: http://www.botscout.com/search.htm
They can change username and email, but as long as they come from a known IP adress (not range of IPs), they're trapped in an endless loop of being unable to register.
I get where you're coming from. Its the trade-off between trusting an outside source that may have an IP address in the database that shouldn't be there vs. you not having the time to be constantly vigilant. Everyone has to decide for themselves which is the bigger risk and do the other.

steven s

Well-known member
They can change username and email, but as long as they come from a known IP adress (not range of IPs), they're trapped in an endless loop of being unable to register..
The majority of my spammers have been stopped based on ip address. Then comes email address.
What might be nice is to have something say, based on your ip address, email address or username your registration has been rejected. If you feel this is in error, contact . . .
Think it's possible not to check against username? That is where I get the most false positives.

Thanks for your efforts.


Well-known member
This will get you protected for up to 300 API calls. You might think is a lot but is not. The bots will hammer your forum several times a day, thinking there was a connection error.
I think you should create a table where you store the previously called API data, preventing you to repeat several times the same API call to botscout.com database.