Contacts Spam Filter

[y2ksw]

This little product/plugin disallows automatic sending of spam through the Contact Us page.

Notes to version 1.1.0.0

Due to an almost personal battle against some spammers - intended as: high spam update rate, specially in the weekends when both me and spammers have nothing to do - I added an option to check the allowed number of hyperlinks in the message body, which makes this spam filter a little more intelligent. ;)

The default number of allowed links is set to 12, which appears to be the lower limit from the latest research.

For customizing the message and the number of allowed hyperlinks, an option interface was added, which appears right below the vBulletin Options list - Site Name / URL / Contact Details, as 'Contact Us' Spam Filter Settings.

Version History
1.1.0.2 Additional recognition strings (repetitive 'http://')
1.1.0.1 FIX: Hyperlinks count bug.
1.1.0.0 Additional recognition strings; check of allowed number of hyperlinks in the message body; options interface

1.0.1.10 Additional recognition string
1.0.1.9 Additional recognition string (not published)
1.0.1.8 Additional recognition string (not published)
1.0.1.7 Additional recognition string
1.0.1.6 Additional recognition string (not published)
1.0.1.5 Additional recognition string (not published)
1.0.1.4 Additional recognition string
1.0.1.3 Additional recognition string
1.0.1.2 Additional recognition string
1.0.1.1 Full vBulletin integration, updateable
1.0.0.0 Basic Spam Filter

[moonclamp]

How does it?

Can you give us some more information on what this does that the image verification doesn't do?

[COBRAws]

more info?

Ok, by reading the XML i found out that if someone goes directly to the sendmessage.php without coming from any of the forums page, the Contact form is not displayed.

[y2ksw]

If the referring page is not the one you specified in the CP options, normally http://www.domain.tld/sendmessage.php, an automated script with the POST / GET commands will receive an essentially blank page, and the mail is not sent.

This is useful only to sites, like mine, where image verification is not appliable.

$MyMessageURL = $vbulletin->options['bburl'] . '/' . $vbulletin->options['contactuslink'];
if($_SERVER['HTTP_REFERER'] != $MyMessageURL)
{
die('Spam filter: Please send your message through the appropriate message form.');
}
Sooner or later the spam bots will be updated to send also the referrer header, but until then this one works pretty well ... ;)

When this will happen, an additional test may be to add a host IP comparison.

[Snake]

Great hack!

[y2ksw]

Here is an update, which does some extra work against automated browsers, and thus has become pretty safe and easy to update.
<?php
$MyDieMessage = 'Spam filter: Please send your message through the appropriate message form.';

// Make sure the form was sent from a browser
if(!$_SERVER['HTTP_USER_AGENT'])
{
die($MyDieMessage);
}

// Make sure the form was POSTed
if(!$_SERVER['REQUEST_METHOD'] == 'POST')
{
die($MyDieMessage);
}

// Allow only the sendmessage script
$MyReferrer = strtolower($_SERVER['HTTP_REFERER']);
$MyURL = strtolower($vbulletin->options['bburl'] . '/' . $vbulletin->options['contactuslink']);
if($MyReferrer != $MyURL)
{
die($MyDieMessage);
}

// Filter header injections
$MyHeaders = array(
"Content-Type:",
"MIME-Version:",
"Content-Transfer-Encoding:",
"bcc:",
"cc:"
);

// Loop through each POST item and check for the headers
foreach($_POST as $MyKey => $MyPostItem)
{
$MyTempItem = strtolower($MyPostItem);
foreach($MyHeaders as $MyHeader)
{
if(strpos($MyTempItem, strtolower($MyHeader)) !== FALSE)
{
die($MyDieMessage);
}
}
}

// Check for '9c53d2119880d95e96e1a71e3a6c8340' in the message body.
// This string is found in automated browsers (all yet) at the bottom.
// For completeness we parse all post variables for this string.
// Prepared for more recognition strings.
$MyStrings = array(
'9c53d2119880d95e96e1a71e3a6c8340',
'dc64615b0a1e1bd3cb2689bf82248b5c' // 2006-06-27
);

// Loop through each POST item and check for the headers
foreach($_POST as $MyKey => $MyPostItem)
{
$MyTempItem = strtolower($MyPostItem);
foreach($MyStrings as $MyString)
{
if(strpos($MyTempItem, strtolower($MyString)) !== FALSE)
{
die($MyDieMessage);
}
}
}

// Cleanup
unset($MyDieMessage, $MyReferrer, $MyURL, $MyHeaders, $MyKey, $MyPostItem, $MyTempItem, $MyHeader, $MyStrings, $MyString);
?>

[Sergio68]

Here comes Giovanni :banana:

[Gn_Snake]

very good...thx

[navajotex]

good really OK splendid compliments is then I have read you from some part I do not remember where to here on the Sergio & Danny Ciaooooooooo Vbulletin.it by

[y2ksw]

I think the latest version has finally made it - no spam is passing through the filters :cool:

[Arjan]

How can I get this code to work with 3.0.x?
It looks good, but so far I did not see a good way to get it to work with the older version.

[y2ksw]

How can I get this code to work with 3.0.x?
It looks good, but so far I did not see a good way to get it to work with the older version.
In fact there isn't a good way to do this inside 3.0.x, since it would need code changes, I cannot even provide, sorry :knockedout:

[Arjan]

Well I got it working.
in the send message.php I added the code in two parts:

This part went into the E-mail permissions piece. Just before the initialisation of the error array.
Since (as I understood) this blocks mail sent from outside the page, I left the Die message in it. Don't make them wise ;)

Look for:

// initialize errors array
$errors = array();


Above it add:

//ANTI SPAM PART 1
$AntiSpamMessage1 = 'Spam filter: Please send your message through the appropriate message form.';
$AntiSpamMessage2 = 'Spam filter: Your message has not been accepted since it has some SPAM like properties.';

// Make sure the form was sent from a browser
if(!$_SERVER['HTTP_USER_AGENT'])
{
die($AntiSpamMessage1);
}

// Make sure the form was POSTed
if(!$_SERVER['REQUEST_METHOD'] == 'POST')
{
die($AntiSpamMessage1);
}

//END ANTI SPAM PART 1



Then the rest goes a bit lower in the page.
In the section
// ############################### do contact webmaster ###############################

Look for:
// if it's all good... send the email
if (empty($errors))


Just above it add:

//ANTI SPAM PART 2
// Allow only the sendmessage script
$MyReferrer = strtolower($_SERVER['HTTP_REFERER']);
$MyURL = strtolower($vboptions['bburl'] . '/' . $vboptions['contactuslink']);
if($MyReferrer != $MyURL)
{
eval('$errors[] = "' . $AntiSpamMessage1 . '";');
}

// Check for strings in the message body.
// This string is found in automated browsers (all yet) at the bottom.
// For completeness we parse all post variables for this string.
// Prepared for more recognition strings.
$MyStrings = array(
'9c53d2119880d95e96e1a71e3a6c8340', // the start
'dc64615b0a1e1bd3cb2689bf82248b5c', // 2006-06-27
'f4dd026ac39b9e2fa576404ae93f215c', // 2006-06-30
'849b90dee61199d2ed871b18e1575cb5', // 2006-07-06
'05980283d7fb0e8cc54b17a2b2a0ab96', // 2006-07-10
'70fcdb09b8b18b50874603a6c99fcbcb', // 2006-07-15
'bd0e28eaccfa349da99ddd3880835725', // 2006-07-16
'71b0d16f90c6ef289fb9e0b08b44fd7c', // 2006-07-16
'df487ef8b49cead02c1a5d00a04288ce', // 2006-07-21
'6d02afe3993f73507d90e3f877d8eed8', // 2006-07-23
'5064a72d6d1acabba6a21f655481a5b5', // 2006-07-24
'33766d282efd27c3468309e546e247c5', // 2006-07-29
'c9551bfed82d85381e7fd1deb6fef0af' // 2006-07-30
);

// Loop through each POST item and check for the headers
foreach($_POST as $MyKey => $MyPostItem)
{
$MyTempItem = strtolower($MyPostItem);
foreach($MyStrings as $MyString)
{
if(strpos($MyTempItem, strtolower($MyString)) !== FALSE)
{
eval('$errors[] = "' . $AntiSpamMessage2 . '";');
}
}
}

// Cleanup
unset($MyDieMessage, $MyReferrer, $MyURL, $MyHeaders, $MyKey, $MyPostItem, $MyTempItem, $MyHeader, $MyStrings, $MyString);

//END ANTI SPAM PART 2


This second part, uses the standard errors option, so it is showed in a nice way to the user. Just in case valid users do not pass the test (though I doubt).

[y2ksw]

(...) I left the Die message in it. Don't make them wise ;)
Right. In fact I would rather show a blank page, which means all and nothing in the same time :)

[Arjan]

True word.... I noticed

And the'' be kind show the user what is wrong' is also not a good idea.
Updating the errorstring and showing the form again invites the spammer (spambot) to retry. My server got huge pageloads in the last couple of hours (5 times more) with a normal, even a bit low, amount of visitors. Which resulted in an overloaded CPU.

I saw I forgot two pieces of code. And with the just Die version you will get this for the second part:

//ANTI SPAM PART 2
// Allow only the sendmessage script
$MyReferrer = strtolower($_SERVER['HTTP_REFERER']);
$MyURL = strtolower($vboptions['bburl'] . '/' . $vboptions['contactuslink']);
if($MyReferrer != $MyURL)
{
//eval('$errors[] = "' . $AntiSpamMessage1 . '";');
die($AntiSpamMessage);
}

// Filter header injections
$MyHeaders = array(
"content-type:",
"mime-version:",
"content-transfer-encoding:",
"bcc:",
"cc:"
);


// Check for the number of hrefs in settings.
// This makes it pretty secure against future spam versions.
$MyPostItem = strtolower($_POST['message']);
$MyTempItem = explode('href=', $MyPostItem);
if(count($MyTempItem) >= 2)
{
die($AntiSpamMessage);
}


// Loop through each POST item and check for the headers
foreach($_POST as $MyKey => $MyPostItem)
{
$MyTempItem = strtolower($MyPostItem);
foreach($MyHeaders as $MyHeader)
{
if(strpos($MyTempItem, $MyHeader) !== FALSE)
{
die($AntiSpamMessage);
}
}
}

// Check for strings in the message body.
// This string is found in automated browsers (all yet) at the bottom.
// For completeness we parse all post variables for this string.
// Prepared for more recognition strings.
$MyStrings = array(
'9c53d2119880d95e96e1a71e3a6c8340', // the start
'dc64615b0a1e1bd3cb2689bf82248b5c', // 2006-06-27
'f4dd026ac39b9e2fa576404ae93f215c', // 2006-06-30
'849b90dee61199d2ed871b18e1575cb5', // 2006-07-06
'05980283d7fb0e8cc54b17a2b2a0ab96', // 2006-07-10
'70fcdb09b8b18b50874603a6c99fcbcb', // 2006-07-15
'bd0e28eaccfa349da99ddd3880835725', // 2006-07-16
'71b0d16f90c6ef289fb9e0b08b44fd7c', // 2006-07-16
'df487ef8b49cead02c1a5d00a04288ce', // 2006-07-21
'6d02afe3993f73507d90e3f877d8eed8', // 2006-07-23
'5064a72d6d1acabba6a21f655481a5b5', // 2006-07-24
'33766d282efd27c3468309e546e247c5', // 2006-07-29
'c9551bfed82d85381e7fd1deb6fef0af' // 2006-07-30
);

// Loop through each POST item and check for the headers
foreach($_POST as $MyKey => $MyPostItem)
{
$MyTempItem = strtolower($MyPostItem);
foreach($MyStrings as $MyString)
{
if(strpos($MyTempItem, strtolower($MyString)) !== FALSE)
{
//eval('$errors[] = "' . $AntiSpamMessage2 . '";');
die($AntiSpamMessage);
}
}
}

// Cleanup
unset($AntiSpamMessage, $MyReferrer, $MyURL, $MyHeaders, $MyKey, $MyPostItem, $MyTempItem, $MyHeader, $MyStrings, $MyString);

//END ANTI SPAM PART 2

[y2ksw]

Thanks for adding your code modifications for 3.0.x :cool:

[mambo9]

Hey peeps!

Great thought on this hack, we have just started to recieve loads of thoose nice rolex watch ads through there lol.

I installed via the pluggin system, set the max hyperlinks too 3.

But, logged in as admin, i now cant test the system it seems? It always renders me the Spam Filter: msg!

Any ideas ?

[y2ksw]

Hey peeps!

Great thought on this hack, we have just started to recieve loads of thoose nice rolex watch ads through there lol.

I installed via the pluggin system, set the max hyperlinks too 3.

But, logged in as admin, i now cant test the system it seems? It always renders me the Spam Filter: msg!

Any ideas ?
Fixed & tested on both vBulletin v. 3.5.4 and 3.6.0 :cool:

[adwade]

Fixed & tested on both vBulletin v. 3.5.4 and 3.6.0 :cool:
So happy to have tripped across this -and- the fact it's v3.6 compatible! Will be installing tomorrow on my day off!

[y2ksw]

You are welcome :)

[adwade]

Install went just fine, and product showed up in the AdminCP panel. Yet, when I try sending a msg via the contact form it just goes right on thru as normal.

Any ideas? At first I was logged in as Admin and I thought maybe that was it, but then tried just as a regular registered user. Still, msgs came right on thru.

BTW, the default was 12 which I set back to only 1. In my msgs I tried sending 2 or 3 LINKS, and as I said they posted just fine for some reason.

What if you don't want even a SINGLE link to be able to be posted? Is that possible? It says "Please type '0' for no limit" in the AdminCP, but nothing about how to stop ALL links. Just curious.

[adwade]

The default number of allowed links is set to 12, which appears to be the lower limit from the latest research.

Are you saying the average spam email has 12 LINKs embedded into it?? :surprised: I often get some that has NO LINKS, just a graphic image that says Do not click, type in your browser www.xxxxxxx.com

[y2ksw]

Are you saying the average spam email has 12 LINKs embedded into it?? :surprised: I often get some that has NO LINKS, just a graphic image that says Do not click, type in your browser www.xxxxxxx.com (http://www.xxxxxxx.com)
Ok, some spam will pass, but most of them are not. The spam kind of no link id sthe most difficult one because usually inserted manually - the spammers study us :) At the moment, this kind of spam is not considered because sooner or later they will give up.

To be links considered as valid links, they must include a number of href="x", or else it won't work. Since my contacts box has been completely abbandoned from spammers after installing this plugin I think this issue is only theorically present. However if you experience heavy spam of a kind, please paste me such a message in a PM and I'll see what I can do.

[adwade]

So is there a way I can TEST this and thus know it's working?

[y2ksw]

Sure, paste this:

9c53d2119880d95e96e1a71e3a6c8340

into the contacts message body and submit, or paste 20 times href=, which has the same effect.

[adwade]

BINGO! Works P-E-R-F-E-C-T-L-Y! Sweet MOD! Thanxx again.

[dlan]

Doesn't work for me and i really could use it, i get heavy spam from some retarded spammers... If someone can update it i would be greatful.

Thanks

[y2ksw]

Can you please attach here a full spam email message (incl. headers) which isn't going to be filtered by this plugin?

Please note, it is going to filter only the typical link list pasted from spambots, not other spam. However through the settings you may define how many links may be pasted into a message before it gets rejected.

[dlan]

X-Account-Key: account2
X-UIDL: e2d03913c51abd99500f55b0dc2cbf29
X-Mozilla-Status: 0201
X-Mozilla-Status2: 00000000
Return-path: <nobody@web02.melonworks.eu>
Envelope-to: dead_lan@worldofwarcraft.gr
Delivery-date: Fri, 29 Dec 2006 02:47:56 +0200
Received: from wowgr by web02.melonworks.eu with local-bsmtp (Exim 4.52)
id 1H05uc-0002T9-Pl
for dead_lan@worldofwarcraft.gr; Fri, 29 Dec 2006 02:47:56 +0200
X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on web02.melonworks.eu
X-Spam-Level:
X-Spam-Status: No, score=1.0 required=5.0 tests=BAYES_00,DOMAIN_4U2,INFO_TLD,
NO_RELAYS,PORN_URL_MISC autolearn=no version=3.1.7
Received: from nobody by web02.melonworks.eu with local (Exim 4.52)
id 1H05uc-0002T0-H2
for admin@worldofwarcraft.gr; Fri, 29 Dec 2006 02:47:54 +0200
To: admin@worldofwarcraft.gr
Subject: =?windows-1253?q?WorldofWarcraft=2EGr_Forums_=D6=FC=F1=EC=E1 _=C5=F0=E9=EA=EF=E9=ED=F9=ED=DF=E1=F2_-_=D0=F1=EF=F4=DC=F3=E5=E9=F2?=
From: "MiamotoXXX @ WorldofWarcraft.Gr Forums" <miamoto@wwwfreemail.info>
Message-ID: <200612290049.705845924799@www.worldofwarcraft.gr>
MIME-Version: 1.0
Content-Type: text/plain; charset="windows-1253"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
Date: Fri, 29 Dec 2006 02:47:54 +0200

Το παρακάτω μήνυμα σας εστάλη μέσω της φόρμας Επικοινωνίας του WorldofWarcraft.Gr Forums από τον/την MiamotoXXX.

--------------------------------

Some live cams show i've captured, ready to see?
bang downloading free gang porn (http://download-free-porn.2sex2u.info/bang-downloading-free-gang-porn.html)
african amateur eve html rapper sex video (http://amateur-sex.2sex2u.info/african-amateur-eve-html-rapper-sex-video.html)
amateur arizona in sex (http://amateur-sex.2sex2u.info/amateur-arizona-in-sex.html)
amateur bbs russian sex (http://amateur-sex.2sex2u.info/amateur-bbs-russian-sex.html)
anal sex babes (http://anal-sex.2sex2u.info/anal-sex-babes.html)
ass sex thumb (http://ass-sex.2sex2u.info/ass-sex-thumb.html)
asian sex actress (http://asian-sex.2sex2u.info/asian-sex-actress.html)
asian sex goddess (http://asian-sex.2sex2u.info/asian-sex-goddess.html)
beautiful mature sex (http://mature-sex.2sex2u.info/beautiful-mature-sex.html)
adult clip gay sex teen video (http://gay-sex.2sex2u.info/adult-clip-gay-sex-teen-video.html)
area bay gay sex (http://gay-sex.2sex2u.info/area-bay-gay-sex.html)
asian teen sex pic (http://teen-sex.2sex2u.info/asian-teen
-sex-pic.html)
black gay teen sex (http://teen-sex.2sex2u.info/black-gay-teen-sex.html)
animated lesbian sex (http://lesbian-sex.2sex2u.info/animated-lesbian-sex.html)
asian lesbian sex teen (http://lesbian-sex.2sex2u.info/asian-lesbian-sex-teen.html)
muscle hairy sex (http://hairy-sex.2sex2u.info/muscle-hairy-sex.html)

--------------------------------

Σχετική ιστοσελίδα: index.php
Διεύθυνση IP: 24.119.128.81
Όνομα Χρήστη: Μη εγγεγραμμένος
Αναγνωριστικό Χρήστη: 0


I'm so sick of this retardish spam. Do they really expect that we will click on that links? sigh -.-

[y2ksw]

Ok thanks. I'll look into it, needs just another line of code ;)

[y2ksw]

I've updated the spam filter. If this is still not working, I will need the complete email attached as a zip file, since pasting into a code/quote window may be changed by vbulletin. :knockedout:

[Mecho]

awesome . thanks for make this . spammers made me crazyyyyyyyyyyyyyyyyyy .

anyway i have new Smart spammer that i think he know about ur hack , lol . here is the email with full header details :

X-Apparently-To: mechondak@yahoo.com via 216.252.110.64; Wed, 18 Apr 2007 07:17:33 -0700
X-Originating-IP: [64.233.162.235]
Return-Path: <mechodownload+caf_=mechondak=yahoo.com@gmail.com>
Authentication-Results: mta361.mail.re4.yahoo.com from=mail.ru; domainkeys=neutral (no sig)
Received: from 64.233.162.235 (EHLO nz-out-0506.google.com) (64.233.162.235) by mta361.mail.re4.yahoo.com with SMTP; Wed, 18 Apr 2007 07:17:32 -0700
Received: by nz-out-0506.google.com with SMTP id m7so145975nzf for <mechondak@yahoo.com>; Wed, 18 Apr 2007 07:17:32 -0700 (PDT)
Received: by 10.114.14.1 with SMTP id 1mr234459wan.1176905852209; Wed, 18 Apr 2007 07:17:32 -0700 (PDT)
X-Forwarded-To: mechondak@yahoo.com
X-Forwarded-For: mechodownload@gmail.com mechondak@yahoo.com
Delivered-To: mechodownload@gmail.com
Received: by 10.114.124.9 with SMTP id w9cs469410wac; Wed, 18 Apr 2007 07:17:31 -0700 (PDT)
Received: by 10.90.28.12 with SMTP id b12mr366994agb.1176905851105; Wed, 18 Apr 2007 07:17:31 -0700 (PDT)
Return-Path: <nobody@host2.mechoddl.com>
Received: from host2.mechoddl.com ([69.72.208.192]) by mx.google.com with ESMTP id 3si868799aga.2007.04.18.07.17.30; Wed, 18 Apr 2007 07:17:31 -0700 (PDT)
Received-SPF: neutral (google.com: 69.72.208.192 is neither permitted nor denied by best guess record for domain of nobody@host2.mechoddl.com)
Received: from nobody by host2.mechoddl.com with local (Exim 4.63) (envelope-from <nobody@host2.mechoddl.com>) id 1HeAz6-0003U4-MK for mechodownload@gmail.com; Wed, 18 Apr 2007 10:18:12 -0400
To: mechodownload@gmail.com
Subject: Mecho Download Contact Us Form - Site Feedback
From: "drugstore @ Mecho Download" <shimushin_eduard@mail.ru> Add to Address BookAdd to Address Book Add Mobile Alert
Message-ID: <200704181409.0f998b891621@www.mechodownload.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="windows-1256"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
Date: Wed, 18 Apr 2007 10:18:12 -0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - host2.mechoddl.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - host2.mechoddl.com
X-Source:
X-Source-Args:
X-Source-Dir:
Content-Length: 544


The following message was sent to you via the Mecho Download Contact Us
form by drugstore.

--------------------------------

Ordered Amaryl from this site and it was sooo much cheaper than buying
it at CVS.. terrific!
They have great products, great prices and fast customer service, what
more can you ask for? Will shop with them always. They're my pick!
David, USA
TheDrugMarket (http://thedrugmarket.com/)

can u kill this one too !!!!! :p

[y2ksw]

Well I think there is not much I can do - but in any case, spam with only one link is not interesting to spammers, so they stop on their own :)

[Mecho]

ok , Thanks anyway for make this great hack :)

[adwade]

I tripped across this old message in some archives and thought it was a unique addition to the choices on the Contact Us page that may offer some more defense:

Undertoad Jul 3rd 2006, 4:20pm
Here's how I deal with it, via "Contact Us Options":

http://cellar.org/2006/spammer.gif

Even with image verification off, this simple method worked perfectly.

No spammer ever figured out that they should change the default setting. Every legitimate contact us user changed the setting.

Gmail's spam filtering picked up only the spam messages. Problem solved.

above taken from http://www.vbulletin.com/forum/archive/index.php/t-188024.html

[y2ksw]

This is the most intelligent solution I've ever seen :)

Compliments!!!