DNSBL, RBL - Open Proxy monitoring/blocking

[TMM-TT]

History

I've had some problems with abuse via open proxies for a time ago, and when we were banning abusers, they always found a new proxy to use and register new accounts with. Since this forum was a large type we could'nt just ban e-mails etc just like that, because this was leading to a very large amount of other banned users too.

At IRC, in the other hand, we had Open Proxy Monitors, that was banning everything that was blacklisted in some DNSBL-databases. No spammers had a chance to get in there as long they were listed in such database.

This is a plugin that blocks blacklisted hosts from some different DNSBL's. It uses the global_start-hook, a very simple handler for blocking proxies, and a vBphrase called OPM_Deny.


April 2006

The source has been rewritten a bit. The proxychecker is now using a cache that, by default, stores all ip's in a database for 6 hours. It scans some DNSBL's and can be configured to block proxies from bitmasks (defined in the plugin) which makes it a little bit more reliable, because it does'nt block everything it see).

Configuration is made from the plugin (hopefully there will be a nice admin interface in the future). Exceptions (ip's that can pass through this system even if it is a proxy) are also handled differently now.

// CHANGES
//
// 2008-09-20 (2.0.8)
//
// * Changed the routines for how to handle inclusion/exclusions
// * Splitted up plugins for 3.5/3.6 and 3.7
//
// 2007-08-05
//
// * Fixed reported bug, based on resolved hosts ending with 127
// * Changed database-tables to get rid of (hopefully) duplicate keys
// * Added resolver-function
// * Added two new block-methods available at the efnet-rbl
//
// 2006-06-28 (2.0.6/Another fix)
//
// * Proxyinclusions/exclusions didn't work properly
//
// 2006-06-28 (2.0.5/Fix only)
//
// * Fixed a bug in the $block-array that affected some of the blocking results
//
// 2006-06-28 (2.0.4)
//
// * opm.tornevall.org has a new entry for anonymizers, added support for this
// * Default value on "block everything detected" in plugin changed to "no"
//
// 2006-06-26 (2.0.3)
//
// * Created options for admincp (removed plugin-configuration)
// * Fixed a bit-bug for njabl
// * Plugin is now a function (rbl_livecheck) for external lookups
// * Added options for "only block on newuser-registrations"
//
// 2006-06-22 (2.0.3 RC)
//
// * The monitor is now a function
// * Added small compatibility with other plugins (with return)
//
// 2006-05-13
//
// * sorbs zones added (no bitmasking)
// * opm.blitzed.org removed
// * time() changed to TIMENOW
//
// 2006-04-21
// ==========
//
// * proxyinclusions
// quickly add own hosts that should be treated as a proxy
//


How does it work with other vBulletins?

This filter actually works with both 3.5 and 3.6, but for now, they will be separate versions, but for 3.5 and 3.6 you should look here (https://vborg.vbsupport.ru/showthread.php?t=96318) and for 3.7 you should look here (https://vborg.vbsupport.ru/showthread.php?t=191398).


How to use the compatibility thing

If you have a plugin that you want to use together with the proxy monitor (only returns a value if a an ip-address is registered as a proxy or not) you can call the function rbl_livecheck like this (example):


global $rblInstalled;

if ($rblInstalled) {
$remoteIsProxy = rbl_livecheck(1, $_SERVER['REMOTE_ADDR']);

//
// .. your code here ..
//

}

Report bugs if you find them...



Don't forget to install (https://vborg.vbsupport.ru/vborg_miscactions.php?do=installhack&threadid=96318) it :)

[TMM-TT]

First Post Reservation.

Look here for the project list (http://forum.tornevall.net/project.php?do=issuelist&projectid=2&issuetypeid=feature)

[Black Tiger]

Seems interesting to me, going to tag this one for later inspection and/or use.;)

[MentaL]

amazing if this actually works.

[proxx]

anybody test this yet ?

[zero5854]

helll YES this works!!! I tried 7 different well known proxies and kept getting errors. After that I logged back in normally and it was fine! THANKS ALOT!!!!!

[raugusto]

Going to give it a try later on.

[corman420]

Do you guys got a proxy I can try to test this? Thanks.

[Vaupell]

Do you guys got a proxy I can try to test this? Thanks.

yeah here you go Web proxy's (http://tinyurl.com/bp4gxc)
great for Ip hideing, when playing browser games with multiple accounts. :p

<3 hidemyass.com

[Leo Brazil]

I've been using this without any problems but it seems one of our biggest internet providers got blacklisted. So far I don't care, they are big enough to take care of them selves but several members (different IPs) using this provider got affected by this mod.

All those member in fact are not using proxies and you can track their IPs to host names.

Question is how to include this host in Non-block list ?

Example: all users with this problem the host name are like 255-55-55-00.host.name.net

As many IPs have been used I just tried to include host.name.net on the list but it doesn't work.

Any tips ?

[TMM-TT]

I've been using this without any problems but it seems one of our biggest internet providers got blacklisted. So far I don't care, they are big enough to take care of them selves but several members (different IPs) using this provider got affected by this mod.

All those member in fact are not using proxies and you can track their IPs to host names.

Question is how to include this host in Non-block list ?

Example: all users with this problem the host name are like 255-55-55-00.host.name.net

As many IPs have been used I just tried to include host.name.net on the list but it doesn't work.

Any tips ?
That will be included in next version. :)

[Leo Brazil]

Thanks TMM-TT,

Is there a change to give an option as well to include specific IPs and user IDs ?
I tell you what, specific IPs because sometimes you don't want to alloy the whole host and user IDs, I mean once user was already registered why block them ? Many users are traveling aroung and Hotels or paid internet access use proxies but if the user has logged in it means it's a trully member right ?
Other suggestion is not block instantly visitors and users, in fact I think it should have a option to not block visitors at all only step up in monitoring them as soon they got registered because lots of searching bots use proxies or somenthing like that and could be blocked, and as soon a member is registered just give a warning at moderation panel so moderators can take a look at it and approve a member or not. Using this version it showed very effective in blocking proxies listed as spammers but it was blocking a lot of people that was in fact good faith visitors.

I'll wait for next version.

Sorry for a lot of comments, I only do that when I think a good has a real potential and that's the case here.

[drupy]

Installed.

Do you think it will have any conflict with Proxy IP to Real IP Conversion
by Paul Marsden below?
https://vborg.vbsupport.ru/showthread.php?t=201211

I installed both mods and I was wondering how your mod will work if the proxy IP is converted to real IP by Paul's mod.

Thank you!

[Arboristsite]

Since AOL uses proxies are they effected with this mod?

[AWJunkies]

Since AOL uses proxies are they effected with this mod?

I have same question

[Leo Brazil]

Guys, it'll only blocks proxies if the IPs are listed on some black lists websites as spammers and something like that. (you acn even select in your AdminCP what black lists and sites you want to check to confirm an IP)
Even using a proxy if it's not listed as spammer, this one will pass through as normal.

[AWJunkies]

Ok thanks testing it out.

[HaZe_X]

How come I cant get this to work for me?

I have everything enabled, and when I use a proxy site I am still able to view my site

Ex..hidemyass.com

[mjolner]

Is there any way to add the 'include list' to the 'on registration' hook?

foreach ($proxyinclusions as $inclusionkey => $inclusion)
{
if (preg_match("[$inclusion]", $OPMremote) AND $inclusion != "") {$OPMinclude = true;}
}

(That one)

If you have "only ban on new registration" it doesnt seem to use the Include/exclude list

[basil2070]

How come I cant get this to work for me?

I have everything enabled, and when I use a proxy site I am still able to view my site

Ex..hidemyass.com

Have the same problem. Any help?

[terminator2k2]

I'm still using vb 3.7.6 but i will update to 3.8.2 in a month

can this one be used under 3.7 or should i use this (https://vborg.vbsupport.ru/showthread.php?t=191398 ) ?

[Deimos]

Getting a whole bunch of MysqL errors after installing this

Database error in vBulletin 3.8.2:

Invalid SQL:
INSERT INTO proxycache (ip, listed, dateline) VALUES ('xx.xx.xxx.xxx', 0, 1239258676);

[steampunks]

What if I don't wish to block?

Instead I prefer to receive an automated PM (as with the cookie detector mod) about which member is using a proxy.

If a proxy is always blocked regardless, the troll will just move on to another proxy method and the moderation team is none the wiser that a troll is on the prowl.

[ouch]

This works great if the proxies are blacklisted, but if i add some proxies to be treated as such it fails badly...for instance here's a small example that bypass this,

http://www.yourhideway.info/

Now im supposed to be able to include that for monitoring ie 'List of hosts, separated with ENTER, that should be considered as proxies'.

FAILED
:(

[Playa82]

sorry, but it doesn't work. i tried 9-10 proxys. none of them where blocked... :-(

[peterle1]

How can I use this with zen.spamhaus.org?
I use spamhaus with our mail servers and have some good experiences with it.

Inserting zen.spamhaus.org doesn't seem to work and spammers still got through, even if they are listed at spamhaus.

Thanks for any help.

[peterle1]

This does not work for me and I would like to test why, but don't know how to do this.
Anyone with any hints here?
Thanks!

[Wizardjv]

I have a simple question. When entering domains into the allow and block list via admincp. What is the format that they are supposed to be entered in to block and allow them? I think maybe thats where people are having problems. Does anyone have this working? If not I guess it just doesnt work

[dutchbb]

After installing, a lot of legit members got banned, so I uninstalled it. NOt very good if you ask me.

[TMM-TT]

After installing, a lot of legit members got banned, so I uninstalled it. NOt very good if you ask me.

Well, the script is quite adaptable, so you can change the sensitivity via admincp. The default settings is the most optimal to use, but you can also lower the triggers.

[TMM-TT]

dnsbl.tornevall.org now includes hosts from http://www.stopforumspam.com/, the bitvalue for such hosts are 64 (abuse) and is covered by "opm.tornevall.org: Block abusive hosts" in the plugin

[BigDog56]

I got a ex-member now that spends all day using proxies to try and register with. I hope this works.

[BigDog56]

It don't. This person came through about 20 different black listed proxies. :(

[BigDog56]

Uninstalled mod.

[Dark_Wizard]

I have uninstalled this as well and found it doesn't work as advertised.

[Lolli]

Installed.

[TMM-TT]

It don't. This person came through about 20 different black listed proxies. :(
Do you know which proxies it was and if the are listed at dnsbl.tornevall.org? It may be something with the configuration in that case.

[xyzmary2001]

Tried too various proxies and I can register using them.

Reserved for installing after updates and fixing this problems.

[Bin7raib]

Thanks, but the demo is blocked in UAE :(

[mhackl]

Testing

[buurman]

Gonna put it trough a testround...

I hope it works... would be great..

[glaive]

I have disabled this mod and will likely uninstall it as I have had enough legitimate registered members encounter issues due to this mod.

[Fraxter]

Any update for vb4 planned?

[TMM-TT]

Any update for vb4 planned?

To be honest: I almost forgot that part. But I'm thinking of migrating my own forum to the new version, so - yes, definetively! Thanks for reminding me! :)

[Fraxter]

Thanks for your answer, i'm using your addon very often. :)

[final kaoss]

Can it aid this mod or will there be problems?
https://vborg.vbsupport.ru/showthread.php?t=207966

[TMM-TT]

Can it aid this mod or will there be problems?
https://vborg.vbsupport.ru/showthread.php?t=207966

I think it's more about reversing the process or something like that. I haven't checked that mod more than reading the thread, and it feels a bit unwise to ban by iphistory since IP's tend to get old very fast. A cache or some kind of agechecking may be a solution for it.


Thanks for your answer, i'm using your addon very often. :)

I've just upgraded to 4.0 and currently learning the new system, so the solution is getting closer! :)

[Fraxter]

Any update status for vb 4.x? Would be very nice to use this addon on vb4. :)

[relaxiha]

Any update status for vb 4.x? Would be very nice to use this addon on vb4.

[TMM-TT]

As soon as I can, I would say. In all this chaos I suddenly sitting here with a newborn child also, so I'm trying to catch up with everything that I missing. I'll do my best, since I need it myself too :)


And a little FYI: Time to change the blitzed bitmask, perhaps?

http://www.stopforumspam.com/forum/viewtopic.php?id=2224

The DNS Blacklist has also been updated:
Live reporting from scrapers
DNS runs on MySQL so everything reported goes live immediately
Daily statistics about added and removed hosts

[bulbasnore]

As soon as I can, I would say. In all this chaos I suddenly sitting here with a newborn child also, so I'm trying to catch up with everything that I missing. I'll do my best, since I need it myself too :)

Understood! Just letting you know that after all these years, there are still folks who would like to see this for 4.2.x, especially as 3.8 is out of support.

Cheers.

[TMM-TT]

Understood! Just letting you know that after all these years, there are still folks who would like to see this for 4.2.x, especially as 3.8 is out of support.

Cheers.

I'm glad to hear that!

I actually tried to activate the product for 4.2.x for a few days ago, and it failed bigtime, to load. So I think it's time to take care of the problem :)

Besides, opm.tornevall.net got deprecated for a while ago, and I need to update the hosts to dnsbl.tornevall.org anyway.