vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vBulletin 3.8 Add-ons (https://vborg.vbsupport.ru/forumdisplay.php?f=235)
-   -   Administrative and Maintenance Tools - vbStopForumSpam (https://vborg.vbsupport.ru/showthread.php?t=222536)

tekknikal 12-08-2009 10:12 PM

just wanted to say thanks. this mod was easy to setup and works extremely well.

JWL 12-22-2009 07:08 PM

Awesome mod, and has cut my spam down to almost nothing

Now How about a VB4.0 gold release :up:

pedigree 12-23-2009 08:11 AM

It works with vb4 gold in its current state :)

Ill see what I can do about removing cURL for those people on old servers.

JWL 12-23-2009 01:27 PM

Just installed again :up:

Skydiver10 12-28-2009 01:09 PM

0.61....Updated and reinstalled XML file...Thank you...:up:

pedigree 12-28-2009 03:19 PM

0.61 was just the same, I just forgot to put the correct version in the mod

Megatr0n 12-28-2009 04:36 PM

Any changes in this new version?

cad2go 12-29-2009 05:31 PM

Flawless install and already catching spammers

mattyk72 12-30-2009 10:33 PM

Excellent, exactly what I needed thank you. Just installed and already got my first spammer.

Medtech 12-30-2009 10:43 PM

I've been using this modification since it was first released, it is still the best mod ever!!:up:

FitgirlWorld 01-19-2010 02:59 AM

thanks for a great mod..

lets hope this works for me

BrightStar 01-20-2010 07:50 PM

This is an awersome mod. Thanks a lot :)

WickedWeb 01-21-2010 08:52 AM

Im messed up somewhere. I have it enabled for ip and emails addresses, and disabled for usernames. I have it so its supposed to log and block registration if either match the data. Query connection timeout is set to allow registration.

To test this after installing I tried signing up with a listed spammer information on the stopforumspam site. It logged that the database match the entry but it still allowed registration due to policy it says. Another weird thing is that i have email verification on and after signing up it said I need to verify my email. This should have put me in the "Users awaiting email validation" group. However it did not. With no email validation I was able to take the spam account and post on my forum with no email error messages. The user I made was directly promoted to a regular user but I have no such promotion set up. Some real issues for me right now.. Also I have no language reference to frontend erorr text. What is going on? I uploaded all the files in the package for 3.8.x and also uploaded the product xml file. Any ideas for me to check into?

The reason query connection timeout still allows registration is in case stopforumspam goes down I want people to still be able to sign up.. Just now double checked something else too.. SQL did not execute on product import.. Tried it manually and it returned sql syntax errors.

WickedWeb 01-24-2010 06:55 AM

Does every field that you enable (username, ip, email) have to match before registration is denied? I tried making test accounts from users in the database at stopforum spam and registration is still being allowed. The only difference is my ip is different. I have all 3 enabled. I am unable to create a denied account.

pedigree 01-28-2010 11:00 AM

No, just one of the fields. Its not so much as a "match these fields", its more of a "match any of these fields".

It sounds like you need to change to option to Block instead of the allow

pedigree 01-28-2010 12:41 PM

deleted

pedigree 01-28-2010 12:46 PM

deleted, my bad

babynino 01-29-2010 02:38 AM

Best mod ever... moderators can now focus with other forum related matters. Spambot activity has gone down to almost zero ever since I installed this mod on my forum.

Thanks so much!

ShadMan 01-29-2010 02:11 PM

Terrific hack, thanks!

ascender 02-08-2010 05:27 PM

Quote:

Originally Posted by wmelnick (Post 1880632)
Following the installation instructions gives "Invalid File Specified" when I try to import it. Any ideas?

W

Same error message here on 3.8.4. No other mods have failed in this manner and can't see anything out of the ordinary.

I'm getting hammered with spam by PM just now, where do I start in finding out why this won't install?

Thanks :)

ZombieAndy 02-09-2010 09:00 AM

Absolutly brilliant modification, i installed this on my forums, we were getting hit bad with PM spammers and this mod catches and prevents around 30 registrations a day at the moment.

Free's up so much time for my staff groups, thank you. amazing job.

spwolf 03-04-2010 01:56 AM

i started getting 100+ new registrations recently, which i think are bots... nothing is helping so far... none of them are doing anything right now, so we will see... mods are waiting ;-)

i will also install mod that allows easy reporting so i can report them...

WickedWeb 03-04-2010 04:23 AM

My installation was logging everything and tagging them as being in the stopforumspam database but even though I had everything set to block the registration it would not block them from registering. They could still register and post.. In one weird case some one without email verification was able to post but I do not know if that was related to this or not but it happened at the same time. I removed everything and all is back to normal. I could not make sense of the registrations not being blocked.

This was on 3.8.3.. I am going to update soon as I can and try again..

mytweakerart 03-12-2010 11:29 PM

simply awesome dude
installed on 3.8.4
youve saved me from those bastages again

http://www.ToyotaBrakeRecall.org

BGObsession 03-20-2010 04:36 PM

I have the mod installed, along with the plug-in to be able to submit spammer info from the admin cp. Seems to be working incredibly well. Only question I have is that when I look at the spam log, sometimes the mod has listed a new registration, but has 'Allowed Registration'. If the modification IDENTIFIED the new registration as a problem in the first place, why would it not block that user from registering? I have it on the default settings, so it should block anyone who has a previously reported username, IP, or email address, right?

It seems inconsistent for the mod to both list the registration in the spam log, but to have allowed the registration anyway? The instances I've seen this occur are ones where the new registration has not yet performed email confirmation. Does that have anything to do with it?

WickedWeb 03-20-2010 05:36 PM

Quote:

Originally Posted by BGObsession (Post 2007124)
I have the mod installed, along with the plug-in to be able to submit spammer info from the admin cp. Seems to be working incredibly well. Only question I have is that when I look at the spam log, sometimes the mod has listed a new registration, but has 'Allowed Registration'. If the modification IDENTIFIED the new registration as a problem in the first place, why would it not block that user from registering? I have it on the default settings, so it should block anyone who has a previously reported username, IP, or email address, right?

It seems inconsistent for the mod to both list the registration in the spam log, but to have allowed the registration anyway? The instances I've seen this occur are ones where the new registration has not yet performed email confirmation. Does that have anything to do with it?

Finally I have some additional proof. If you read a couple post or so behind this one I have the same problems as you just stated. It seems though that nobody is really supporting this.

KW802 03-20-2010 05:55 PM

1 Attachment(s)
Whoops, didn't realize that I posted this in the 3.6.x thread instead of the 3.8.x thread... :o

Quote:

Originally Posted by KW802
After upgrading my vB 3.x sites to vB 3.8.5 it meant, of course, that I lost the manual edits to submit the user to StopForumSpam.com from directly in the ACP.

So... I came up with a very quick & very dirty plugin to add an option in the postbit. That way if a spammer does make it through and posts something, I can view the post, click on their name in the postbit, hit the 'Submit' button from the drop-down list (which then takes my browser window to the StopForumSpam.com site and shows me the result of submitting the info), hit the browser 'Back' button, and then continue BAU on cleaning up the spam.

Only Super Mods & above should be able to see the 'Submit' button but, for your own sanity, test it out on your site. ;)

Attached is the plugin XML and a screen shot of how it'll look. Notice this is a plugin and not a product! That means you import via ACP => Plugins & Products => Download/Upload Plugins and *not* through the Manage Products screen.

Yes, it's quick & dirty but it serves my purposes.


KProjects 03-23-2010 04:19 PM

Installed a while ago - can't believe how many it catches throughout the day.. it's like 7 or 8 an hour!!

I'm starting to wonder if they're all spammers.. heh

sump 03-24-2010 10:51 AM

this mod is awesome !! we went form aproximatly 70 -100 registrations to 10/15 it looks like it get about 90% .. very please

there is some talk here about the alllowed .. the ALLOWED that i see did not find any problems with either IP, username or e-mail, just like if i search the IP in google ...

also all of the people that already registred I still must deal with , but from the minute this was installed it went to work !!

see see no error messages when one IS allowed,, DEFAULT settings ,,,

in the past when i have had problems with hacks .. delete as er instructions if any , redownload, reinstall ....

thanks for this great mod !!

Theo-zzzz 05-01-2010 06:37 PM

This mod is blocking about 200 spam registrations a day.
It saves us so much time.

Nominated for MOTM

noj75 05-02-2010 03:45 AM

Installed this last night.
Checked the log this morning and 31 spammers had been blocked. I am so very impressed with this mod.

Thank you Pedigree, excellent work!

Nominated for MOTM!

Dunhamzzz 05-04-2010 08:34 AM

I've had this mod for a while now (almost a year), but over the last few days I've had quite a few emails from real people who have been unable to register because the plugin has blocked them, this is happening on all my forums.

I'm temporarily removing it...

DanGarion 05-04-2010 07:17 PM

It appears that the www.StopSpamLinks.com is dead... :(

pforums 05-06-2010 12:08 AM

Thats cause it's http://www.stopforumspam.com/ :o

bobnv 05-09-2010 03:59 PM

Have an interesting issue. We have this installed on two separate forums, all seems to work well a far as programs operation but on one install "Prune vbStopForumSpam Logs" was installed under the log section and on the other forum, it was not installed. The installations were done by two separate people, could it be that something was missed in the uploads on the one missing the prune section?

BTW, have had this mod installed on one forum for about 6-7 weeks and the log is up to 3300+ the only spammers that get through are the ones that have fresh clean emails and IP's, but that's not many.

Zookie 05-10-2010 03:03 PM

REALLY NICE! Just installed to my vBulletin 3.8.5 and looks like a real winner. However...

I was thinking that leaving the User name check enabled would be a problem as I suspected that common user names would get flagged. For instance, if someone tries to use "Fred" they should get flagged according to http://www.stopforumspam.com/api?username=Fred. I tried testing this by registering a new user with the name Fred and it was allowed even though I have User name checking enabled and the above URL suggests that it should have been blocked. So maybe I'm not understanding how this works...

Cindyl10 07-30-2010 05:16 PM

We have been being attacked for the last month and now they have begun to try and hack into our board since they haven't been able to get through our registration blocks to prevent spammers and trolls. I am running vBulletin 3.8.6 Patch Level 1 and I have spoken to our host and they have suggested I contact vbulletin which I'm trying to do but I also thought I should let you all know what's going on too as if they are able to hack me, they can then hack anyone with this mod. Here is all the info I have on it which I gave to my host

Quote:

We've been being spammed a lot and had to install a program that rejects spammers registrations as we were getting something like 100 a day. Well one person who was rejected keeps coming back to the board and when I look to see what he's doing, it says "modifying his profile". I wasn't to worried about it since I didn't think there was anything he could do to cause the site to accept his registration anyway, but each time he does it I get a database error and it looks to me like he is trying to force the board to add him as a member. This is what the error says:

Database error in vBulletin 3.8.6:

Invalid SQL:
SELECT DATEDIFF(NOW(), '2010-07-27 20:18:50') AS DAYS;;

MySQL Error : MySQL server has gone away
Error Number : 2006
Request Date : Tuesday, July 27th 2010 @ 09:56:19 PM
Error Date : Tuesday, July 27th 2010 @ 09:57:14 PM
Script : http://www.fresh-hope.com/forums/reg...p?do=addmember
Referrer : http://www.fresh-hope.com/forums/register.php?
IP Address : 94.23.18.220
Username : Naramoria
Classname : vB_Database
MySQL Version :

***************

In the line that says script is a link and at the end of the link it says: " do=addmember" which is what made me think this... Is this troll a possible hack attempt do you think or am I being paranoid?
Quote:

Hello Cynthia,

Thank you for contacting support.


It does appear that he may be attempting to use SQL Injection, however as long as your forum software is up-to-date and the latest version is installed you should certainly be safe. However, if you would like we can ban 94.23.18.220 from the server, so this way it will ensure he can't access the site or attempt any further malicious injections.

regards,
Melissa


I had them go ahead and do that. But it happened again today:


Quote:

It's happening again I'm afraid. The people who are attacking us seem very stubborn. The biggest problem is that they're pro's and constantly switch their IP's. That's why we had to install the two programs we did to intercept them. We installed them a week ago on July 23rd and since then the programs have rejected 409 registrations as spammers.

This error message is slightly different though. Here is a copy of it:


Database error in vBulletin 3.8.6:

Invalid SQL:
INSERT HIGH_PRIORITY IGNORE INTO vbstopforumspam_remotecache (date, data, spambot, field) VALUES (now(), 'martinkiday', '0', 'username');;

MySQL Error : MySQL server has gone away
Error Number : 2006
Request Date : Friday, July 30th 2010 @ 05:31:02 AM
Error Date : Friday, July 30th 2010 @ 05:32:20 AM
Script : http://www.fresh-hope.com/forums/reg...p?do=addmember
Referrer : http://www.fresh-hope.com/forums/register.php?
IP Address : 89.212.200.113
Username : martinkiday
Classname : vB_Database
MySQL Version :

I meant to add that one thing that concerns me now is that they've obviously figured out what the main program we're using to defeat them is: vbstopforumspam

Quote:

Hello Cynthia,

Thank you for your reply.

From the SQL code, it appears they are attempting to inject into the caching system. Honestly, I would strongly suggest providing those results to vBulletin, as the developers would be the best people to tell you whether you are safe from those specific attacks or not. I know from experience that vBulletin is kept up to date regularly and is protected by these type of attacks, however it certainly doesn't hurt to get a second opinion from the source itself .


Please let us know if there is anything further we may assist you with from here.

regards,
Melissa

Please let me know if perhaps you guys can help me and if my board is safe...

Cindyl10 07-31-2010 09:46 AM

Quote:

Originally Posted by Cindyl10 (Post 2076886)
We have been being attacked for the last month and now they have begun to try and hack into our board since they haven't been able to get through our registration blocks to prevent spammers and trolls. I am running vBulletin 3.8.6 Patch Level 1 and I have spoken to our host and they have suggested I contact vbulletin which I'm trying to do but I also thought I should let you all know what's going on too as if they are able to hack me, they can then hack anyone with this mod. Here is all the info I have on it which I gave to my host

Quote:

We've been being spammed a lot and had to install a program that rejects spammers registrations as we were getting something like 100 a day. Well one person who was rejected keeps coming back to the board and when I look to see what he's doing, it says "modifying his profile". I wasn't to worried about it since I didn't think there was anything he could do to cause the site to accept his registration anyway, but each time he does it I get a database error and it looks to me like he is trying to force the board to add him as a member. This is what the error says:

Database error in vBulletin 3.8.6:

Invalid SQL:
SELECT DATEDIFF(NOW(), '2010-07-27 20:18:50') AS DAYS;;

MySQL Error : MySQL server has gone away
Error Number : 2006
Request Date : Tuesday, July 27th 2010 @ 09:56:19 PM
Error Date : Tuesday, July 27th 2010 @ 09:57:14 PM
Script : http://www.fresh-hope.com/forums/reg...p?do=addmember
Referrer : http://www.fresh-hope.com/forums/register.php?
IP Address : 94.23.18.220
Username : Naramoria
Classname : vB_Database
MySQL Version :

***************

In the line that says script is a link and at the end of the link it says: " do=addmember" which is what made me think this... Is this troll a possible hack attempt do you think or am I being paranoid?
Quote:

Hello Cynthia,

Thank you for contacting support.


It does appear that he may be attempting to use SQL Injection, however as long as your forum software is up-to-date and the latest version is installed you should certainly be safe. However, if you would like we can ban 94.23.18.220 from the server, so this way it will ensure he can't access the site or attempt any further malicious injections.

regards,
Melissa


I had them go ahead and do that. But it happened again today:


Quote:

It's happening again I'm afraid. The people who are attacking us seem very stubborn. The biggest problem is that they're pro's and constantly switch their IP's. That's why we had to install the two programs we did to intercept them. We installed them a week ago on July 23rd and since then the programs have rejected 409 registrations as spammers.

This error message is slightly different though. Here is a copy of it:


Database error in vBulletin 3.8.6:

Invalid SQL:
INSERT HIGH_PRIORITY IGNORE INTO vbstopforumspam_remotecache (date, data, spambot, field) VALUES (now(), 'martinkiday', '0', 'username');;

MySQL Error : MySQL server has gone away
Error Number : 2006
Request Date : Friday, July 30th 2010 @ 05:31:02 AM
Error Date : Friday, July 30th 2010 @ 05:32:20 AM
Script : http://www.fresh-hope.com/forums/reg...p?do=addmember
Referrer : http://www.fresh-hope.com/forums/register.php?
IP Address : 89.212.200.113
Username : martinkiday
Classname : vB_Database
MySQL Version :

I meant to add that one thing that concerns me now is that they've obviously figured out what the main program we're using to defeat them is: vbstopforumspam

Quote:

Hello Cynthia,

Thank you for your reply.

From the SQL code, it appears they are attempting to inject into the caching system. Honestly, I would strongly suggest providing those results to vBulletin, as the developers would be the best people to tell you whether you are safe from those specific attacks or not. I know from experience that vBulletin is kept up to date regularly and is protected by these type of attacks, however it certainly doesn't hurt to get a second opinion from the source itself .


Please let us know if there is anything further we may assist you with from here.

regards,
Melissa

Please let me know if perhaps you guys can help me and if my board is safe...

Just this morning I discovered that I had yet another database error like the above one and when I checked the "member" who had just registered seems to be legit according to everything I can find out about them, so now I am really really confused! I know for a fact that the above two times were spammers/potential hackers but this time this person seems to be a perfectly legit registration and I doubt if they'd know how to do this... I'll share a copy of the error but I'm just very confused and don't understand any of this as this one looks more like the vbstopforumspam program itself might be responsible for these errors....

Database error in vBulletin 3.8.6:


Invalid SQL:
INSERT HIGH_PRIORITY IGNORE INTO vbstopforumspam_remotecache (date, data, spambot, field) VALUES (now(), 'mr_nazarene', '0', 'username');;


MySQL Error : MySQL server has gone away
Error Number : 2006

Request Date : Friday, July 30th 2010 @ 09:32:00 PM
Error Date : Friday, July 30th 2010 @ 09:32:54 PM
Script : http://www.fresh-hope.com/forums/reg...p?do=addmember
Referrer : http://www.fresh-hope.com/forums/reg...hp?do=register
IP Address : 64.134.158.177
Username : mr_nazarene
Classname : vB_Database
MySQL Version :

Please help me to determine if my board is safe and what is causing this database error.

KProjects 07-31-2010 09:59 AM

Have you looked in the logs that vbstopforumspam keeps (bottom of your admincp in statistics and logs) to see if there are others that aren't causing this error?

Are you getting the 'mysql server has gone away' errors for other pages on your site also?

If it let the last one - mr_nazarine - register, try PMing him to see if he's real..

Cindyl10 07-31-2010 11:34 AM

Yes I have looked through the logs. Nothing seems to cause this error. The first two errors were made by a person who's registration was denied (a lot of times lol) and he was obviously trying to bypass it. When I would look to see what he was doing on the board after his registration was denied it would show him "modifying or editing his profile". It would be at that time that I would get those first two error messages I posted.

As for this last error message, the username is shown twice in a row in the log:

Quote:

mr_nazarene 2010-07-30 21:33:59 MDCassens@email.nbc.edu 64.134.158.177 Allowed registration
mr_nazarene 2010-07-30 21:33:09 MDCassens@email.nbc.edu 64.134.158.177 Allowed registration
but only shows up as once in the members list and the new registrations list. I checked them out very thoroughly and can't find anything to indicate that they are trolls or spammers or anything other then a regular person who wants to join us... in fact they appear to be a pastor.

The only other "oddity" that was somewhat like this that I've seen happened yesterday. Again someone registered and seemed "normal". (they have since posted and are fine) This is how their registration shows up in the logs:



What is weird is that the only thing that showed up in my member list or new registrations was the last one; none of the other three did...

It has let through only two that I determined were trolls and banned, but those two were only listed once when on the logs such as:


Quote:

Tanichi 2010-07-28 17:49:29 acneinfo@zenmed.eu 188.153.53.2 Allowed registration
Yet when I looked in new registrations that name isn't there; when I do a search they don't exist. I assumed for lack of a better explanation that when vbStopForumSpam approved them that my other program Auto-Moderate Evading Banned Members caught them and disallowed them... but I have no way of knowing as there are no logs for that program...at least none that I can find... Thank you for your help!


All times are GMT. The time now is 06:52 PM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01413 seconds
  • Memory Usage 1,888KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (14)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (3)pagenav_pagelink
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (40)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 

Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete