FYI db->query is depreciated as of 3.6. You should be using db->query_read and db->query_write. Not that this changes functionality but sticks with the vBulletin coding style.

I also noticed that you don't free the result of the database queries with db->free_result. db->query_first should be used in a number of places since you only want the value of one field. This will make remove the need for db->fetch_array and db->free_result.

Please use db->escape_string instead of addslashes. addslashes doesn't catch all cases nor does it take into account the SQL connection encoding.

For the datediff consider db->query_first_slave as we don't need to be hitting the master db server with that query.

rsw686 thanks for the heads up :)

Excellent with 4.0.1 Thank you.
I had similar experience with 3.84
J.R.

I installed this, on multiple forums, and it's working great! I've had a couple spammers slip through, but it has drastically slowed them down.

I do have a problem though, and I don't know what's causing it. Many of my members are now complaining that they need to log in daily, or sometimes even every time they visit the forum now. I don't know how it could be related, but it started afer installing this plug-in. Anyone else seen this? Anyone have a clue how to fix it?

I'm running 3.84 patch level 2

Gotta say, thanks!
In 2 days, this plugin caught 88 spammers trying to register!

As of today I have had 25+ new members complain that the plugin isn't working. The stop forum spam database check step doesn't complete and registration is blocked.

I wonder if we're blocked, the database down, or the plugin needs an update or whatever?

I for now have turned off this mod so I do not lose 50 potential registrations in a day from valid members.

There are two settings in case of connection errors: "Query Connection Errors" (What should happen if the remote connection times out when querying the new registration?) and "Data Fetching - Cache" which help to identify these type of errors.

I've just installed StopForumSpam. It was super-easy. After carefully studying what it does, I realized it essentially automates most of the successful bot-blocking strategies I've been using manually here for over 2 or 3 years. Wish I'd found this add-on l-o-n-g ago. Duhhh!

It has blocked a dozen spambot registrations in its first hour. I have every expectation it will eliminate 99% of all spambot registrations and cut the risk of spam-posts to a minimal level. I suspect I'll be able to stop moderating new registrations almost completely. We'll see. But that's my guess.

Thanks a lot! :)

Here's a very minor bug in vbstopforumspam.php

Database error in vBulletin 3.8.2:

Invalid SQL:

SELECT * FROM vb3_vbstopforumspam_log AS logs

ORDER BY ip ASC, date DESC
LIMIT 0, 15;

MySQL Error : Unknown column 'ip' in 'order clause'
Error Number : 1054
Request Date : Monday, January 25th 2010 @ 04:50:55 PM
Error Date : Monday, January 25th 2010 @ 04:50:56 PM
Script : http://myforums.com/forums/admincp/v...erby=ip&page=1
Referrer : http://myforums.com/forums/admincp/v...am.php?do=view
IP Address : xx.xxx.xxx.x
Username : webmaster
Classname : vB_Database
MySQL Version : 5.1.30

The column-name reference in this query should be to "ipaddress" and NOT to "ip". I fixed it here. But it should be fixed in the released code too.

Unistalled, the server seems to be down most of the time now causing no one to be able to register. This works really well!
https://vborg.vbsupport.ru/showthread.php?t=183917

@Floris / @TheInsaneManiac:

There is an option in the configuration of the plugin:

"What should happen if the remote connection times out when querying the new registration?" Allow Registration / Block Registration

...which will first check your local cached copy of the stop forum spam dataset (ie. you are still protected from most recently known spammers in your local cache) and then allow registration if there is no response from the stop forum spam.

As the site has had a 3x+ traffic increase from January 2009 - January 2010, scaling and DDOS attacks are always a challenge. That being said, there is much effort happening behind the scenes to increase the robustness / speed of the stop forum.

@TheInsaneManiac, the plugin you suggested can certainly be run in combination with the SFS plugin as they compliment each other well. That being said, it only prevents automated (bot) not human spammers.

I see that Floris and Insane Maniac and perhaps others are reporting experiencing problems with accessing the database that support this add-in. Yet, as far as I can tell, I'm not having any problems in doing so.

Can someone comment about these reported problems? Is this an issue you are working on or is it one you can't fix or is it perhaps related to loads on your current server? This is a great and very effective mod. I'd hate to see it vanish because the database we all rely on has become unreliable.

Thanks!

Oops. I see that between the time I read InsaneManiac's post and the time that I got around to replying to it, skippybosco has commented. Sorry I didn't notice that before I posted this request. :(

@websissy: I'm also not having the problems that folks are reporting here, but I make use of the cached database whenever possible and set the plugin to allow registration if not in local cache AND can not reach SFS server for some reason.

As I eluded to in my previous post, there are backend enhancements that are being implemented that will certainly increase the robustness of the server requests, but for the most part tuning the configuration of the mod on your local server will greatly improve the experience for both you and your users.

I thought I had fixed that, grr, its certainly posted back in the thread. Ive gone back, changed it and reuploaded the zip file again. I have no idea how that got back into the upload

Im not aware of any server down time recently.

Are you using cURL? Are the blocks all at much the same time or scattered randomly? Maybe switch it so that it will allow registration on error?

None of us is perfect, Pedigree... least of all we software types. As far as I'm concerned this product is one of the most useful vbulletin hacks I've seen. I wasn't complaining... I just wanted to help improve it a bit.

Don't sweat the small stuff. You ROCK, friend!!

Thanks! :D

Thanks :) but I still want to try to fix anything where I can. If the script is failing for any reason that I can control, then I really want to try to fix it.

I had the same result with it catching what seemed to be an extremely high number. Then I looked through the code and realized it checks the stop spam database even if the registration fields aren't validated. So if a bot submits with an invalid code or mismatch password it checks the stop spam database first. I changed the code to just let vBulletin throw the invalid registration fields error. This way I am not hitting the stop forum spam database when unneeded. All I had to do was wrap the register_addmember_process hook with if (empty($userdata->errors))

I also noticed that the cache is inserting records for the same data with a newer datestamp. However when grabbing the results from the cache it doesn't sort by date. Potentially the cached results could be around longer then the time set in the control panel. I changed this to only insert into the cache it there was not a cache hit already. This one I kind of went crazy rewriting things. pedigree if you would like I can send you the files. I want to say upfront that I am extremely picky with mods as I like to do things in a consistent way since it isn't part of the vBulletin release.

rsw686 im working on your other suggestions and Ill add this one as well.

vB.org sent out an auto-update for vBSFS last night, but I only see the 0.6.1 version... Clicked the wrong button there? ;)

@Barteh: Given the updated dates of the files in the .zip I would say it is indeed updated, but retaining the legacy version number. Pedigree eludes to the included fixes a few threads above this one.

Ah, alright. As I'm not experiencing any vBSFS problems right now, I suppose I can stick with my current installed version, then :)

It was to fix an issue with a re-install without first having removed it. There is no need to redownload and reinstall

It was to fix an issue with a re-install without first having removed it. There is no need to redownload and reinstall

Thanks for helping us to reduce spams.

FWIW, we are seeing a significant problem with vbStopForumSpam because of pollution in the www.stopforumspam.com database.

For example, the other day we found that the www.stopforumspam.com database was blocking the IP address of Sun Microsystems, definitely not a spammer.

The problem has become so bad, we have disabled all IP checking :(

Of course, this is not a problem with this great mod, but a problem with most RBL type systems where the data is user contributed and often inaccurate.

We might have to deinstall this.... unfortunately.

@imported_silkroad: What is the IP address in question? Have you reported it to the admins at Stop Forum Spam so it can be investigated and potentially removed from the database?

Consider a few possibilities:

1) The IP address has been recycled and is no longer being used by Sun MicroSystems
2) Could very well be a compromised machine of a Sun MicroSystems employee (like the 43 companies that were recently had employees computers compromised such as Google, Adobe, Microsoft, Yahoo, etc)
3) Could very well be a Sun MicroSystem employee trolling/flaming forums from their work computer. While not a traditional "bot" activity, many admins still consider this "pollution" of their forums and as such will report it.

That being said, you're correct that until the "reputation" system is in place and refined, there is a chance that someone could enter a valid IP address into the database intentionally or accidentally. There are, however, things you can do as an admin to reduce the impact of such a thing:

1) make use of the additional details available from the API such as "last seen" and "frequency reported". Unless someone is maliciously targeting a specific IP, the likelihood of multiple entries in a short period of time are fairly low.
2) set your configuration to not "block" registration but rather quarantine the "suspect" users (ie. those with matching info) to more restrictive VB usergroups and either have their posts content validated by something like AkiSmet (automated) or moderated (manually) and then make use of promotion rules within vB to automate their transition to non-quarantined. Even without fear of "data pollution" this is a sound strategy that I employ on my sites.

Installed. Good to see a coder like you Pedigree actively involved in this thread and product. As a new forum owner, I'm hoping this thing helps a LOT! :-)

-Tom

No, it was non of those scenarios.

I spoke directly to the Sun employee, who is very professional and very intelligent. They were actually kind enough to contact us and tell us of the problem.

I have a lot of experience with problems with abuse of user-generated blacklists for anti-spam, etc going back nearly 15 years.

The database used for this mod has serious problems.

I like your strategies above to reduce impact and will consider them before removing this mod, which is causing more problems than benefit as our other anti-spam plugins that do not use the Stop Forum Spam database are "pretty good" and do not lock out perfectly good registrations!

PS: There is no way we will spend time reporting problems to the Stop Forum Spam admins. This would take more time that deleting spammers!! The admins of Stop Forum Spam should validate better. Their system is really bad and does block good people consistently, we have seen this.

In addition, anyone can report an IP address and use this malicious to hurt others. It is unfair to put the validation on the end user or forums who have problems. The db should have a better validation algorithm, period!

You dont have to disable IP checking, you can drop its threshold to 5 days or something like that.

How about posting the IP numbers youre seeing as polluted so that I can check them out.

Like paying someone to manually validate every entry? Right... we barely break into double digits each month in donations....

If someone finds their IP number on the database, they can remove it themselves.

So far, Ive seen no one come and say "this IP is listed and shouldnt be, its Sun" - give me the IP and I can look into it but anything past that and I dont have the time to start scanning CIDR networks for something that might not even be there. You had the time to contact Sun but not stopforumspam?

I am in the process of coding a reputation system for inclusion in the results but as I code the website in my spare time, its slow progress.

You are entitled to your opinion. I am entitled to mine. You are not going to change
mine by arguing with me or acting as if you know more than people you disagree with. All you are going to accomplish is to alienate me because you disagree. So be it.

I don't like your combative tone. You can't accept a different view because you are so attached to your work. You act like it is perfectly acceptable for a professional at Sun to be locked out frustrated and that he must spend time to contact a crappy database because the database is so polluted. Nonsense, IMHO. You are free to have a less respectful opinion about your potential forum members :)

The only reason our admins (including me) got involved was because the user was kind enough to contact us (very unhappy and frustrated three times) and ask....

Why Is Your Site Blocking Us???

We apologized and disabled IP checking. I doubt we will turn it on again, and may consider de-installing the mod.

False positive blocks are not acceptable to us.

The Stop Forum Spam db is polluted.

That IP address 192.18.8.1 is in the StopForum database only once so a frequency filter would have prevented this from registering for site admins that are more sensitive to the risk of a "false positive"

That being said, a quick Google search on 192.18.8.1 makes it very clear that IP address, while it may be registered to Sun MicroSystems, is not being used just for business purposes. Given the multiple users that appear to be posting from that IP address to various social forums, my guess was that it is a Proxy server or shell server.

Then I started looking into some of the posts:

Luzhou Guestbook Spam

Korean University Forum Spam

Thailand Message Board Spam

Shopping Site Feedback Spam

...and the list goes on for pages.

And in case you're wondering *why* or *how* this could be happening to an IP address that is registered by Sun MicroSystems and whose employees confirm this?

That is because this is a shell server that was compromised in November 2009 and access to various "Premium Accounts" on it are being sold online to spammers, including the root account.

http://www.neararsan.org/karisik-pre...-t266276.html?

This took roughly 2 minutes of investigation to find this using just Google

As I said in previous posts, there is a chance that someone maliciously or accidentally enters a legitimate IP address. There are existing tools to help reduce the risk of false positive on an Admin as well as more long term things such as the reputation system that Pedigree eluded to.

That being said, it is a community of Admins. It is give and take. For the thousands of spammers that don't make it on your site (and the time you save not having to clean up their mess) we ask that you add spammers that do make it back to the database. While there are other sources of the data (honeypots, etc) If Admins deinstalled the mod every time a spammer wasn't in the database the service would shut down and the spammers will have won (oh the humanity!).

The same is true for invalid IP addresses in the database (should there be any). If an admin identifies an erroneous IP, the hope is that they should report it back to Stop Forum Spam to help clean the database up for everyone. While we're working to make that an easier process (and automated validation, etc), again the time you save NOT having to clean up thousands of spammers should more than make up for the time it takes to report a false positive.

Do us both a favor, stop using the database and uninstall the mod because I certainly have better things to do that listen to you rant in whatever thread you decide to post in and I certainly dont have time to drop whatever Im doing to help fix your problem.

That IP looks like a real false positive, I mean, there is no way that a IP allocated to Sun could ever spam right? All those people that reported that box mustve been reporting it as part of some vindictive plan to undermine Sun.

I dont like your attitude, the way that you complain in most threads and the way that you think the world owes you attention. I hope you uninstall my mod and never visit this thread again. Im sure Im not the only one that would be happier not to see you around as well. Mod of the month, 2000+ installs, and Im sure that there are a lot of happy people, some that have PMed me asking (nicely) for help, whom Ive spent hours with. You however are better off without the support of the community that attempts to help others.

Next time, i suggest typing an IP into google. I mean, with your "15 years of anti-spam" experience.... I hope you dont charge by the hour...

and



Im going to quote this, for future reference, should imported_silkroad decide to edit his post... =

Pedigree, you can't win against these so-called "experts." Just because someone works at Sun doesn't make him some sort of god. The Sun IP address is being used for nefarious purposes and your plugin did EXACTLY WHAT IT'S SUPPOSED TO DO. This isn't a question of a different view, as Silkroad states... The facts speak for themselves.

You can only hold your hand out to offer help so many times before something with rabies goes in for a bite. Ive had to deal with many so called "self appointed experts" before in my full time job. Having to endure someone from IBM, charging $1700 a day, coming in to provide vendor support for IBM websphere and having to show them how to do things. They are everywhere

http://www.googleisyourfriend.net/

You and Pedigree, et al are being childish.

We talked to the person directly and they are definitely a legitimate Sun employee.

Pedigree can "Google for two minutes" all day long and still not be accurate.

StopForumSpam blocks perfectly good people from registering.

Why do you argue that point like a child with Google in your hand?

Why should I edit the post?

Your product blocks professionals at Sun.

Your "two minute Google analysis" proves nothing.

We spoke directly to the Sun Employee and he is not a spammer and your software blocked him.

Why argue this point?