vb.org Archive - SpamBuster v1.0.0 (Stable): Identify, log and remove spam posts on your forum

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vBulletin 3.5 Add-ons (https://vborg.vbsupport.ru/forumdisplay.php?f=113)

- - SpamBuster v1.0.0 (Stable): Identify, log and remove spam posts on your forum (https://vborg.vbsupport.ru/showthread.php?t=109258)

Just updated the new rules :)

Quote:

Originally Posted by contactsonia

Just updated the new rules :)

Cool - if anyone wants to post up rules they're using onto this thread then please do.

You know the best thing for me? I stop all users from posting a URL in their first 5 posts. Kills 99% of spam.

regexp:a_url:10:any:"/http/i"
regexp:a_www_url:10:any:"/www/i"

obviously a threshold of 10 - so anyone who posts any kind of URL will need to be moderated - if they have less then 5 posts.

Jimbo - I am not very good at figuring out the templates. How can I add the name of the poster to the spam report? I have spam reports posted to a special forum. I would like to have their name available (in the title?) so I can scan the title and see the real problem posters.

Is that possible?

Quote:

Originally Posted by ScubaAddict

You know the best thing for me? I stop all users from posting a URL in their first 5 posts. Kills 99% of spam.

regexp:a_url:10:any:"/http/i"
regexp:a_www_url:10:any:"/www/i"

I'd err on the side of caution and use something like

regexp:a_url:10:any:"/http:\/\//i"
regexp:a_www_url:10:any:"/www\./i"

Quote:

Originally Posted by ScubaAddict

Jimbo - I am not very good at figuring out the templates. How can I add the name of the poster to the spam report? I have spam reports posted to a special forum. I would like to have their name available (in the title?) so I can scan the title and see the real problem posters.

Is that possible?

${spam_user} is the name of the posting user. The user's name is already in the report as part of the quote tag.

Quote:

Originally Posted by UK Jimbo

Gio - it looks like the links have been removed from all the posts on that forum so I can't suggest rules. Generally excluding by URL is the way to go.

Hmm. Okay. When I do indeedget more spamvertiser, I'll preserve the links to help with the rules.

Great plug-in, and we've just recently installed and began using it on our system. Still tweaking the rule-set, but so far it's been great.

I have run into the admincp/modcp issue as well, since as far as I can tell the postdata_presave hook is also called when moderating posts. I haven't been getting any errors, but the admincp/modcp page doesn't refresh at all after validating posts (I get a blank page), and the whole process basically just fails.

In my case, I had to add the following snippet, modified from an earlier post in this thread:

Code:

if (function_exists('sbhits') == true) {

                $GLOBALS['sbhits'] = sb_test($this);

        }

The $GLOBALS['sbhits'] = array() portion in the else construct didn't actually work, so I trimmed it down to what you see above, and that appears to have restored modcp/admincp functionality for me.

I've also made a small addition in my system that I thought I'd share... Generally, spammers on our forum get banned pretty quickly, but obvioiusly I don't want that to be an automated process until an Admin or Senior Moderator has had a chance to review the situation. So what I did was a template modification to add a link to the banning portion of the modcp. Basically, a "Click Here to Ban or Suspend This User" link.

The following specific modifications were made in SpamBuster Libraries under the global_start plug-in hook:

In variable definitions:

Code:

   // added 21 Jun 06 by JDH to fetch userid for banning link

    $spam_userid = $post->registry->userinfo['userid'];

In body of message section:

Code:

[URL=http://forums.ilounge.com/modcp/banning.php?do=banuser&u=${spam_userid}]Click here to Ban or Suspend this user[/URL]

The only other issue that I've run into is the way that posts are dropped into the moderation queue after an edit of an existing post when it's the first post in the thread.

Normally, if a user posts a new thread which is tagged as spam, the entire thread is set to require moderation. However, if the user posts a valid thread, and then goes back and edits their first post, then only the post is sent to the moderation queue.

This creates a situation where normal users see a dangling thread header with no posts. Further, the in-line moderation tools don't work for approving the post, because they're looking to approve the thread. I think the post can still be approved from the ModCP, but ultimately it creates an odd situation.

Granted, this shouldn't occur too often, but it would be nice to add a check to the code following an edit to determine if the post being edited is the first in it's thread, in which case the thread should probably be set to "moderated."

I'm going to poke a bit at the code myself to see if I can't make this work, although it's not a huge priority. If I do solve it, however, I'll post my results here.

Thanks again for a great mod otherwise, though.

Thanks for the detailed feedback and suggestions. I'll factor these in for the next release.

Any update of this for 3.6.0?

I don't have a 3.6 install to test it on at the moment. If anyone would like to verify if it works or otherwise that would be great.

Thanks :)

It appears to be working in 3.6.0...though I haven't had any real-world tests (actual spammers) hit it yet.

It did catch my test posts (both new posts and replies).

If it does anything odd, I'll be sure to let you know.

Here are a few rules that I have added due to online casino bots adding them to my guest forum. I have applied them, but they don't seem to be working. Do I have to restart the plugin ever time I update the rules? Maybe I'm doing something wrong?

Code:

regexp:t_cardstud:10:title:"/online seven card stud/i"

regexp:t_888casino:10:title:"/888 Casino/i"

regexp:t_freeslots:10:title:"/free slots/i"

regexp:t_onlinepoker:10:title:"/online poker tournament/i"

regexp:t_videopoker:10:title:"/video poker/i"

regexp:t_pokerrooms:10:title:"/online poker rooms/i"

regexp:t_freeslots:10:title:"/free slots/i"

regexp:t_baccarat:10:title:"/baccarat/i"

regexp:t_online7:5:title:"/online seven card stud/i"

regexp:t_roulette:10:title:"/roulette/i"

regexp:a_888:10:any:"/888\.com/i"

regexp:a_ajcarvelli:10:any:"/ajcarvelli\.com/i"

regexp:a_7cardstud:10:any:"/seven card stud/i"

regexp:a_stud:5:any:"/stud/i"

regexp:a_baccarat:5:any:"/baccarat/i"

regexp:a_casino:5:any:"/casino/i"

regexp:a_online:5:any:"/online/i"

regexp:a_free:5:any:"/free/i"

regexp:a_slots:5:any:"/slots/i"

regexp:a_keno:5:any:"/keno/i"

-parabat

Brilliant parabat, thanks for that. I hope others will share their rules too.

How did you test these rules? The best way is to set up a new test users with 0 posts then try posting using that account.

Quote:

Originally Posted by UK Jimbo

Thanx Jimbo
Most of the spam I get is in the public guest book forum. So unregistered users can post comments and that is usually how the bots add to the site. With all these rules in place I'm still getting them onthe site. Not sure why. Do I have to specify a spamuser in the admincp?

-parabat

Jimbo:

A really nice feature would be if it would not allow the message to be posted at all for certain rules.

I'm getting lots of pharmaspam lately - the messages are getting moderated, but I still have to go clean them up. It would be great if I could keep them from even being posted at all if they trigger the spam rules.

Got the same error as

Code:

Fatal error: Call to undefined function: sb_test() in /****/****/public_html/forums/includes/class_dm_threadpost.php(728) : eval()'d code on line 1

Quote:

Originally Posted by UK Jimbo

Are you sure the global_start plugin was enabled?

After the install, I don't see any plugin called "global_start. Can you verify this for me please.

-parabat

Does this work under 3.6?

Great Mod, thanks

The answer may be here already, but I'm pretty new to this and not seeing it. I want to add rules to my board but I can't figure out if there is a wildcard
or not I want to add a rule for sex that will be triggered as well by sex! sexy
sexual bisexual. You get the idea, how do I do that ?

Thanks

Great mod, I hope you keep up with it and keep updating it for new versions. I'm running 3.55 right now and it works just fine.

I'll be upgrading to 3.6 soon.

I received the same error as above today

Fatal error: Call to undefined function: sb_test()

However that was when I attempted to approve the post from the moderator control panel.

I was able to approve the post right from the thread though. I'm quite happy doing it that way.

Quote:

Originally Posted by parabat

Got the same error as

Code:

Fatal error: Call to undefined function: sb_test() in /****/****/public_html/forums/includes/class_dm_threadpost.php(728) : eval()'d code on line 1

Hi All. Seems like after I reinstalled the product this error dissappeared. It's working like a dream now.
Saved my hind.

Thanx :D

Is there any sort of manual that tells us how to use this thing and set up the rules? The lack of documentation is killing me here.

David.

Quote:

Originally Posted by parabat

Hi All. Seems like after I reinstalled the product this error dissappeared. It's working like a dream now.
Saved my hind.

Thanx :D

I've installed three times. No change. I get the error when moderating from the modcp. Never an error when doing inline moderation.

Steve

Ive now installed and tested on our 3.6.0 forum. Works like a charm for now. An important thing you cant remember is to make that new test user with a 0-9 postcount and test.

One issue that this misses is with users posting links like below

Code:

blah

Quote:

Originally Posted by Sownman

I've installed three times. No change. I get the error when moderating from the modcp. Never an error when doing inline moderation.

Steve

Hi Sownman

The way I got this resolved was to uninstall the product, then I enabled moderation, then installed the product again. This resolved that error a I had moderation disabled previously and only turned it on once I had installed the product. Not sure if you had the same thing.

-Parabat

Code:

#Phones

regexp:a_sidekick:3:any:"/sidekick/i"

regexp:a_nokia:3:any:"/nokia/i"

regexp:a_ericsson:3:any:"/ericsson/i"

regexp:a_motorola:3:any:"/motorola/i"

regexp:a_nextel:3:any:"/nextel/i"

regexp:a_kyocera:3:any:"/kyocera/i"





#computers

regexp:a_dell:3:any:"/dell/i"

regexp:a_alienware:3:any:"/alienware/i"

regexp:a_apple:3:any:"/apple/i"

regexp:a_ipod:3:any:"/ipod/i"

regexp:a_toshiba:3:any:"/toshiba/i"

regexp:a_vaio:3:any:"/vaio/i"

regexp:a_ibm:3:any:"/ibm/i"

regexp:a_acer:3:any:"/acer/i"





#consoles

regexp:a_xbox:3:any:"/xbox/i"

regexp:a_playstation:3:any:"/playstation/i"

regexp:a_playstation1:3:any:"/play station/i"

Heres a few more that i get at least.

Sorry guys, I've been pretty tied up (not literally!) with my personal life for the last couple of months. I hope that I can get back to this project in the next few weeks and have a good v3.6 release with some new features.

Does this work on existing posts?

or only new posts since install?

if not, is there a way to get it to process all posts?

Quote:

Originally Posted by GlobalFusion

Does this work on existing posts?

or only new posts since install?

if not, is there a way to get it to process all posts?

It's only triggered by a user making the post. It'd require a big rewrite to make it work with old posts.

I must say this hack is great, works perfectly. Found a couple of spammers already. One thing is there anyway to not do certain forums. I have a few moderator forums that would be impossible for it post spam in. I want to be able to just to soft delete the spam posts and not have to worry about it deleting the posts in the restricted areas.

Also antoher thing that needs to be updated is the new post when making a new thread to report. I have it setup so it posts a thread in a spam report forum but i cant tell if there has been spam reported unless i go into there. Could you also update the dateline and lastposter and all that as well. I could probably modify myself and just give you the code too, which is what i will probably do once i get time.

Quote:

Originally Posted by Kungfu

I understand what you mean but in practise the regexp tests will only be carried out for users with a post count of > the defined threshold. There's a marginal amount of CPU involved doing that single test on their postcount.

Quote:

Originally Posted by Kungfu

Also antoher thing that needs to be updated is the new post when making a new thread to report. I have it setup so it posts a thread in a spam report forum but i cant tell if there has been spam reported unless i go into there. Could you also update the dateline and lastposter and all that as well. I could probably modify myself and just give you the code too, which is what i will probably do once i get time.

That would definitely be nice to have. If you get round to writing the code then please let me know, if not it's something I'll end up writing myself.

Will this work on 3.6?

Added a few rules:

Code:

#pills

regexp:a_meds:10:any:"/meds/i"

regexp:a_pharmacy:10:any:"/pharmacy/i"

regexp:a_clickhere:5:any:"/click here/i"

Just had a porn spammmer that got caught. The curious thing was that spambuster didn't count the links in the post although there were 3 images linked to urls & 2 text link urls in their post. But here's all it caught:

Quote:

Rules matched: t_free=5,a_free=5
Total score: 10

Any guess on why it didn't count the urls? I confirmed that the url check is still installed. My full rule list:

Code:

## SpamBuster config file

# tests are in the format:

# type:name:score:section:expression



## Title tests

# title starts with free

regexp:t_free:5:title:"/^free/i"

# title starts with free and ends in an exclaimation mark

regexp:t_freebang:5:title:"/^free.*!$/i"

# title ends with three exclamation marks

regexp:t_3bangs:5:title:"/.*!!!$/i"



## Tests title and body

# contains a price in dollars

regexp:a_dollar:5:any:"/\$[\d\.]+/"

# lists a % discount offer

regexp:a_percent:5:any:"/\d+%/i"

# contains a URL

regexp:a_url:3:any:"/http:\/\//"

# contins the word free anywhere

# regexp:a_free:5:any:"/free/i"

# contins the word fedex anywhere

regexp:a_fedex:5:any:"/fedex/i"



## Known spam sites

regexp:a_dotdeals:10:any:"/dotdeals\.com/i"

regexp:a_ekmas:10:any:"/ekmas\.com/i"

regexp:a_qckjmp:10:any:"/c\.qckjmp\.com/i"

regexp:a_websponsors:10:any:"/\.websponsors\.com/i"

regexp:a_wonderyears:10:any:"/\.wonderyears\.com/i"

regexp:a_lynxtrack:10:any:"/\.lynxtrack\.com/i"

regexp:a_getodp:10:any:"/\.getodp\.com/i"

regexp:a_actualdeals:10:any:"/\.actualdeals\.com/i"

regexp:a_pdv001:10:any:"/\.pdv001\.com/i"

regexp:a_eajmp:10:any:"/\.eajmp\.com/i"

regexp:a_aftrk.com:10:any:"/\.aftrk\.com/i"

regexp:a_lps999.com:10:any:"/\.lps999\.com/i"

regexp:a_e2save.com:10:any:"/\.e2save\.com/i"

regexp:a_qksrv.net:10:any:"/\.qksrv\.net/i"

regexp:a_dse500.com:10:any:"/\.dse500\.com/i"

regexp:a_bag1881.com:10:any:"/\.bag1881\.com/i"

regexp:a_esrmtech.com:10:any:"/\.esrmtech\.com/i"

regexp:a_jokescratchcards:10:any:"/jokescratchcards/i"

regexp:a_83332:10:any:"/83332/i"

regexp:a_eaziit:10:any:"/eazi\.it/i"

regexp:a_bravehost:10:any:"/bravehost\.com/i"

regexp:a_dailyunique:10:any:"/dailyunique\.com/i"

regexp:a_en+++++:10:any:"/en+++++\.com/i"

regexp:a_putzamare2004:10:any:"/putzamare2004/i"

regexp:a_cpsasales:10:any:"/cpsasales\.co\.uk/i"

regexp:a_madhouse21:10:any:"/madhouse21/i"

regexp:a_raelian:10:any:"/rael\.org/i"

regexp:a_speedflip:10:any:"/speedflip\.com/i"

regexp:a_fredphones:10:any:"/fredphones/i"

regexp:a_watchgem:10:any:"/watchgem\.com/i"

regexp:a_250free:10:any:"/250free\.com/i"

regexp:a_bagluxury:10:any:"/bagluxury\.com/i"

regexp:a_greatnow:10:any:"/greatnow\.com/i"

regexp:a_ampd:10:any:"/ampd\.com/i"

regexp:a_remster5:10:any:"/remster5/i"

regexp:a_tipcell:10:any:"/tipcell\.com/i"

regexp:a_hotxxxstuff:10:any:"/hotxxxstuff\.com/i"

regexp:a_pochrist:10:any:"/thepassionofthechrist/i"

regexp:t_feelsad:10:title:"/This picture may make some of you feel sad/i"

regexp:a_winme:10:any:"/win-me\.biz/i"

regexp:a_pharmacy1010:10:any:"/pharmacy1010\.com/i"

regexp:a_picfury:10:any:"/picfury\.com/i"

regexp:a_mightybody:10:any:"/mightybody\.com/i"

regexp:a_winantispyware:10:any:"/winantispyware\.com/i"

regexp:a_systemdoctor:10:any:"/systemdoctor\.com/i"

regexp:a_rogalik:10:any:"/rogalik\.net/i"

regexp:a_aapurse:10:any:"/aapurse\.com/i"

regexp:a_freepay:10:any:"/freepay\.com/i"



##Casino

regexp:t_cardstud:10:title:"/online seven card stud/i"

regexp:t_888casino:10:title:"/888 Casino/i"

regexp:t_freeslots:10:title:"/free slots/i"

regexp:t_onlinepoker:10:title:"/online poker tournament/i"

regexp:t_videopoker:10:title:"/video poker/i"

regexp:t_pokerrooms:10:title:"/online poker rooms/i"

regexp:t_freeslots:10:title:"/free slots/i"

regexp:t_baccarat:10:title:"/baccarat/i"

regexp:t_online7:5:title:"/online seven card stud/i"

regexp:t_roulette:10:title:"/roulette/i"

regexp:a_888:10:any:"/888\.com/i"

regexp:a_ajcarvelli:10:any:"/ajcarvelli\.com/i"

regexp:a_7cardstud:10:any:"/seven card stud/i"

regexp:a_stud:5:any:"/stud/i"

regexp:a_baccarat:5:any:"/baccarat/i"

regexp:a_casino:5:any:"/casino/i"

regexp:a_online:5:any:"/online/i"

regexp:a_free:5:any:"/free/i"

regexp:a_slots:5:any:"/slots/i"

regexp:a_keno:5:any:"/keno/i"



#Phones

regexp:a_sidekick:3:any:"/sidekick/i"

regexp:a_nokia:3:any:"/nokia/i"

regexp:a_ericsson:3:any:"/ericsson/i"

regexp:a_motorola:3:any:"/motorola/i"

regexp:a_nextel:3:any:"/nextel/i"

regexp:a_kyocera:3:any:"/kyocera/i"



#computers

regexp:a_dell:3:any:"/dell/i"

regexp:a_alienware:3:any:"/alienware/i"

regexp:a_apple:3:any:"/apple/i"

regexp:a_ipod:3:any:"/ipod/i"

regexp:a_toshiba:3:any:"/toshiba/i"

regexp:a_vaio:3:any:"/vaio/i"

regexp:a_ibm:3:any:"/ibm/i"

regexp:a_acer:3:any:"/acer/i"



#consoles

regexp:a_xbox:3:any:"/xbox/i"

regexp:a_playstation:3:any:"/playstation/i"

regexp:a_playstation1:3:any:"/play station/i"



#pills

regexp:a_meds:10:any:"/meds/i"

regexp:a_pharmacy:10:any:"/pharmacy/i"

regexp:a_clickhere:5:any:"/click here/i"

Thanks for the nice mod, Ross

Awesome mod. Thanks.

I'm running 3.6.0 and it does not work. Fails with the error others have posted:

Code:

Fatal error: Call to undefined function: sb_test() in /home/morcmtb/public_html/forums/includes/class_dm_threadpost.php(1549) : eval()'d code on line 2

This happens immediately when I try post a message using a test user.

This would be really nice if someone could find out why this happens.

So far all I have seen are people re-installing it or disabling then re-installing it. That did not work for me. Someone mentioned turning on moderation - not sure what they meant by that, we have some forums that have leaders, some do not - I have 4 users that are moderators in general.

I'd be careful of this until someone confirms why this is happening. UNINSTALLING

This looks really interesting .. Has anyone had any issues with it deleting legit posts by members?

Quote:

Originally Posted by bada_bing

This looks really interesting .. Has anyone had any issues with it deleting legit posts by members?

it doesnt delete, it puts the post under moderation. Then you can make it post a new post in some forum that way you can check to see oh well this is under moderation. And then accept the post if it should be valid.

This modication is nice, installed on 3.6.1 and working great. Thank you UK Jimbo for this.
I have set spam buster to post a thread upon spam detection, it does post when spam is detected but forum counter not getting updated, may be a bug or something. I understand this is not meant for use on 3.6.1 but it helps me thank you. Any help in this direction would be nice thank you.

Quote:

Originally Posted by Kings

I've fixed the problem myself, by modifying the plugin so that it checks if the function exists, for example:

Code:

<phpcode><![CDATA[

    if (function_exists('sbhits') == true) {

        $GLOBALS['sbhits'] = sb_test($this);

    } else {

        $GLOBALS['sbhits'] = array();

    }                

]]></phpcode>

The plugin still seems to work, and I can use my moderation tools again. Hope this helps.

Where exactly did you put this bit of code? I still have the sb_test error and really want to use this hack.

It seems that something has been missed in this hack to watch for potential conflicts or other...?

how do you search for something but have an exception.

I want to be able to search for urls but exclude the urls within the forums.

Example:

It finds www.somespamsite.com and because it has www. it marks it as spam.

But how can you change it so if say someone does www.yourforumaddress.com/thread.... so if it has yourforumaddress in there it will just ignore it.

Phrase Groups Available:

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01447 seconds Memory Usage 1,870KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (12)bbcode_code_printable (15)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (3)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (40)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: