LOL, this one was simple.

It's blocked because 'tor' is in the list (monitor5.securi.net). So it did it's job.

In either case, securi.net has no business accessing register.php, so the add-on did it's job.

It didn't ban securi from accessing the site, it just stopped it from registering.

So, re-enable the add-on.

And that is a oversight on my own part, since I compiled most of that list.

I'll be recommending "tor" be removed post haste. I think we have it covered with another definition anyway.

Unfortunately, Sucuri needs to access out site as it's a primary security monitor and does complete server scans every 1/2 hour...

Regards,
Doug

Ok, I removed tor and have saved the mod and restarted it.. :)

Thanks for all the help guys... :up:

Regards,
Doug

It can access the site. The add-on doesn't stop that. It just threw an error to it saying it can't register.

Once again... It does not and should not be trying to register. That is not part of its normal behavior.

Roger that ... :up:

Thanks again... :)

Regards,
Doug

I prefer to keep logs, but a log with dozens of PMS a day is unmanageable. See ask the recent posts above for an example of why you'd would to keep a record so that you can search if later (sucuri being blocked).

Securi was not blocked from the site. Nobody is blocked from the site with this mod. Securi was blocked from registering. There's a big difference.

https://vborg.vbsupport.ru/showpost....7&postcount=86

Ok just a follow up on the Sucuri situation.

Sucuri will scan your site with several different user-agents (including the one you mentioned).
During this scan, the bot will crawl through all links found in the site, and looks like it's hitting the registration link.

Sucuri will not follow the robots.txt directives. Since it tries to behave as a "real user" it'll ignore that file. The only way to do it would be creating a .htaccess file to redirect SiteCheck to a 404 or a different page when hitting those forms.

So you can add tor back to the list if you wish, and add this to your htaccess file.

That will stop Sucuri from hitting the registration trigger, and it is what they recommended to me. :)

I am still curious what difference it makes if Securi is sent to the error page when it hits register.php or not?

It seems Securi is scanning pages for malware and the error page shouldn't have any malware.

Or, does Securi know exactly what register.php is suppose to contain and they throw an error on their end if it contains anything else?

I believe they just check it for malware.

Hey Snog... Any plans to make the filter list one per line, so it has to be exact match to get caught? Example - just had a spammer register from "Biznet" but adding this to the filter is going to catch everything that has 'biz' or 'net' in the name.

Yeah that would be a optimal way to do it. :)

No it won't. It will catch BIZNET.

The entire word has to be matched. The word isn't broken down into smaller sections for detection. So bizmarknet would NOT be caught. But badbiznet would.

How then did we catch "monitor5.securi.net" using the word 'tor' in the filter?

The plain word 'tor' was in the list. That matched the tor in "monitor5.securi.net"

See the difference..

BIZNET

bizmarknet would NOT be caught.

but somethingbiznetelse would be.

Okay... Yep I get it.

With "Ban Spiders by User Agent" we don't get such matches, I assume because the definitions are line by line instead of separated by commas?

Well, no it's more because of the way they check for matches. I look for it in any part of the host name or user agent. They match the exact item.

I've found that doing it the way I do gives better protection overall. Mainly because if you decide you don't want any servers registering you just have to enter 'server'. That kills a good number of bots right off the bat. Another example would be rackcentre. Anything with that in the host name is a server. Listing each server from rackcentre would be a list 10 miles long. So with the way I do it, just entering it once kills them all.

Let me ask you this, can it be made to have each one on it's own line without a performance issue? It would be much easier to maintain the list that way.

It could be done. But to keep it simple, I would also have to retain the csv format to account for old installations.

I'll put it on the wish list for the mod.

Cool, I would really like to see that. ;)

Actually, we do.

I had problem with banning string MSIE 1, with which I tried to block old MSIE 1 users. But, today there are MSIE 10 and MSIE 11, both browsers also were blocked, as they contain "MSIE 1" in their UA. As I remember, to block only MSIE 1 we should use this string: MSIE 1. (dot at the end), as it is identified with MSIE 1.0.

I wrote about it Ban Spiders thread.

We need to be very careful what string we block, unless we get blocking innocent users.

Yeah it is best to be cautious when adding things to these types of mods. :)

Right, I remember that well. I merely stopped worrying about IE 1 since the likelihood of any device using that, still surviving seems very low.

So how do i collect hostnames and useragents to ban? I saw post 29 but being a newbie it means nothing to me.

Lets start with an example. I just had a spammer try to register. Their IP is 137.175.68.84 and looking at stopforumspam confirms there is a lot of spamming going on from this IP.

What would be my next step (in newbie talk)? When i tried to do a hostname search using whatismyip.com, it just threw up the IP address i just posted.

If you don't understand what's in post 29, it really can't be explained in any simpler terms.

Look up the IP at ARIN as described in post 29.

In the case of that IP, you would want to ban 199-180-100-0-1

Got it

This great mod should be a built-in vb as a security and protection tool ...

Installed on VB4.2.2 PL2

You will find this is a invaluable tool on your site. :)

Quick question: If netzip is entered as a useragent to be blocked, will that also block NetZIP and NetZip?(i.e. Are the useragent names case sensitive in order to work for all occurrences?)

Also, what about Mata Hari vs. Mata.Hari ? If only Mata Hari is entered as the useragent, will that catch Mata.Hari as well?

Useragents are not case sensitive.

Mata Hari will only catch Mata Hari, not Mata.Hari.

Hi guys,
too me I have the same problem? What I can do to fix it.
I have installed the 3.0.1 version of the mod.

You should not be having the same problem with version 1.0.3.

But try putting something in both the Useragent field and the Hostname field to see if your problem stops.

Hi Nhawk and thanks for your reply.
In the Hostname box is just full of host names.
The Useragent box is empy. What I can add?
Have you a list of useragents please?

Just add the word proxy

Inside the Mod?
Is a new release?

I don't understand what you're asking now.

You asked what to add to the Useragent box and I answered that.

Ahhh sorry...
I thought you have added something in the mod. sorry... :)

I go to try.