Troublesome user
 

I've got a user who continually disrupts the forum, if I ban him he just registers a new account, new email, and new IP address, I have a feeling he is also using an IP mask, is there a MOD out there that can stop him ?

You can block proxies from registering, you can also block host names.

If he's got something unique and goofy in his user agent string, you can block that.

The mods for the above:

https://vborg.vbsupport.ru/showthread.php?t=264932

https://vborg.vbsupport.ru/showthread.php?t=242357

https://vborg.vbsupport.ru/showthread.php?t=279110

If someone is truly determined and persistent, there's really no stopping them other than moderating all new users, or shutting registration off completely. Those are likely what he wants to see.

You just gotta outlast him, put up some of these roadblocks I've listed, and keep vigilant. he'll get bored finally and go away.

Also - once you've identified him you can put him in Tachy - he will be the only one who can see his posts. Let him waste his time posting away...

<a href="https://vborg.vbsupport.ru/showthread.php?t=299546" target="_blank">https://vborg.vbsupport.ru/showthread.php?t=299546</a>

I've installed that, but he isn't using known proxies, at the present count he's logged in from 42 ISP addresses

Instead of banning them and playing cat and mouse, how about letting them register, grab their IP address, and redirect them (.htaccess) to a 404 page or some other screen shot you have, etc. that leads them to believe that the site is down, or has been hacked? Maybe they won't bother for a while...

Until he just changes IP addresses and sees the site isn't down. Same exact issue with tachy goes to Coventry too, if he logs out he won't be able to see his own posts and will know something is up.

Give us his User Agent String you get from online.php, set it to show user agents and copy.

My advice? let him join, welcome him as a user then add the mod "miserable user" and add him to it, he'll always be able to see and use the forum except it will be painfully slow, if he re-registers simply add his userid/username to miserable user eventually he will get fed up.

Again, that one only works when he is logged in. One could also add the IP address as well to MU, but as the OP said he changes them often.

If you make the settings subtle on that however it might be some time before he begins to suspect there's a problem.

Thanks for these, I've installed the lot !

--------------- Added [DATE]1384972266[/DATE] at [TIME]1384972266[/TIME] ---------------

Can you explain this bit a bit better ?

When you know he is on and logged in, go to "Who's Online" and find him there, then set your "User Agent" option at the bottom for "Yes" then click "Display" and it will show his IP address, plus his user agent string. This will include his operating system, browser, and other identifiers. Typical one might look like this:

117.26.112.70
Mozilla/5.0 (Windows NT 5.1; rv:23.0) Gecko/20100101 Firefox/23.0

One word of advice when doing that is if he DOESNT have a unique section in his user agent then enter the entire string, he may be using proxies, changing ip's...etc but computers always have identifying user agent strings.

Even entering his entire string may inadvertently ban legitimate users, if you find this to be the case send me a pm and i'll customise your installation as best I can to give you other options so this doesn't happen.

UDAMAN Simon. I seriously doubt he is hitting the OP's board with more than two devices.

And as a non-technical addition to the above info, be more persistent than him. Disruptive users fall into the same classes as bullies. They persist because they know they know it gets to you, and the results entertain them. Show them that they're putting in more effort at being a nuisance than you are at stopping them. When they realize they're nothing to you, they'll loose interest, stop having fun anymore and go away.

DON'T use the useragent to ban someone unless you really know what you're doing.

If you ban someone with this useragent..
Mozilla/5.0 (Windows NT 5.1; rv:23.0) Gecko/20100101 Firefox/23.0

You'll ban EVERYONE that is using Windows XP with Firefox version 23.

That's.... Not exactly for sure 100% verified is it? When using Simon's hack?Yes much better put than i tried to do earlier.

Absolutely 100% for sure using Simon's hack or mine.

Clink this link for what that useragent means.. analyze UA

I know what it means, been a student of UAs for years.. I was asking if, this theory has been actually tested? That's what I meant by verified.

If it is all entered on one line is it not a unique entry to the hack?

EDIT: I re-read your original statement and yes, that is right. For some reason i saw the word "everyone" and the rest didn't register.

Simon did tell him depending on the UA of the perp, others might be blocked too and if so he could help narrow it down some.

ALL of this is why i asked the OP to post for us, the UA string of the perp.

My apologies for misreading your first post.

If the OP installed my mod, this might help..

These words entered into HOSTNAMES (not useragents) will stop quite a few people in their tracks..
server,proxy,localhost,anonymous,vpn,unknown

After that, it's a hunt and shoot to find out the proxies the person is using.

I have a excellent list of bad hostnames for your hack, hawk. I will PM it to anyone who wants it.

Max I would make use of this list. I am also going to install Snogs mod.

I have about 178 hostnames in my list. I'd be curious to see how we match up.

But I also block most, if not all of China.

I have a mod on my forum that tells me the real IP address when members login with a proxy. I can share it if you like...pm me.

I'm sure that only works with public proxies (proxies that identify themselves). There's nothing that can pick up an anonymous proxy.

Ha! That's alot more than mine, and I thought I had a pretty good list.

Let's swap via PM?

Can't someone build one MOD with all of these features.

I too think I have blocked most of China now, and practically all of the Eastern Block too

My mod does both hostnames and useragents. What else is missing?

I wonder if there is a way to find out his password via the db? i would bet its the same across the board for all accounts... then perhaps use that information to send his registration to limbo...

@Hawk Your site looks sharp too by the way.

Thanks! So does yours. But I'd be afraid to post there because I'm far too opinionated. I'd slip up and have homeland security, the CIA and FBI knocking on my door. :D

I never worry about that, if you look in my blacklisted user agents I sent you, the government goons can't view my site!

Thanks for the flowers though, we'd love to have you on - giving it hell.

Thanks Max and nhawk for the pm's and the list. Very much appreciated. Will get everything set up tonight.