Administrative and Maintenance Tools - Multiple Account Detection & Prevention

It happens all of the time. Some members will make multiple accounts to back their own opinion or get an extra vote in a poll. Here's a modification that will detect and prevent multiple accounts, as well as notify the administration about multiple accounts. Inspiration for this modification came from the work of MPDev (creator of the Multiple Account Login Detector) and randominity (creator of the Multiple Account Registration Prevention). This is basically a combination of those two modifications but with new and improved functionality.

This is not an update to the "Multiple Account Login Detector (AE Detector)" nor is it an update to the "Multiple Account Registration Prevention." If you have either one of these (or both of them) installed, you should uninstall them before installing this modification.

With the initial release of Multiple Account Detection & Prevention, I believe that I have fixed previous bugs/complications as well as improved the efficiency and logic of the code. This is my first publicly released modification. I would appreciate any comments and suggestions!

Confirmed! This works perfectly on all vBulletin 3.6, 3.7, and 3.8 versions.

Unfortunately, I cannot give support right now. I may be able to help periodically, but until my schedule yields some more free time, I won't be much support. Please check back in a week or two.

Basic Details
File Edits: None
Template Edits: None
New Files: 6
Hooks/Plugins: 3
Global Phrases: 36
Install Time: 2 Minutes or Less
Install Difficulty: None, Very Easy

Features and Settings
- Login Detection
- Registration Prevention (Multiple Methods)
- Ignore Child Accounts
- Ignored Users
- Ignored Usergroups
- Ignored ISPs
- Prevention Usergroup
- IP Address Based Prevention
- Extended IP Address Prevention
- IP Address Time Inclusion
- Banned Account Check
- Primary Banned Usergroup
- Cookie Expiration Time
- Cookie Refreshing
- Cookie Name
- Cookie Reset
- Multiple Account Reporter
- Reports via PM
- PM Report Recipients
- Reports via New Thread
- Forum for Report Threads
- Verbose Mode
- BB Codes: LIST, URL, CODE

How it Works
With every newly recognized login/registration, an account-counting cookie is set (or added onto) with the member's User ID. Depending on the settings, Multiple Account Detection & Prevention will analyze the cookie during login/registration to see if there are any multiple accounts.

Login Detection offers cookie-checking and reporting. Registration Prevention offers the same thing, plus more advanced features. First of all, when it prevents an account from registering, it actually moves the registrant to the Prevention Usergroup so that the administration can review the case. This also allows for customized privileges for recognized multiple registrants. Registration Prevention also has IP address detection which finds out just as much information about users. Depending on an administrator's preference, this modification can also reban a new registrant if one of their previous accounts has been banned. In fact, if the administration wishes, multiple registrants can simply be denied registration all together.

Whenever there is a detection/prevention, the modification will report the information to the administration through private messages, a new thread, or both (depending on settings). The Multiple Account Reporter can be any valid user.

Known Issues
- vB Optimise users: Reporting via thread seems to get messed up by vB Optimise, so try reporting via PM instead.
- PhotoPost vBGallery users: The registration handling appears to not work properly when PhotoPost vBGallery is enabled.

From what I can tell, these known clashes have been caused by the other modification's coding. The author of vB Optimise will not even work with me to fix it. Until they improve their coding, I'm not sure if I can do anything about these issues. As far as I know, administrators that do not use the above modifications will not have any problems.

Installation / Upgrade
Unzip the package (madp.zip), upload the files to your forum location, and import the product file (allow overwrite if upgrading). Please read the ReadMe.txt file that is packaged with the modification for more information.

Please remember to mark this modification as installed if you use it!
If you like it, nominate it for the Mod of the Month!

Thank you!

[BlueNinjaGo]

You may...

also, i'd recommend setting up everything the way you want it to be (having your user ID ignored, usergroups ignored, and what not) and then having a trusted member create an alt. Don't be specific. Tell him/her to please make a new test account. Then just delete the test account later.

It helps give you a real idea...

Also, with IP address checks, you might need to extend the date it checks... i switched it from 90 to 180 to see and 2 reports popped up...

[Kiros72]

Hmm, I think I see what's going on here. And if it's what I'm thinking, then you won't need a cookie reset.

Since the IP checks only work for the registration prevention, you won't benefit from it while testing logins. But what I think happened may have been caused by the use of different browsers. Each browser has its own cookie-handling system and it's own set of cookies. Now let me explain what probably happened.

If you had your Usergroup or user account added to the ignored list, and you tried to login, then it wouldn't have caught you. It would still set the cookie and make sure that it knows what accounts you have logged into, but again, it would not have thrown a red flag. Even after removing the ignored ID numbers, it would still not have thought anything out of the ordinary because it only reports NEW detections. This is because you wouldn't want to keep on being spammed notifications if someone kept logging in and out throughout one day. So yeah, this is probably what happened. This is also why it worked after you cleared your cookies.

Understand?

[exportforce]

I just did a livetest with a pal.
He registered with the same IP & Browser 2 Accounts.
The 2nd was banned instantly, the first one was not touched.
Can you please make it possible that it will ban BOTH, I am really extremly in need of this.

Also please make the mod report if already banned accounts do a multilogin.
I had someone logged in with shareaccounts which are already banned but I did NOT get a notice about that like AE Detector did.
(he just killed the cookies and that do a lot of ppl do. I need the option)

[Alfa1]

My forum has been without multiple account detection for some months and i would like to detect all members that have created multiple accounts. I understand that this hack only detects multiples in case they try to register. Not in case they already have registered?
Is there anything I can do to get a check of existing members?

[Kiros72]

Originally Posted by exportforce

I just did a livetest with a pal.
He registered with the same IP & Browser 2 Accounts.
The 2nd was banned instantly, the first one was not touched.
Can you please make it possible that it will ban BOTH, I am really extremly in need of this.

Also please make the mod report if already banned accounts do a multilogin.
I had someone logged in with shareaccounts which are already banned but I did NOT get a notice about that like AE Detector did.
(he just killed the cookies and that do a lot of ppl do. I need the option)

The original account isn't touched for safety measures. This is to protect you. Because if you don't have yourself on the ignored list for some reason (like testing something) and you get busted, you wouldn't want to get banned out of your own site... Would you? This is why I made it this way.

This modification should report those who do multiple logins regardless if they are banned or not (as long as it's a NEW detection).

Originally Posted by Alfa1

My forum has been without multiple account detection for some months and i would like to detect all members that have created multiple accounts. I understand that this hack only detects multiples in case they try to register. Not in case they already have registered?
Is there anything I can do to get a check of existing members?

Unfortunately, this would require database work. I'm still in the slow, slow development of a major release, 2.0.0, which will include database features. Until the new version is released, the only suggestion that I can offer is to look through all of your past reports (if you haven't deleted them).

[exportforce]

Originally Posted by Kiros72

The original account isn't touched for safety measures. This is to protect you. Because if you don't have yourself on the ignored list for some reason (like testing something) and you get busted, you wouldn't want to get banned out of your own site... Would you? This is why I made it this way.

This modification should report those who do multiple logins regardless if they are banned or not (as long as it's a NEW detection).

Can you optionally change this?
I am really in extreme need of this, that ALL accounts get instantly banned for multiaccounting, no matter who it will be.

Also I am in need of the notification from AE Detector that already banned accounts did a multiple login. So I can find new multipleaccounts too.

Also it would be very cool if the addon would also instantly send a note if a user accesses a 3rd account and the addon tells me again all 3 accounts, even if he just a minute ago logged in with another. Also it would be great if it would tell me which detection what nick has gotten to be multiple (Cookie, IP, both)

I have a really hard time with multipleaccounts, sometimes ppl with over 8 accounts show up, so just to tell a number.

(No, just preventing to register a new Account is not an option for me, for they just kill the cookies and reconnect if they recognize that)

[kursed]

Originally Posted by Kiros72

it would still not have thought anything out of the ordinary because it only reports NEW detections. This is because you wouldn't want to keep on being spammed notifications if someone kept logging in and out throughout one day. So yeah, this is probably what happened. This is also why it worked after you cleared your cookies.

Understand?

Understood. That I guess was the issue here. Thank you so very much for your help.

[Alfa1]

Originally Posted by Kiros72

Unfortunately, this would require database work. I'm still in the slow, slow development of a major release, 2.0.0, which will include database features. Until the new version is released, the only suggestion that I can offer is to look through all of your past reports (if you haven't deleted them).

I have just recently got this hack to work. Until January i was using the AE detector. The few months without detection seems to have resulted in a lot of returning trolls.

DB features would be great.

Some suggestions:

- After each account:

• Add a link to PM the member. (optimal would be a predefined PM text to be sent)
• Add a link to search the database for all IP's that belong to the account.
• Add a link to add the account to the miserable users group
• Add a link to add the account to 'Tachy goes to Coventry'
• Add a link to ban the member.

- Add a function to ignore the accounts or IPs in the future.
- If an IP is reported, then add the whois.

[Kiros72]

Originally Posted by exportforce

Can you optionally change this?
I am really in extreme need of this, that ALL accounts get instantly banned for multiaccounting, no matter who it will be.

I'll try to include this option in my next version, but understand that this is not a priority of mine. This would be an unsafe feature that could get a lot of people in trouble, so again, it's no priority.

Originally Posted by exportforce

Also I am in need of the notification from AE Detector that already banned accounts did a multiple login. So I can find new multipleaccounts too.

Multiple Account Detection & Prevention already does this.

Originally Posted by exportforce

Also it would be very cool if the addon would also instantly send a note if a user accesses a 3rd account and the addon tells me again all 3 accounts, even if he just a minute ago logged in with another. Also it would be great if it would tell me which detection what nick has gotten to be multiple (Cookie, IP, both)

Multiple Account Detection & Prevention already does this too.

Originally Posted by exportforce

I have a really hard time with multipleaccounts, sometimes ppl with over 8 accounts show up, so just to tell a number.

(No, just preventing to register a new Account is not an option for me, for they just kill the cookies and reconnect if they recognize that)

Umm, okay, well if they clear they're cookies and have their IP address changes, there's nothing that anyone can do about that. The AE Detector didn't even have registration IP address checks. I don't see what you're wanting me to do about people trying to evade the system.

Originally Posted by kursed

Understood. That I guess was the issue here. Thank you so very much for your help.

Glad I could help

Originally Posted by Alfa1

I have just recently got this hack to work. Until January i was using the AE detector. The few months without detection seems to have resulted in a lot of returning trolls.

DB features would be great.

Hmm, if you want to "start over," then you can either change the Cookie Name or do a cookie reset. The cookie reset would take a substantial amount of time, but the cookie name change would be immediate.

I cannot say exactly how long the wait will be for the next version, but it's going to be at least another couple of weeks. I've got a big project that I'm still working on.

[exportforce]

Originally Posted by Kiros72

I'll try to include this option in my next version, but understand that this is not a priority of mine. This would be an unsafe feature that could get a lot of people in trouble, so again, it's no priority.

If it is a matter of money, please tell me a price to get this a bit higher into your priority list.
Maybe as a hardcoded option in a file, so if you really want to activate it, it is not easily accessable through the options

Originally Posted by Kiros72

Multiple Account Detection & Prevention already does this too.

For me not. As Stated. Account X and Y are already banned for being shared accounts. Yesterday someone logged into both accounts with the same IP and browser and the System did NOT inform me about that.
About the detectiontype... in our test the text was missing, now on a real one it showed the detection very well

Originally Posted by Kiros72

Umm, okay, well if they clear they're cookies and have their IP address changes, there's nothing that anyone can do about that. The AE Detector didn't even have registration IP address checks. I don't see what you're wanting me to do about people trying to evade the system.

If you directly deny a registration they'll figure more fast, that they should do this. If you let them register and instantly ban them, they don't fiddle around much. Don't know why but it works better that way