Anti-Spam Options - Hostname or Useragent Registration Ban

THIS ADD-ON IS NO LONGER AVAILABLE AND IS NOT SUPPORTED

This is an add-on that is designed with vBulletin 4.1.5. It may not work on earlier versions of vBulletin. It is known to be working on vB versions 3.8.7, 4.0.7 and 4.1.5 through 4.2.0. I don't know if it is compatable with all versions of vB or not.

On my site, I receive quite a few PMs asking me how I prevent spam from being posted there. While I can't release everything I use because some of it is server based (external from vBulletin), I can release one of the lines of defense that I use.

This mod allows you to ban Hostnames and Useragents from registering on your site.

If a hostname or useragent contains any of the words you specify and they are trying to register, they are presented with an error telling them they are forbidden from registering on your site. And no registration screen ever appears.

In the event the hostname is blank, a WHOIS can be performed to establish the identity of the system being used to register.

The 'External Content' pulled by this mod is only the WHOIS information when that is enabled.

WARNING: This mod has the potential of banning humans from registering. Choose what words you use carefully.

Personally, I am not very concerned about banning an occasional human from registering. So, from time to time my system may ban a human that uses an anonymous proxy.

NOTE: This mod has a 'Don't Ask, Don't Tell' clause. Please don't post telling people what words to ban. We don't need spammers getting around this mod by reading posts telling them what is being filtered.

REQUIREMENTS: In order for the WHOIS function used in this mod to work properly, your server must have OPENSSL installed.


* INSTALLATION *
---------------------
1) Upload the contents of the 'upload' folder to your forum's root.
(If your forum's location is http://www.example.com/forums/, the root is /forums/)

2) Import the product XML file (product-hostusercheck.xml) into the Product Manager in AdminCP.

3) Take some time to set the options in ACP->Settings->Options->Prevent Hostname or Useragent from Registering.

4) Be sure to turn on the mod when setting options in ACP->Settings->Options->Prevent Hostname or Useragent from Registering.



* History (Changelog) *
-----------------------------
1.0.3 (December 12, 2013)
- Fix hostname not being checked under certain circumstances.

1.0.2 (March 1, 2012)
- Fix error on registration page when Useragent or Hostname to ban is blank.

1.0.1 (February 24, 2012)
- Wrong hook being used for one of the plugins.

1.0.0 (January 22, 2012)
- Public Release

[nhawk]

I am still curious what difference it makes if Securi is sent to the error page when it hits register.php or not?

It seems Securi is scanning pages for malware and the error page shouldn't have any malware.

Or, does Securi know exactly what register.php is suppose to contain and they throw an error on their end if it contains anything else?

[ozzy47]

I believe they just check it for malware.

[Max Taxable]

Hey Snog... Any plans to make the filter list one per line, so it has to be exact match to get caught? Example - just had a spammer register from "Biznet" but adding this to the filter is going to catch everything that has 'biz' or 'net' in the name.

[ozzy47]

Yeah that would be a optimal way to do it.

[nhawk]

Originally Posted by Max Taxable

Hey Snog... Any plans to make the filter list one per line, so it has to be exact match to get caught? Example - just had a spammer register from "Biznet" but adding this to the filter is going to catch everything that has 'biz' or 'net' in the name.

No it won't. It will catch BIZNET.

The entire word has to be matched. The word isn't broken down into smaller sections for detection. So bizmarknet would NOT be caught. But badbiznet would.

[Max Taxable]

Originally Posted by nhawk

No it won't. It will catch BIZNET.

The entire word has to be matched. The word isn't broken down into smaller sections for detection. So bizmarknet would NOT be caught. But badbiznet would.

How then did we catch "monitor5.securi.net" using the word 'tor' in the filter?

[nhawk]

Originally Posted by Max Taxable

How then did we catch "monitor5.securi.net" using the word 'tor' in the filter?

The plain word 'tor' was in the list. That matched the tor in "monitor5.securi.net"

See the difference..

BIZNET

bizmarknet would NOT be caught.

but somethingbiznetelse would be.

[Max Taxable]

Originally Posted by nhawk

The plain word 'tor' was in the list. That matched the tor in "monitor5.securi.net"

See the difference..

Okay... Yep I get it.

With "Ban Spiders by User Agent" we don't get such matches, I assume because the definitions are line by line instead of separated by commas?

[nhawk]

Originally Posted by Max Taxable

Okay... Yep I get it.

With "Ban Spiders by User Agent" we don't get such matches, I assume because the definitions are line by line instead of separated by commas?

Well, no it's more because of the way they check for matches. I look for it in any part of the host name or user agent. They match the exact item.

I've found that doing it the way I do gives better protection overall. Mainly because if you decide you don't want any servers registering you just have to enter 'server'. That kills a good number of bots right off the bat. Another example would be rackcentre. Anything with that in the host name is a server. Listing each server from rackcentre would be a list 10 miles long. So with the way I do it, just entering it once kills them all.

[ozzy47]

Let me ask you this, can it be made to have each one on it's own line without a performance issue? It would be much easier to maintain the list that way.