Miscellaneous Hacks - Ban Spiders by User Agent

What this mod does
With this mod you can enter User Agents to watch or ban, you can also recieve emails or have an Output.txt created and updated with time and date of visits. It doesn't just have to be spiders, you can watch, log or ban any useragent!

How to install
Simply import the product ban_spider, the mod is active by default but none of the other options are turned on.

What is a UserAgent?
http://en.wikipedia.org/wiki/User_agent

Understanding a UserAgent string
http://user-agent-string.info/parse

Genuine User Getting Blocked?
https://vborg.vbsupport.ru/showpost....&postcount=105

Tools to help
http://whatsmyuseragent.com/SwitchingUserAgents.asp
http://www.botsvsbrowsers.com/SimulateUserAgent.asp

FAQ
https://vborg.vbsupport.ru/showpost....&postcount=137

What's a bot?
http://en.wikipedia.org/wiki/Spambot

How do i ban a bot?
https://vborg.vbsupport.ru/showpost....&postcount=318
https://vborg.vbsupport.ru/showpost....7&postcount=51

Where's output.txt located?
https://vborg.vbsupport.ru/showpost....&postcount=216

Bad bot lists
https://vborg.vbsupport.ru/showpost....&postcount=259
https://vborg.vbsupport.ru/showpost....&postcount=224
https://vborg.vbsupport.ru/showpost....&postcount=281

VB4.x Version of Ban Spiders By User Agent

Tested on vb3.7.x, vB3.8.x but should work on any version.

__________________________________________________ __________________
Special thanks to:
Lior
KH99
BoP5
for helping me sort out a few issues

...and beta testers
ForceHSS (Special thanks to Force for latest testing)
ozzy47
GreyHost

If you use this please mark as INSTALLED

History
9th June 2011 Orginal xml added
12th June 2011 Added both email notification and text file logging
22nd June 2011 Version 2.0.0, Added create thread on activity

1. Added match facility you can now use something like Yandex and it will match MOZILLA/5.0 (COMPATIBLE; YANDEXBOT/3.0; +HTTP://YANDEX.COM/BOTS)
2. Added clickable link to visited thread

22nd September 2011 added user redirect url selection
08th October Beta testing started for thread creation.
20th October Beta testing started for emailing.
21st October Beta testing complete Ver 3.0.0 uploaded
29th October minor fix added to cope with empty userid on thread creation
30th October Beta testing automatic redirection to spiders/bots IP
31st October New xml uploaded with automatic redirect to IP
25th November Minor fix for blank forumid fixed
26th November 2011 Fixed version check & create thread Off by default
17th December 2014 Version 3.1.0 uploaded, Extra logging and statistics added by Ozzy47 (Chris)
18th December 2014 Version 3.1.2 uploaded, due to rogue process from other mod
18th December 2014 Version 3.1.3 uploaded, due to previous one being VB4 mistakingly uploaded

The Bad Bots list is now included in the product
Please prune out all those that you wish to be able to see your site (i suggest you definately prune out "DA" and "Custo" :

Support will now only be given to those who have this mod marked as INSTALLED

[Simon Lloyd]

I doubt there's a pc on the planet that still uses MSIE 1,2 or 3

Remember this mod was built to ban spiders or bots which usually display their bot name in their UA, using the mod outside of that scope is bound to take you in to some grey areas, make sure you use the tools shown in the original post of this thread to check new UA's before you ban them.

[Dan49]

Is there a way to block MSIE 1 without affecting MSIE 10?

[Simon Lloyd]

All you can do is add a space after it, but again all it will do is look for MSIE 1_ where _ is the space (it doesn't physically look like _ that was for illustration purposes), but if it doesn't appear in the UA with a space after it, it wont ban it.

[Dan49]

Thanks.

Another general question. I understand that malicious bots can fake the UA. Why don't they all fake it to display as Google? This way anybody would be hesitant to block them? BTW I do use your IP ban mod also.

[Max Taxable]

Originally Posted by Dan49

Max, you may be interested in this. I had a legit user blocked out of my forum. I checked and rechecked his UA and could not figure out why he was blocked

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Of course turning off the mod unblocked him, so I knew it had to be something.

On a hunch I looked at the MSIE entries I copied from your old post:

MSIE 1
MSIE 2
MSIE 3
MSIE 4
MSIE 5
MSIE 6

I realized that MSIE 1 is the culprit being the first part of MSIE 10.0;

Have you since removed MSIE 1 from your list?

Is there another way to make MSIE 1 work without affecting MSIE 10? As well as the other MSIE, like MSIE 2 for when IE gets to version 20 ?

Yes this was covered earlier in the thread, and have since removed MSIE 1 from my list. This was months ago. Like Simon said, the number of surviving computers on the planet still using MSIE1 is so tiny, it's not worth blocking.

[Max Taxable]

Originally Posted by Dan49

Thanks.

Another general question. I understand that malicious bots can fake the UA. Why don't they all fake it to display as Google? This way anybody would be hesitant to block them? BTW I do use your IP ban mod also.

Some of them do so, but it's very easy to spot those fakes since Google only uses one or two IP addresses. I am pretty sure there's a Mod for blocking spoofed google UA's somewhere.

[Dan49]

I found this information about verifying Google bot. And used this tool http://ipadmin.junkemailfilter.com/rdns.php. Is this the best way? Or is there a list of the IP addresses google uses?

I'd appreciate a link to the mod you mentioned, I searched and can't find it.

[valdet]

Hi Simon,

Hope you got your forum problems sorted

I noticed that the mod will not create new threads on private forums, where only admins can post/read.
I am using my admin account as thread creator, so it has permissions to create threads. The threads are created only on public forums where other members and guests can see them, which of course isn't nice.

The output.txt file writing is also not logging anything.

But from my server logs, I see this mod has been doing incredibly well in blocking some nasty spiders (mainly Magpie and Spinn3r).

For those who don't check their server logs, I would advise to check them and see if Magpie is sucking up to 40% of bandwidth as it was until recently in one of my sites.

[Max Taxable]

Originally Posted by Dan49

I found this information about verifying Google bot. And used this tool http://ipadmin.junkemailfilter.com/rdns.php. Is this the best way? Or is there a list of the IP addresses google uses?

I'd appreciate a link to the mod you mentioned, I searched and can't find it.

I only vaguely remember seeing such, and it was sometime back. And I might even be wrong.

[Simon Lloyd]

Originally Posted by valdet

Hi Simon,

Hope you got your forum problems sorted

I noticed that the mod will not create new threads on private forums, where only admins can post/read.
I am using my admin account as thread creator, so it has permissions to create threads. The threads are created only on public forums where other members and guests can see them, which of course isn't nice.

The output.txt file writing is also not logging anything.

But from my server logs, I see this mod has been doing incredibly well in blocking some nasty spiders (mainly Magpie and Spinn3r).

For those who don't check their server logs, I would advise to check them and see if Magpie is sucking up to 40% of bandwidth as it was until recently in one of my sites.

Glad it's working for you, on my forum I simply added a forum where only staf had permissions to view and made the threads there, I also had no issue with logging.

I did get my forum issues sorted, turns out it was a half assed script kiddie attempt to kill it but got it sorted (one of my forums allowed html in the post environment....really bad idea!). When I get chance (which will be after Thursday as my wife is having an op) I will retest the mod from scratch and post specifics here.