Administrative and Maintenance Tools - vbStopForumSpam - known spammer lookup for new registrations

vbStopForumSpam

This provides access to a RBL type system for forum admins, listing known spam IP / email / usernames. The RBL database is provided by www.stopforumspam.com. You do NOT need an API key from the website in order to access the database. only to submit data if you should wish to do so.

At the point of user registration, the mod checks if the IP number / provided username / email addresses appear on a block list and can block the registration.

Whilst this isnt the most perfect way to stop all forum spam, its another step that spammers have to overcome.

VB4 here https://vborg.vbsupport.ru/showthrea...hreadid=230921
Its the same code, it works in 3.54 to 4.0


What it does

It checks with a remote database of known forum spammers. Their IP number, email address and forum username are tested and based on your configuration, you can reject / log / accept user registrations based on what you get back.

This version doesnt have
- whitelisting or the ability to submit users to the database but it will within the next week.
- automatic user deletion / post / PM purging. There are good tools out there already, this does something else.

Instructions are included in the installation.txt file - PLEASE read it first and dont forget to actually upload the files in the upload folder, otherwise it WILL kill your registration progress and you wont see the log file options in admincp. You do not need to download the product-vbstopforumspam-3.54.xml file unless you are using a vBulletin version older than 3.6.0

Changes to vB
- 3 new database tables
- 2 database table alternations
- No new templates.
- 2 Hook (register_addmember_process & register_addmember_complete)

Ive tested it but had feedback that it works with versions as old as 3.6.2... Support should go back to older versions, as long as they have hook support for register_addmember_process / register_addmember_complete

Known to work - tested by me
- vBulletin 3.6.8 on Apache 2.2 / PHP 5.1.2 on Linux using cUrl
- vBulletin 3.7 Gold on Apache 2.0 / PHP 4.4.3 on Windows without cUrl (template changes wont work on 3.7 - thats in the next version with auto template changes)

For code to submit spammers to the database, check this post for code changes
https://vborg.vbsupport.ru/showpost....&postcount=288

Reported in the thread to work
- 3.6.1, 3.6.2, 3.6.9, 3.6.10, 3.7.0, 3.7.1, 3.7.2, 3.7.3, 3.74, 3.80, 3.81, 3.82, 3.83, 3.8.4, 4.0beta3

If you have 3.54, then you can use the product-vbstopforumspam-3.54.xml file attached instead of the one in the ZIP file, which will allow older vBulletin versions to access this mods' features. I personally havent tested this version, its a user contribution, thanks to Darrell Mobley, that changes the way the XML works when imported into older versions.

Installers should remember to refresh their ACP navigation window when they first install it so they can see the new log file menu item.

REQUIRES MySQL 4.1.1+

Future versions
- Automatic integration into vBulletin to add users to the stopForumSpam.com database from a form
- Whitelisting of username / IP / email addresses
- AJAX integration to allow for lookups from within the users profile
- Decreased remote query count from three per user to one per user.

Versions / Changes

0.1 Initial Release

0.2 pedigrees special brew birthday release.
- Small security update. If you have 0.1 installed, download 0.2 and replace your existing functions_vbsfs.php with the one in the archive. It just tests to see if its running inside the VB framework before anything else. This is what happens when you code at 2am after drinking wine

0.3
- stopped it processing valid registrations twice
- moved all non-function code into the plugin. Not a big one as 0.2 basically did that
- fixed a typo in the log pruner that stopped it working (404)
- removed unused fields from the database for people with mysql that doesnt support varchar > 255 (ie mySQL4). If you have 0.2 installed and dont need to prune your logs just yet, you dont really need to install this version but can instead wait for 1.0 unless of a massive security update.

0.4
- logs registrations that arent/wouldnt be blocked
- fixed XML errors when username has a space it in
- tightened up the cache so that it doesnt test a username against an email name to give a bypass result (for when a username is an email address that isnt banned where the email address is)
- fixed some basic logic errors in the PHP

0.6
- Should work on PHP 4.4 now - rewrote the XML with PHP4 in mind (tested on Apache2.0/PHP 4.4.3)
- Fixed a caching system where data wasnt being updated correctly which could cause a remote query when one wasnt needed
- Possible false negative situation when a spammer was blocked due to SFS.com being down who then visited again when it was up but within the cache expiry time
- Remote query failure when the result page isnt XML should work a bit better now. It does a very basic test for valid XML results.
- Fixed log purging (again) and it should actually work properly now.
- No longer requires PHP5
- The log viewer now links to a user profile when registration is allowed.

v0.61 - Removed a template change that was invalid vBulletin code. The package you download will still say its 0.60 however

NB : When upgrading from any version to 0.6, you must remove and then add the plugin due to changes in one of the database tables

You need to have an API key from www.stopforumspam.com in order to submit data, its free and easy to get... You DONT need an API key in order to use this mod however, only to submit spammer data.

Issues are
- The usergroup permissions / view details etc DONT work. I jumped the gun and put the permissions controls in there before I put the code in. Please delete the includes/xml/bitfield_vbstopforumspam.xml file and rebuild your postbit

Installation
- Follow the instructions in the zip file, that includes upload the correct folders
- ONLY download the 3.54 xml file if youre using a vbulletin version prior to 3.6.0. use this file to install the mod instead of the xml file in the zip file.

Please click Installed

[techtir]

It's only rejecting spammers with gmail address. We have plenty of real members with gmail addresses.

A recent tactic of US spammers seems to be to get a fresh Nigerian Human to sign up. We see the IP is Nigerian and do nothing. About 5min to 15min later the 1st post comes, a large advert for phones etc from a US IP, often with new email addresses to send the order to.

If it's a cable or Fibre IP, then the user IP doesn't change much. So then we add those posting Emails and original email to VB's own blocked emails list (in case in future Stopforumspam is down) and then add all the IPs and Emails and user names to stopforumspam.

I'd like to see this mod add blocked or banned IPs & email, (i.e. no matter if registration was successfull or not) to VB's blocked list.

I already made one tiny change on the addon reporting script so the Report to Stopforumspam box and button doesn't appear unless the user is Banned user group (Change NOT admintrators group to EQUAL Banned Group). That submit button needs to simply update the Blocked IPs and Banned Emails settings visible in VBoptions userBanning, two SQL statements)

[pedigree]

Originally Posted by techtir

I'd like to see this mod add blocked or banned IPs & email, (i.e. no matter if registration was successfull or not) to VB's blocked list.

I already made one tiny change on the addon reporting script so the Report to Stopforumspam box and button doesn't appear unless the user is Banned user group (Change NOT admintrators group to EQUAL Banned Group). That submit button needs to simply update the Blocked IPs and Banned Emails settings visible in VBoptions userBanning, two SQL statements)

Explain the 1st one a bit more if you could please. 2nd one - click click, add the IP number to the vbulletin banned IP address list as well?

[techtir]

Here is the code from the "submit" to stopforumspam. It's the plugin add on I got from this thread with one small change.

PHP Code:

if (is_member_of($user['usergroupid'], 8)) // we dont want to ban our admin account now do we
        { 
            print_table_break('', $INNERTABLEWIDTH);
            print_table_header("vbStopForumSpam");
            if ($vbulletin->options["vbstopforumspam_apikey"])
                print_label_row('Submit these details to www.stopforumspam.com ban list<BR><table><tr><td>Username:</td><td><input type="text" name="username"  size="30" value="'. 
$user['username'] . '"></td></tr><tr><td>Email:</td><td><input type="text" name="email"  size="30" value="' . $user['email'] . '"></td></tr><tr><td>IP:&nbsp;</td><td><input type="text" name="ip_addr"  value="' .$user['ipaddress'] . '"></td></tr></table><input name="api_key" type="hidden" value="' . $vbulletin->options['vbstopforumspam_apikey'] .    '"><input onclick="this.form.action=\'http://www.stopforumspam.com/add.php\';this.form.submit()"  type="button" class="button" value="' . $vbphrase['submit'] . '"/>');

            else
                print_label_row('You need an API key from www.stopforumspam.com before you can submit to the database' ,'');    
        } 


Changed line
if (is_member_of($user['usergroupid'], 8))
Note it's now ==8, banned Group, rather than != Admin Group

This means the box with email, username, IP and submit to stopforumspam only appears if you banned user (i.e. automagically via Delete all posts as Span etc)
I haven't added anything else.
But this is where you would add two SQL statements, one to add email and other to add IP to the database normally accessed manually in VBoptions User Banning settings.
Then assuming all the spammer's posts where physically deleted you can now safely delete the user.
I usually also manually add IP used and email quoted in the Spamvertisment that is deleted, as well as the user account IP and email.

None of this is automatic, I'm only suggesting that that's what I would automate and where I'd add it.

[techtir]

The other issue is that the vbstopforumspam 1st checks IP then it checks email.
If there is a match on email in log I update manually the IP and user name with that email to Stopforumspam as the email pretty much is always real spammer.
a)
That would be a useful thing to automate.

b)
Since spammers usually try with same email and / or IP multiple times and stopforum spam database could go down for a while, I thought that if any successful blocks on email or IP found at stopforumspam, it would make sense to automatically update VB's own blocking database with those likely to be retried IP and/or email. I think that's quite useful compromise between loading the entire stopforumspam database (and syncronising changes) or doing nothing.

I don't think anything needs added to the "in forum" delete as spam or ban user as you want to review banned users in Admin CP before blocking/reporting them.

The Submit code (in last post above) ideally should use a custom user field (Reported) and NOT automatically delete the user. Then the button text could be Unsubmit and remove the details from Stopforumspam, the vboptions user blocking, and unbanned the user (change group to Registered User) if it was all a mistake. Mistakes happen.

[Johndd]

Fantastic I was getting really frustrated banning spammers every morning. Thanks

[Barteh]

Originally Posted by techtir

It's only rejecting spammers with gmail address. We have plenty of real members with gmail addresses.

A recent tactic of US spammers seems to be to get a fresh Nigerian Human to sign up. We see the IP is Nigerian and do nothing. About 5min to 15min later the 1st post comes, a large advert for phones etc from a US IP, often with new email addresses to send the order to.

If it's a cable or Fibre IP, then the user IP doesn't change much. So then we add those posting Emails and original email to VB's own blocked emails list (in case in future Stopforumspam is down) and then add all the IPs and Emails and user names to stopforumspam.

I'd like to see this mod add blocked or banned IPs & email, (i.e. no matter if registration was successfull or not) to VB's blocked list.

I already made one tiny change on the addon reporting script so the Report to Stopforumspam box and button doesn't appear unless the user is Banned user group (Change NOT admintrators group to EQUAL Banned Group). That submit button needs to simply update the Blocked IPs and Banned Emails settings visible in VBoptions userBanning, two SQL statements)

Easiest way to deal with this is both a reCaptcha protected 'contact us' form (which iirc is automatically referred to when people are unable to register because of banned email addresses) and a moderation queue for new users.
vBSFS keeps out the vast majority of spammers (say, 999 per 1000 attempts at least), so you'll only have to deal with possible human spammers on occasion, assuming you have enough people who can authorise new users of course. You might want to install the ModCP moderate new users plugin as well, helps share this load with your supermoderators and thus keeps response time to a minimum.

[Coop1979]

Wow, I installed this an hour ago and already have had 20 spammers try to sign up and be rejected!

[pedigree]

Im in the code again at the moment, putting code in there so that its hooked in inline_deleteaspam.

Now, given that you can delete posts as spam and not ban someone, what options should be put in to avoid submitting non banned users to the database?

Either
1. No submission to the database if the user isnt set to be perm-banned
2. A form checkbox in the page, to overwrite #1
3. Admin options (off by default) that allows non-banned users to be submitted regardless of the form data.

[Wired1]

After you select Delete post as spam, under Punitive Action add a 3rd radio box that says "Ban these users and submit to vBSFS". It'd be nice if it submitted the IP they posted from as well as the IP they registered from, as like someone said earlier, they can be different. ESPECIALLY those wankers who spam the cell phone crap!

[pedigree]

Thats what I have at the moment but submitting data when not banning a user, a bit of an odd action