Anti-Spam Options - Hostname or Useragent Registration Ban

THIS ADD-ON IS NO LONGER AVAILABLE AND IS NOT SUPPORTED

This is an add-on that is designed with vBulletin 4.1.5. It may not work on earlier versions of vBulletin. It is known to be working on vB versions 3.8.7, 4.0.7 and 4.1.5 through 4.2.0. I don't know if it is compatable with all versions of vB or not.

On my site, I receive quite a few PMs asking me how I prevent spam from being posted there. While I can't release everything I use because some of it is server based (external from vBulletin), I can release one of the lines of defense that I use.

This mod allows you to ban Hostnames and Useragents from registering on your site.

If a hostname or useragent contains any of the words you specify and they are trying to register, they are presented with an error telling them they are forbidden from registering on your site. And no registration screen ever appears.

In the event the hostname is blank, a WHOIS can be performed to establish the identity of the system being used to register.

The 'External Content' pulled by this mod is only the WHOIS information when that is enabled.

WARNING: This mod has the potential of banning humans from registering. Choose what words you use carefully.

Personally, I am not very concerned about banning an occasional human from registering. So, from time to time my system may ban a human that uses an anonymous proxy.

NOTE: This mod has a 'Don't Ask, Don't Tell' clause. Please don't post telling people what words to ban. We don't need spammers getting around this mod by reading posts telling them what is being filtered.

REQUIREMENTS: In order for the WHOIS function used in this mod to work properly, your server must have OPENSSL installed.


* INSTALLATION *
---------------------
1) Upload the contents of the 'upload' folder to your forum's root.
(If your forum's location is http://www.example.com/forums/, the root is /forums/)

2) Import the product XML file (product-hostusercheck.xml) into the Product Manager in AdminCP.

3) Take some time to set the options in ACP->Settings->Options->Prevent Hostname or Useragent from Registering.

4) Be sure to turn on the mod when setting options in ACP->Settings->Options->Prevent Hostname or Useragent from Registering.



* History (Changelog) *
-----------------------------
1.0.3 (December 12, 2013)
- Fix hostname not being checked under certain circumstances.

1.0.2 (March 1, 2012)
- Fix error on registration page when Useragent or Hostname to ban is blank.

1.0.1 (February 24, 2012)
- Wrong hook being used for one of the plugins.

1.0.0 (January 22, 2012)
- Public Release

[nhawk]

Originally Posted by Max Taxable

If you have it set to do the WHOIS check it might be returning the word "proxy."

That's what I thought at first, but it returns..

Hostname: monitor5.sucuri.net
NetName: LINODE-US <------- This is the important one

[Max Taxable]

Originally Posted by nhawk

That's what I thought at first, but it returns..

Hostname: monitor5.sucuri.net
NetName: LINODE-US <------- This is the important one

Just so... Just so.

But, not finding that either when I search the list he said he is using.

[Max Taxable]

Originally Posted by BadgerDog

What I don't understand, is why it's blocking a registration when there's no registration needed for this access?

If it attempts to register it will be blocked if it is on the list, otherwise nothing happens to it.

That it's using a i-phone as a UA seems strange to me. Using a spoof UA and trying to register aren't the behavior you would expect of a site monitor.

Again, the only way this mod fires is if a register attempt is made. It doesn't block anything else. It does not block access.

The key is, "Tried to register." Sucuri Verified Site Monitor is not blocked from access and it has no legitimate business loading the register page..

[Max Taxable]

Spammer botnets often infect systems such as these site monitors and verifiers. I believe this mod stopped a attempted bot registration. It did its job.

It did not restrict any other access by your site monitoring service. At all. I recommend you turn it back on.

You might ask Sucuri why their bot product is trying to register.

[ozzy47]

That is a legit sucuri IP address.

Doug, what do you have in your robots.txt file?

[nhawk]

As Max said, this add-on only triggers when someone tries to register. It doesn't prevent access to the site. It prevents registration.

So if securi attempted to register and either the hostname or useragent for the securi bot contained blocked information then the add-on did it's job. It blocked a registration, that's all. It didn't prevent access to the site.

[Max Taxable]

Originally Posted by ozzy47

That is a legit sucuri IP address.

Right, which means they are very likely infected and have some botnet zombie computers on their system. It's not at all unusual to see.

Point is, it has no business at all loading the register page or trying to register. This mod did its job.

And his site monitoring service is not blocked from the site. Just the register page, where it doesn't need to be.

I'd leave it.

[nhawk]

Max I wish I could like your posts multiple times, but C'est la vie

[Max Taxable]

Originally Posted by nhawk

Max I wish I could like your posts multiple times, but C'est la vie

Me too, Just tried liking another of yours haha.

[BadgerDog]

Originally Posted by nhawk

Without seeing your list (please DON'T post that in public), I don't know why it would have banned them. If you want, send me your list via PM and I'll have a look.

The other thing that could be in your list that is associated with that IP is 'LINODE'.

And check your hostname list too. Something might be in there.

PM's you with list, which is the one Ozz recommended...

Regards,
Doug