Administrative and Maintenance Tools - Troll/ip-tracker, detect multiple accounts/trolls [3.6 compatible]

Continuosly information about updates can also be found here.

Edit 2007-08-07

Since the script needs to be rebuilt from scratch due to some problems with it, I've decided to temporarily stop the distribution. On larger sites, this script may cause heavy lagging when active. There has also been reports on "duplicate keys", that should be fixed. To prevent more problems cause by this hack, it's removed and cannot be downloaded.


History

In 2005 a forum was founded, for a short period of time that was intended to work as a service for people with a common interest - a reality show. The forum grew big and the traffic was very intensive. Moderators worked day and night to assist the forum. Traffic and events in the show made people show different kind of feelings and some of them showed this in strange ways. They said "I'd better register 10 nicknames, just to secure that noone can ban me". Sometimes, when they got banned, they registered new nicks and sometimes they switched ips but they didn't post anything the same day. Next day, they switched ip again and it suddenly got much harder to trace their nicks back to the start.

In 2006, the forum opened again (new season) and we was prepared for this. A script, specialized to trace trolls, was written and the main purpose was to trace things that vBulletin missed. This plugin was requested at the vBulletin forums.


Now, it's here, as a beta production - a trolltracker that stamps all visitors even if they don't post anything. It also, partially, checks if an ip-address can be traced from anonymous proxies by reading headers that proxies are sending to he server (HTTP_VIA and HTTP_X_FORWARDED_FOR).


Templates to change (Optional): 3


Attached

trolltracker-2.0.3beta.zip - the main archive with the tracker and extras
iptracker.php - A quickfix for the coming version 2.0.4 that changes the SHOW COLUMNS-behaviour-bug in the tracker


The archive

The zip should contain the following files

• The product, currently named product-trolltracker_beta.xml because of it's beta status
• iptracker.php, the tool that makes it easier to trace nicknames and ip's
• iptracker_search.php, htmlcode - the searchform that iptracker.php is using (old code that never used templates)
• trollpost.php, a quite slow script that imports ip's and usernames from the post-table to make it possible to trace older data. (If you run this over a web-interface, it might not work, because of timeouts --screendump--)

How to install

1. Copy *.php to your forumroot
2. Install the product code (choose overwrite if you're upgrading)
3. Check the configuration from your admincp (settings for usergroups that can run the iptracker.php is made from there)

Additional information


Track older ips (2.0.x)

If you want to import older posts, you can do that, but because of timeouts (and bad scripting) trollpost.php may timeout if you run the script from a web-browser. This part is, currently, unsupported, but if someone has any ideas here, feel free to notify me.

OPM Support

The ip-tracker supports RBL Monitor.


How to use it

Use the tracker by calling http://your-forum.com/iptracker.php


Database

The installation creates a table named user_troll for your forum.
The FQDN-support also adds a table called user_trollresolver for the resolver cache (like the one used in the OPM monitor)

Information and issues

• There is no version 1.x - that version was private (this is not an issue)
  
• It's still a beta, so bugs may still annoy us
  
• Testing on vBulletin 3.6.0 rc1: Works fine
• Importing posts with trollpost.php might give strange results if you are using the multiple account detector (AE): reports in forum that are posted with a specific userid makes it look like a troll is using other usernames too

To do

See CHANGELOG for full details


Show the tracker in navbar (v2.0.1+)

To show the tracker in the navbar (only for the admingroups that can be found in the options), edit your template 'navbar' and add this code where you want it to be shown:

 <if condition="$show['trolltracker']"><td class="vbmenu_control"><a href="iptracker.php">Trolltracker</a></td></if>

I chose to put it in the end of navbar, right after this code:

        <if condition="$show['member']">
<td class="vbmenu_control"><a href="login.php?$session[sessionurl]do=logout&amp;logouthash=$bbuserinfo[logouthash]" onclick="return log_out()">$vbphrase[log_out]</a></td>
        </if>

How to show trolls in the onlinelist

Edit template:
whosonlinebit

Find:
</tr>

Add above:

    <if condition="$show['trolldata'] AND $userinfo['trolldata'] != ''">
            <td class="alt1">
            $userinfo[trolldata]
            </td>
        </if>

Edit template:
WHOSONLINE

Find:

</tr>
$onlinebits

Add above:

    <if condition="$show['trolldata']">
            <td class="thead">
            <b>Trolldata</b>
            </td>
        </if>

Support, help, contact

Any questions, requests and bugreports can be sent to me by PM, mail or via threads at http://vbulletin.tornevall.net/


Don't forget to install this plugin

[cheekymonk3y]

Originally Posted by Alfa1

My forum has become slower and slower until it started crashing(time outs) daily. Then I tried many things, but nothing helped. Then I deactivated the troll tracker and my site was as speedy as ever again. There are quite a lot of entries in the tracker. Is it possible that the amount of entries caused my site to slow down so much that it crashed?

pity i never read this thread before having my forum totalled for a whole 30 hours. The exact same thing as the above user happened with me, and i never noticed the slowdown after i installed, but members began picking it up after a few hours. The forums were creeping and activity was 95% down, anyway, i eventually figured things out and uninstalled and everything went hyper. The reason for the slowdown i think is because the mod interrupts the page load. Ftp/downloads/non-vb pages worked perfectly.

[TMM-TT]

Yes, I've discovered the bottlenecks myself with this hack after a quite long period now, and due to IRL-delays I haven't been able to answer for a long time. I'm also thinking of making a brand new version in a (hopefully) close future, that should work better than this..umm..crap.

I'm sorry for this and all my "lagging"..

[valdet]

Does this work on vB 3.6.5 too. I need this bad..

[Alfa1]

TTM: My database is incredibly huge now. I'd like to get rid of the troll tracker until you have created something better.

Can you please tell me how to un-install this in a way so that my database goes back to normal? Please be specific. I am very scared to do something wrong.

[TMM-TT]

Originally Posted by Alfa1

TTM: My database is incredibly huge now. I'd like to get rid of the troll tracker until you have created something better.

Can you please tell me how to un-install this in a way so that my database goes back to normal? Please be specific. I am very scared to do something wrong.

I don't think there will be no problems... Actually, I think the only thing you need to do is to disable the hack from the product manager. If you uninstall it, the table should be dropped, but in case of any possible problems I'd prefer to disable the hack first. After disabling, you can do whatever you want with the table

[Alfa1]

Which tables should I delete?

[Karolis_S]

Originally Posted by TMM-TT

Yes, I've discovered the bottlenecks myself with this hack after a quite long period now, and due to IRL-delays I haven't been able to answer for a long time. I'm also thinking of making a brand new version in a (hopefully) close future, that should work better than this..umm..crap.

I'm sorry for this and all my "lagging"..

What about new better version? Can we hope to see it soon?

This was the best sollution I have ever seen, but as I read the forums goes slowly... Please let us know if you are creating something, or we have to look any solusions in other threads...

Big Thank you.

[TMM-TT]

Originally Posted by Karolis_S

What about new better version? Can we hope to see it soon?

This was the best sollution I have ever seen, but as I read the forums goes slowly... Please let us know if you are creating something, or we have to look any solusions in other threads...

Big Thank you.

The problem with the old script is that every single hit to the forum are controlled and registered to the database. The controlling part should limit the database size, to prevent duplicates, but instead when the database grows larger, it's almost impossible to handle, especially if the board is big. I still have no good solution for this, but I've been working with similar things that still is working quite nice - and is a bit coorporative with the AE-Detector.

Of course, there could be a possibility to make it work as the DNSBL-Plugin does, by caching the lates nicknames, but still, if the database is too large there might be some problems with the speed.

Due to a lot of "side-work", my time is limited, but I'll try to make an upgrade soon. If you have any suggestions on how to make the tracker better, that would be nice too.

[twilighthush]

I'm getting errors that look like this:

Connecting to destination database...

Warning: mysql_connect() [function.mysql-connect]: Access denied for user '[usernamehere]'@'localhost' (using password: YES) in /trollpost.php on line 77
Unable to reach forumdatabase

I edited the username and password in the php file when it failed the first time, and it still doesn't work. Any advice?

[bikers]

Originally Posted by Ski-Whiz

Ok I have found a bug:

Invalid SQL:
UPDATE user_troll SET timestamp = 1156627674, date = '2006-08-26', username =
'dabear's are #1', userid = '0', time = '17:27:54', opm = '0', imported = 0 WHERE
idx = '9830' AND deleted = 0 AND fqdn = 0 LIMIT 1;

MySQL Error  : You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use near 's are
#1', userid = '0', time = '17:27:54', opm = '0', imported = 0 WHERE idx = ' at line
1
Error Number : 1064
Date         : Saturday, August 26th 2006 @ 05:27:54 PM
Script       : http://www.xxxxxxx.com/forums/register.php

Now this error is from anyone who uses an apostrophe in their username. The name I tried to register is "dabear's are #1"

This leaves us all open to a SQL attack..

Im still getting this error with 2.0.4. When is there going to be an update or fix for this?