SpamBuster v1.0.0 (Stable): Identify, log and remove spam posts on your forum

This is the v3.5 version of vbSpamBuster that I wrote for vBulletin v3.0.x This version adds some new features.

What does it do?
It spots posts that could potentially be spam then (depending on option settings) creates a thread alerting site admin/moderators about the post and/or hides the post from view.

How does it identify the spam?
All off the posts for users with a post count of less than 10 (configurable) have their posts checked against a number of rules. Each rule has a different "score". If the total score for the post exceeds a specified limit then the post is deemed to be spam.

Can I add my own rules?
The installer file has a default rule set with it, you may wish to customise the rules in the options section of the AdminCP. The rules system is fairly simple to add to, in simple terms each rule is a perl regular expression and a score.

How do I install it?
Import the product via the Product Manager in the AdminCP. The options group and plugins will be added to your system. Now would be a good time to click the install link on here to record the fact that you've installed it.

How do I configure it?
Head to the "SpamBuster" option group in the "vBulletin Options" section of your AdminCP. Fill in the relevant fields. Further documentation will follow but it should be obvious what each setting does for the moment.

How do I upgrade?
Just run a regular install. It's worth backing up your settings particluarly the rules before performing the upgrade. If you're upgrading from v0.3.2 to v1.0.0 you can just download the attached rules file and add it via the admincp as there have been no code changes.

How can I test it?
Try posting a new thread/post with some trigger values in it. The string ekmas.com should do the trick.

Help it's broken my forum!
Erm, that's not an intended feature. Disable all six of the plugins that are part of the product "SpamBuster" and post an error report to this thread. The forum will work fine.

Why doesn't it do x,y or z?
Because I've either not thought about it yet or I've not written it yet. Please drop a post into this thread with any (sensible!) suggestions.

Can I use it commercially?
You're free to use it for whatever purpose comercially/privately as long as you don't resell the code. It's released under the LGPL, see the link below for futher info. If you find this plugin useful and you'd like to make a donation please use the "donate" button below.




This software is licenced under the CC-GNU LGPL.


Changelog

• 15th June 2006 - v1.0.1 - Updated list of rules uploaded as a text file
• 6th April 2006 - v1.0.0 - Stable release: code remains the same but the rules file has changed.

[UK Jimbo]

Originally Posted by Kungfu

I must say this hack is great, works perfectly. Found a couple of spammers already. One thing is there anyway to not do certain forums. I have a few moderator forums that would be impossible for it post spam in. I want to be able to just to soft delete the spam posts and not have to worry about it deleting the posts in the restricted areas.

I understand what you mean but in practise the regexp tests will only be carried out for users with a post count of > the defined threshold. There's a marginal amount of CPU involved doing that single test on their postcount.

Originally Posted by Kungfu

Also antoher thing that needs to be updated is the new post when making a new thread to report. I have it setup so it posts a thread in a spam report forum but i cant tell if there has been spam reported unless i go into there. Could you also update the dateline and lastposter and all that as well. I could probably modify myself and just give you the code too, which is what i will probably do once i get time.

That would definitely be nice to have. If you get round to writing the code then please let me know, if not it's something I'll end up writing myself.

[leo1977]

Will this work on 3.6?

[goteamsgo]

Added a few rules:

#pills
regexp:a_meds:10:any:"/meds/i"
regexp:a_pharmacy:10:any:"/pharmacy/i"
regexp:a_clickhere:5:any:"/click here/i"

Just had a porn spammmer that got caught. The curious thing was that spambuster didn't count the links in the post although there were 3 images linked to urls & 2 text link urls in their post. But here's all it caught:

Rules matched: t_free=5,a_free=5
Total score: 10

Any guess on why it didn't count the urls? I confirmed that the url check is still installed. My full rule list:

## SpamBuster config file
# tests are in the format:
# type:name:score:section:expression

## Title tests
# title starts with free
regexp:t_free:5:title:"/^free/i"
# title starts with free and ends in an exclaimation mark
regexp:t_freebang:5:title:"/^free.*!$/i"
# title ends with three exclamation marks
regexp:t_3bangs:5:title:"/.*!!!$/i"

## Tests title and body
# contains a price in dollars
regexp:a_dollar:5:any:"/\$[\d\.]+/"
# lists a % discount offer
regexp:a_percent:5:any:"/\d+%/i"
# contains a URL
regexp:a_url:3:any:"/http:\/\//"
# contins the word free anywhere
# regexp:a_free:5:any:"/free/i"
# contins the word fedex anywhere
regexp:a_fedex:5:any:"/fedex/i"

## Known spam sites
regexp:a_dotdeals:10:any:"/dotdeals\.com/i"
regexp:a_ekmas:10:any:"/ekmas\.com/i"
regexp:a_qckjmp:10:any:"/c\.qckjmp\.com/i"
regexp:a_websponsors:10:any:"/\.websponsors\.com/i"
regexp:a_wonderyears:10:any:"/\.wonderyears\.com/i"
regexp:a_lynxtrack:10:any:"/\.lynxtrack\.com/i"
regexp:a_getodp:10:any:"/\.getodp\.com/i"
regexp:a_actualdeals:10:any:"/\.actualdeals\.com/i"
regexp:a_pdv001:10:any:"/\.pdv001\.com/i"
regexp:a_eajmp:10:any:"/\.eajmp\.com/i"
regexp:a_aftrk.com:10:any:"/\.aftrk\.com/i"
regexp:a_lps999.com:10:any:"/\.lps999\.com/i"
regexp:a_e2save.com:10:any:"/\.e2save\.com/i"
regexp:a_qksrv.net:10:any:"/\.qksrv\.net/i"
regexp:a_dse500.com:10:any:"/\.dse500\.com/i"
regexp:a_bag1881.com:10:any:"/\.bag1881\.com/i"
regexp:a_esrmtech.com:10:any:"/\.esrmtech\.com/i"
regexp:a_jokescratchcards:10:any:"/jokescratchcards/i"
regexp:a_83332:10:any:"/83332/i"
regexp:a_eaziit:10:any:"/eazi\.it/i"
regexp:a_bravehost:10:any:"/bravehost\.com/i"
regexp:a_dailyunique:10:any:"/dailyunique\.com/i"
regexp:a_en+++++:10:any:"/en+++++\.com/i"
regexp:a_putzamare2004:10:any:"/putzamare2004/i"
regexp:a_cpsasales:10:any:"/cpsasales\.co\.uk/i"
regexp:a_madhouse21:10:any:"/madhouse21/i"
regexp:a_raelian:10:any:"/rael\.org/i"
regexp:a_speedflip:10:any:"/speedflip\.com/i"
regexp:a_fredphones:10:any:"/fredphones/i"
regexp:a_watchgem:10:any:"/watchgem\.com/i"
regexp:a_250free:10:any:"/250free\.com/i"
regexp:a_bagluxury:10:any:"/bagluxury\.com/i"
regexp:a_greatnow:10:any:"/greatnow\.com/i"
regexp:a_ampd:10:any:"/ampd\.com/i"
regexp:a_remster5:10:any:"/remster5/i"
regexp:a_tipcell:10:any:"/tipcell\.com/i"
regexp:a_hotxxxstuff:10:any:"/hotxxxstuff\.com/i"
regexp:a_pochrist:10:any:"/thepassionofthechrist/i"
regexp:t_feelsad:10:title:"/This picture may make some of you feel sad/i"
regexp:a_winme:10:any:"/win-me\.biz/i"
regexp:a_pharmacy1010:10:any:"/pharmacy1010\.com/i"
regexp:a_picfury:10:any:"/picfury\.com/i"
regexp:a_mightybody:10:any:"/mightybody\.com/i"
regexp:a_winantispyware:10:any:"/winantispyware\.com/i"
regexp:a_systemdoctor:10:any:"/systemdoctor\.com/i"
regexp:a_rogalik:10:any:"/rogalik\.net/i"
regexp:a_aapurse:10:any:"/aapurse\.com/i"
regexp:a_freepay:10:any:"/freepay\.com/i"

##Casino
regexp:t_cardstud:10:title:"/online seven card stud/i"
regexp:t_888casino:10:title:"/888 Casino/i"
regexp:t_freeslots:10:title:"/free slots/i"
regexp:t_onlinepoker:10:title:"/online poker tournament/i"
regexp:t_videopoker:10:title:"/video poker/i"
regexp:t_pokerrooms:10:title:"/online poker rooms/i"
regexp:t_freeslots:10:title:"/free slots/i"
regexp:t_baccarat:10:title:"/baccarat/i"
regexp:t_online7:5:title:"/online seven card stud/i"
regexp:t_roulette:10:title:"/roulette/i"
regexp:a_888:10:any:"/888\.com/i"
regexp:a_ajcarvelli:10:any:"/ajcarvelli\.com/i"
regexp:a_7cardstud:10:any:"/seven card stud/i"
regexp:a_stud:5:any:"/stud/i"
regexp:a_baccarat:5:any:"/baccarat/i"
regexp:a_casino:5:any:"/casino/i"
regexp:a_online:5:any:"/online/i"
regexp:a_free:5:any:"/free/i"
regexp:a_slots:5:any:"/slots/i"
regexp:a_keno:5:any:"/keno/i"

#Phones
regexp:a_sidekick:3:any:"/sidekick/i"
regexp:a_nokia:3:any:"/nokia/i"
regexp:a_ericsson:3:any:"/ericsson/i"
regexp:a_motorola:3:any:"/motorola/i"
regexp:a_nextel:3:any:"/nextel/i"
regexp:a_kyocera:3:any:"/kyocera/i"

#computers
regexp:a_dell:3:any:"/dell/i"
regexp:a_alienware:3:any:"/alienware/i"
regexp:a_apple:3:any:"/apple/i"
regexp:a_ipod:3:any:"/ipod/i"
regexp:a_toshiba:3:any:"/toshiba/i"
regexp:a_vaio:3:any:"/vaio/i"
regexp:a_ibm:3:any:"/ibm/i"
regexp:a_acer:3:any:"/acer/i"

#consoles
regexp:a_xbox:3:any:"/xbox/i"
regexp:a_playstation:3:any:"/playstation/i"
regexp:a_playstation1:3:any:"/play station/i"

#pills
regexp:a_meds:10:any:"/meds/i"
regexp:a_pharmacy:10:any:"/pharmacy/i"
regexp:a_clickhere:5:any:"/click here/i"

Thanks for the nice mod, Ross

[manguish]

Awesome mod. Thanks.

[gopherhockey]

I'm running 3.6.0 and it does not work. Fails with the error others have posted:

Fatal error: Call to undefined function: sb_test() in /home/morcmtb/public_html/forums/includes/class_dm_threadpost.php(1549) : eval()'d code on line 2

This happens immediately when I try post a message using a test user.

This would be really nice if someone could find out why this happens.

So far all I have seen are people re-installing it or disabling then re-installing it. That did not work for me. Someone mentioned turning on moderation - not sure what they meant by that, we have some forums that have leaders, some do not - I have 4 users that are moderators in general.

I'd be careful of this until someone confirms why this is happening. UNINSTALLING

[bada_bing]

This looks really interesting .. Has anyone had any issues with it deleting legit posts by members?

[Kungfu]

Originally Posted by bada_bing

This looks really interesting .. Has anyone had any issues with it deleting legit posts by members?

it doesnt delete, it puts the post under moderation. Then you can make it post a new post in some forum that way you can check to see oh well this is under moderation. And then accept the post if it should be valid.

[ravi]

This modication is nice, installed on 3.6.1 and working great. Thank you UK Jimbo for this.
I have set spam buster to post a thread upon spam detection, it does post when spam is detected but forum counter not getting updated, may be a bug or something. I understand this is not meant for use on 3.6.1 but it helps me thank you. Any help in this direction would be nice thank you.

[gopherhockey]

Originally Posted by Kings

I've fixed the problem myself, by modifying the plugin so that it checks if the function exists, for example:

<phpcode><![CDATA[
    if (function_exists('sbhits') == true) {
        $GLOBALS['sbhits'] = sb_test($this);
    } else {
        $GLOBALS['sbhits'] = array();
    }                
]]></phpcode>

The plugin still seems to work, and I can use my moderation tools again. Hope this helps.

Where exactly did you put this bit of code? I still have the sb_test error and really want to use this hack.

It seems that something has been missed in this hack to watch for potential conflicts or other...?

[Kungfu]

how do you search for something but have an exception.

I want to be able to search for urls but exclude the urls within the forums.

Example:

It finds www.somespamsite.com and because it has www. it marks it as spam.

But how can you change it so if say someone does www.yourforumaddress.com/thread.... so if it has yourforumaddress in there it will just ignore it.