Administrative and Maintenance Tools - Troll/ip-tracker, detect multiple accounts/trolls [3.6 compatible]

Continuosly information about updates can also be found here.

Edit 2007-08-07

Since the script needs to be rebuilt from scratch due to some problems with it, I've decided to temporarily stop the distribution. On larger sites, this script may cause heavy lagging when active. There has also been reports on "duplicate keys", that should be fixed. To prevent more problems cause by this hack, it's removed and cannot be downloaded.


History

In 2005 a forum was founded, for a short period of time that was intended to work as a service for people with a common interest - a reality show. The forum grew big and the traffic was very intensive. Moderators worked day and night to assist the forum. Traffic and events in the show made people show different kind of feelings and some of them showed this in strange ways. They said "I'd better register 10 nicknames, just to secure that noone can ban me". Sometimes, when they got banned, they registered new nicks and sometimes they switched ips but they didn't post anything the same day. Next day, they switched ip again and it suddenly got much harder to trace their nicks back to the start.

In 2006, the forum opened again (new season) and we was prepared for this. A script, specialized to trace trolls, was written and the main purpose was to trace things that vBulletin missed. This plugin was requested at the vBulletin forums.


Now, it's here, as a beta production - a trolltracker that stamps all visitors even if they don't post anything. It also, partially, checks if an ip-address can be traced from anonymous proxies by reading headers that proxies are sending to he server (HTTP_VIA and HTTP_X_FORWARDED_FOR).


Templates to change (Optional): 3


Attached

trolltracker-2.0.3beta.zip - the main archive with the tracker and extras
iptracker.php - A quickfix for the coming version 2.0.4 that changes the SHOW COLUMNS-behaviour-bug in the tracker


The archive

The zip should contain the following files

• The product, currently named product-trolltracker_beta.xml because of it's beta status
• iptracker.php, the tool that makes it easier to trace nicknames and ip's
• iptracker_search.php, htmlcode - the searchform that iptracker.php is using (old code that never used templates)
• trollpost.php, a quite slow script that imports ip's and usernames from the post-table to make it possible to trace older data. (If you run this over a web-interface, it might not work, because of timeouts --screendump--)

How to install

1. Copy *.php to your forumroot
2. Install the product code (choose overwrite if you're upgrading)
3. Check the configuration from your admincp (settings for usergroups that can run the iptracker.php is made from there)

Additional information


Track older ips (2.0.x)

If you want to import older posts, you can do that, but because of timeouts (and bad scripting) trollpost.php may timeout if you run the script from a web-browser. This part is, currently, unsupported, but if someone has any ideas here, feel free to notify me.

OPM Support

The ip-tracker supports RBL Monitor.


How to use it

Use the tracker by calling http://your-forum.com/iptracker.php


Database

The installation creates a table named user_troll for your forum.
The FQDN-support also adds a table called user_trollresolver for the resolver cache (like the one used in the OPM monitor)

Information and issues

• There is no version 1.x - that version was private (this is not an issue)
  
• It's still a beta, so bugs may still annoy us
  
• Testing on vBulletin 3.6.0 rc1: Works fine
• Importing posts with trollpost.php might give strange results if you are using the multiple account detector (AE): reports in forum that are posted with a specific userid makes it look like a troll is using other usernames too

To do

See CHANGELOG for full details


Show the tracker in navbar (v2.0.1+)

To show the tracker in the navbar (only for the admingroups that can be found in the options), edit your template 'navbar' and add this code where you want it to be shown:

 <if condition="$show['trolltracker']"><td class="vbmenu_control"><a href="iptracker.php">Trolltracker</a></td></if>

I chose to put it in the end of navbar, right after this code:

        <if condition="$show['member']">
<td class="vbmenu_control"><a href="login.php?$session[sessionurl]do=logout&amp;logouthash=$bbuserinfo[logouthash]" onclick="return log_out()">$vbphrase[log_out]</a></td>
        </if>

How to show trolls in the onlinelist

Edit template:
whosonlinebit

Find:
</tr>

Add above:

    <if condition="$show['trolldata'] AND $userinfo['trolldata'] != ''">
            <td class="alt1">
            $userinfo[trolldata]
            </td>
        </if>

Edit template:
WHOSONLINE

Find:

</tr>
$onlinebits

Add above:

    <if condition="$show['trolldata']">
            <td class="thead">
            <b>Trolldata</b>
            </td>
        </if>

Support, help, contact

Any questions, requests and bugreports can be sent to me by PM, mail or via threads at http://vbulletin.tornevall.net/


Don't forget to install this plugin

[49er]

I recieve this error also?

Database error in vBulletin 3.5.2:

Invalid SQL:
SHOW COLUMNS FROM user_troll WHERE field != 'username';

MySQL Error : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE field != 'username'' at line 1
Error Number : 1064
Date : Sunday, July 23rd 2006 @ 07:41:17 AM
Script : http://www.*****.com/forum/iptracker...ookupdeleted=1
Referrer : http://www.*****.com/forum/iptracker.php?self=1
IP Address : **.***.**.***
Username : ****
Classname : vb_database

[TMM-TT]

Originally Posted by sduckie2k5

to be a bother but I uninstalled the hack, the reinstalled it and tried again, this time, I am not marked as a troll but I still cant seem to get the same view you have in your screenshot with the delete button. I appear to be in the right area but theres missing text next to one of the check boxes and I cant delete even if I select the names then press the button. What am I doing wrong, it almost looks like part of the old version is still left behind? Thankyou in advance

Ahh, now I see.. The phrase for that function seem to be placed in the wrong product here, so when I exported it that one wasn't included.

There should be a troll_iptracker_deleteselected-phrase included to the hack but that was missing and the text I have added there looks like "Delete selected entries from database (immediately)". I can see in your screenie that there is a button, but with no text. That's the text that was missing and another miss by me..

Originally Posted by teepeg

I recieve this error also?

Database error in vBulletin 3.5.2:

Invalid SQL:
SHOW COLUMNS FROM user_troll WHERE field != 'username';

Try the fix here

[sduckie2k5]

No error but it still doesnt allow me to delete entries and the button still shows no text, sorry.

[aveon]

why do i always get atabase errors when i tried to search for the ip ad adresses and how can i make aoutoblacklist any help will be appriated thanx

[The Finman]

I installed this today and rotflmao when it said "No soup for you!, and you!, and you! :laugh:

Many thanks my friend!

[TMM-TT]

Originally Posted by aveon

why do i always get atabase errors when i tried to search for the ip ad adresses and how can i make aoutoblacklist any help will be appriated thanx

The autoblacklisting works together with the banlist. If you banned someone you can activate the blocking so the hack blocks all users that are trying to access the forum if they are matched with the banned user:

Automatically block banned users
Block banned users from forum (with deepscan), including they who's not logged in to the forum

... meaning that guests (not logged in users) also will be blocked on match with the banlist ...


You can also use the options for "specific users to block". If so, just enter the names or the userids you want to block if they reach a match of XX usernames (Controlled by the option Specific users trigger). This option only block chosen multiple usernames when they are trying to log in.

Originally Posted by aveon

why do i always get atabase errors when i tried to search for the ip ad adresses and how can i make aoutoblacklist any help will be appriated thanx

Have you tried the fix, or is there another errors?

Originally Posted by The Finman

I installed this today and rotflmao when it said "No soup for you!, and you!, and you!

That's the other hack - AE Multiple Login Detection.

[aveon]

yea great man fix worked for me but can you tel me how to create a black list you mean is it the list on the vbulletin options>user banning options i really need help on this

[TMM-TT]

Originally Posted by aveon

yea great man fix worked for me but can you tel me how to create a black list you mean is it the list on the vbulletin options>user banning options i really need help on this

No, the tracker use it's own "blacklist"..
For example, if the tracker works as it should:

1. Joe is banned
2. The tracker see that Joe is banned and blocks him from the forum
3. Joe try to log out by cleaning up the cookies
4. The tracker compares the ip to the banlist and see that there is a guest using Joes ip.. He gets blocked as guest also
5. Three days later, Joes ip is changed and he can log in as a guest again. He knows that hes banned so he use another nickname instead, that he registered after 'Joe'. He logs in as 'Jim'
6. The tracker checks the database and find that Joe is linked to Jim
7. The tracker checks with the userban-list and find that Joe is banned
8. Jim, Joe and the new ip is now locked out

The blacklisting option means that if any guest is matched with a banned user the ip will be blocked from the forum even before login. If 'Jim' is a shared "troll"-account this also means that all users logged in as Jim, will be locked out of the forum because Joe is linked to the same nick - and banned.

The blacklist in options->userbanning only stops specific ip-addresses, which means that if Joe goes to his parents he's able to see the forum as a guest (until he tries to login as Joe again). If you use the built-in blacklist and using parts of the ip the risk is that you ban a bunch of other users that is using the same subnet.

[87accordlxi]

Jumping back to this picture. What else is missing here? There's a checkbox that is missing text on my installation too. I manually added the troll_iptracker_deleteselected phrase mentioned on the previous page, and that fixed the delete button text.

[TMM-TT]

Originally Posted by 87accordlxi

Jumping back to this picture. What else is missing here? There's a checkbox that is missing text on my installation too. I manually added the troll_iptracker_deleteselected phrase mentioned on the previous page, and that fixed the delete button text.

Ouch! Another one?

Phrase: troll_search_RBL
Text: Check RBL-Database (Open Proxy)


The two reported phrases should be fixed in next version. Sorry for the misses...