Administrative and Maintenance Tools - Troll/ip-tracker, detect multiple accounts/trolls [3.6 compatible]

Continuosly information about updates can also be found here.

Edit 2007-08-07

Since the script needs to be rebuilt from scratch due to some problems with it, I've decided to temporarily stop the distribution. On larger sites, this script may cause heavy lagging when active. There has also been reports on "duplicate keys", that should be fixed. To prevent more problems cause by this hack, it's removed and cannot be downloaded.


History

In 2005 a forum was founded, for a short period of time that was intended to work as a service for people with a common interest - a reality show. The forum grew big and the traffic was very intensive. Moderators worked day and night to assist the forum. Traffic and events in the show made people show different kind of feelings and some of them showed this in strange ways. They said "I'd better register 10 nicknames, just to secure that noone can ban me". Sometimes, when they got banned, they registered new nicks and sometimes they switched ips but they didn't post anything the same day. Next day, they switched ip again and it suddenly got much harder to trace their nicks back to the start.

In 2006, the forum opened again (new season) and we was prepared for this. A script, specialized to trace trolls, was written and the main purpose was to trace things that vBulletin missed. This plugin was requested at the vBulletin forums.


Now, it's here, as a beta production - a trolltracker that stamps all visitors even if they don't post anything. It also, partially, checks if an ip-address can be traced from anonymous proxies by reading headers that proxies are sending to he server (HTTP_VIA and HTTP_X_FORWARDED_FOR).


Templates to change (Optional): 3


Attached

trolltracker-2.0.3beta.zip - the main archive with the tracker and extras
iptracker.php - A quickfix for the coming version 2.0.4 that changes the SHOW COLUMNS-behaviour-bug in the tracker


The archive

The zip should contain the following files

• The product, currently named product-trolltracker_beta.xml because of it's beta status
• iptracker.php, the tool that makes it easier to trace nicknames and ip's
• iptracker_search.php, htmlcode - the searchform that iptracker.php is using (old code that never used templates)
• trollpost.php, a quite slow script that imports ip's and usernames from the post-table to make it possible to trace older data. (If you run this over a web-interface, it might not work, because of timeouts --screendump--)

How to install

1. Copy *.php to your forumroot
2. Install the product code (choose overwrite if you're upgrading)
3. Check the configuration from your admincp (settings for usergroups that can run the iptracker.php is made from there)

Additional information


Track older ips (2.0.x)

If you want to import older posts, you can do that, but because of timeouts (and bad scripting) trollpost.php may timeout if you run the script from a web-browser. This part is, currently, unsupported, but if someone has any ideas here, feel free to notify me.

OPM Support

The ip-tracker supports RBL Monitor.


How to use it

Use the tracker by calling http://your-forum.com/iptracker.php


Database

The installation creates a table named user_troll for your forum.
The FQDN-support also adds a table called user_trollresolver for the resolver cache (like the one used in the OPM monitor)

Information and issues

• There is no version 1.x - that version was private (this is not an issue)
  
• It's still a beta, so bugs may still annoy us
  
• Testing on vBulletin 3.6.0 rc1: Works fine
• Importing posts with trollpost.php might give strange results if you are using the multiple account detector (AE): reports in forum that are posted with a specific userid makes it look like a troll is using other usernames too

To do

See CHANGELOG for full details


Show the tracker in navbar (v2.0.1+)

To show the tracker in the navbar (only for the admingroups that can be found in the options), edit your template 'navbar' and add this code where you want it to be shown:

 <if condition="$show['trolltracker']"><td class="vbmenu_control"><a href="iptracker.php">Trolltracker</a></td></if>

I chose to put it in the end of navbar, right after this code:

        <if condition="$show['member']">
<td class="vbmenu_control"><a href="login.php?$session[sessionurl]do=logout&amp;logouthash=$bbuserinfo[logouthash]" onclick="return log_out()">$vbphrase[log_out]</a></td>
        </if>

How to show trolls in the onlinelist

Edit template:
whosonlinebit

Find:
</tr>

Add above:

    <if condition="$show['trolldata'] AND $userinfo['trolldata'] != ''">
            <td class="alt1">
            $userinfo[trolldata]
            </td>
        </if>

Edit template:
WHOSONLINE

Find:

</tr>
$onlinebits

Add above:

    <if condition="$show['trolldata']">
            <td class="thead">
            <b>Trolldata</b>
            </td>
        </if>

Support, help, contact

Any questions, requests and bugreports can be sent to me by PM, mail or via threads at http://vbulletin.tornevall.net/


Don't forget to install this plugin

[TMM-TT]

Originally Posted by Alfa1

Many thanks.

Can you please add a small explanation of the functions. I am confused with this:
When I enter a username, select resolve IP address, the tracker finds an amount of entries, but does not display them.

How do you mean with does not display? Do you have any screenshot to show as an example?

[bada_bing]

I currently have another duplicate account tracker called dual account tracker that was coded from someones on this site but really like the functions of this hack better. Any issues with running both?

[Alfa1]

I mean that the page does not display the entries of the member, but does display how many entries there are.
I have to add that I did not upload the trollpost.php as i do not want to import IP's from older posts. I also did not upload the changelog, as I have no clue what this is for. I did not see any instructions about what to do with this.

[TMM-TT]

Originally Posted by bada_bing

I currently have another duplicate account tracker called dual account tracker that was coded from someones on this site but really like the functions of this hack better. Any issues with running both?

Is it the hack called AE Multiple Login Detector? In that case - I use both.

Originally Posted by Alfa1

I mean that the page does not display the entries of the member, but does display how many entries there are.

Ahh, the amount it shows is the total amount of registered usernames/ip the database has registered since the install. Maybe the nickname you're looking for hasn't been "catched" yet?

Originally Posted by Alfa1

I also did not upload the changelog, as I have no clue what this is for. I did not see any instructions about what to do with this.

Changelog is just a textfile with a list of bugfixes/changes made to the tracker and a to do-list.

[Alfa1]

Originally Posted by TMM-TT

Ahh, the amount it shows is the total amount of registered usernames/ip the database has registered since the install. Maybe the nickname you're looking for hasn't been "catched" yet?

Yes, it has. I have looked this member up many times before the upgrade. But it seems like all data was lost on the upgrade and now the tracker has started again with adding entries. To bad, but no disaster.

On another note:
What would really help my moderators solving the double accounts is; In the post which warns for multiuser accounts

1. get the usernames linked to the profile like the AE detector does.
2. have the IP address which connects the two member accounts listed in the post
3. include both usernames in the topic title of the post

Any chance on this?

[Alfa1]

Because it is very important to know wether the user is on dial up/proxy or not, it would be handy to see how many other IP's have been used by the member. If these are a lot, then it is reasonably sagfe to assume that it concerns a proxy/dial up and is not the same member.
I'd like to request in the post:

4. amount of IP's used.
5. link for admin to the iptracker results for the found user.

[TMM-TT]

Your requests can be fixed, yes.

The first one - act like AE does - is already added, by the way.


I'm also thinking of making ipv6-support to the ipaddress field (by just changing the max lenthg of that field) since I use ipv6 myself.

[Alfa1]

The IP tracker gives us many reports about members on the same proxy (like AOL and such). How do I prevent the tracker from listing members on proxy?

[TMM-TT]

Originally Posted by Alfa1

The IP tracker gives us many reports about members on the same proxy (like AOL and such). How do I prevent the tracker from listing members on proxy?

If you use the tracker together with the OPM-hack theres an option called "Ignore OPM-users" you can use. Described:

If the OPM-monitor is installed, use this option to avoid register users using proxies (Keeping track of users that using multiple accounts from anonymous proxies might give unreliable results in the tracker). OPM Monitor is required for this option

[redspider]

I getting this error did I miss something?:

Database error in vBulletin 3.5.4:

Invalid SQL:
SELECT user1.username AS un1,user2.username as un2,user1.realip,user2.realip,user1.fqdn,user1.deleted,user1.imported,user2.deleted,user1.userid,user2.userid
FROM user_troll AS user1
LEFT JOIN user_troll AS user2
ON user2.realip = user1.realip 
WHERE user1.fqdn = 0
AND user1.deleted = 0
AND user2.deleted = 0
AND user1.userid > 0
AND user2.userid > 0

AND ();

MySQL Error  : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 11
Error Number : 1064
Date         : Monday, September 25th 2006 @ 06:22:33 PM
Script       : http://www.domaincom/forums/iptracker.php?q=&depth=&q_t=username&resolver=true&opm=1&Submit=Ask
Referrer     : 
IP Address   : xx.xxx.66.1
Username     : Unregistered
Classname    : vb_database