Miscellaneous Hacks - Check Proxy RBL on New User Registration.

Check Proxy RBL on New User Registration Version 4.1

Version 4.1 includes remains unchanged from version 4.0 with the exception of a code fix to deal with an SQL injection security hole in the code.

What does this hack do?

Hooking in at register_addmember_process and register_addmember_complete this hack compares the IP address of the person registering with the Realtime Block List(s) of your choice. Based on your configuration the RBL Checker will then perform one of these actions:

1. Nothing, the registration continues as normal.
2. Registration continues as normal, but the user is automatically moved into the "Pending Moderation" group of your choice.
3. Registration continues as normal, but the user is automatically permanently banned.
4. Registration is blocked, an error message is displayed to the user.

Please Note: It is strongly recommended that you configure PM or Thread based notification so that you may monitor registrations that are from IPs that are a positive hit on the RBL. Especially if you configure the checker to allow registrations to complete normally.

These options are configurable in AdminCP > Options > DM-RBL Check on Registration.


Why Block Proxies?

Banned and Spammers users often get around IP bans by simply using an open proxy - of which there are thousands - to get around the IP ban. Very few legitimate users slow their surfing by using an anonymous proxy.


How do you Install?

1. Create a user from which PMs, Posts, etc. will be generated.
2. In your adminCP obtain values for the "banned" and "pending moderation" groupIDs (Defaults are 8 and 4).
3. Install the attached product.

IMPORTANT NOTE:You must specify a username if you plan on configuring the AUTOBAN or NOTIFICATION options. Otherwise you WILL get errors.


What is the default config?
By default the RBLChecker will check the IP of a new registration, allow registration to complete, but add the new user to the "COPPA Members Awaiting Moderation" usergroup. You can then approve/reject those members depending on whether you think they are/aren't spammers/trolls.

You can modify the settings in the AdminCP to Ban or Block as you like.


Hack History:

Version 4.1
- Fixed SQL Injection security hole.
- Fixed some minor typos in automatically generated messages.

Version 4.0
- Added ability to specify error reported on blocks.
- Added ability to specify ban reason and custom title.
- Added ability to move users to "pending moderation" group if registration is allowed.
- Updated list of RBLs checked based on testing with lists of "anonymous" proxies.
- Fixed IP address of Notification Posts equalling IP of blocked user. (Now Notification IP = 1.2.3.4)

Version 3.2
- Fixed typo causing blocked registrations to be reported as allowed.

Version 3.1
- change in variable name in v3.0 broke RBL checking. Corrected error.
- match notification now includes the name of the RBL that matches the IP.

Version 3.0
- plugin now fires at "register_addmember_process" allowing the user to completely fill in the form.
- Added the ability to specify more than one RBL.
- Added option to specify whether registration is blocked or allowed to complete.
- Added option to automatically ban registrations that are allowed to complete but have a positive IP match.
- Added option to specify user who is "notifier".
- Added option to specify a forum where a notification thread will be created.
- Added option to supress notification PM / Thread when an IP matches blacklist or known proxy list.
- Added customized error codes for notifications - notification now indicates whether a registration IP has matched the RBL, blacklist, or predefined list of anonymizers.
- Reworded Phrases.
- Removed 10.x.x.x IP from known proxy/anonymizer list.

version 2.0
- Added configuration options under vboptions > DM-RBL Check on Registration.
- Added PM on Block.
- Added option to select RBL.
- Added Custom Whitelist.
- Added Custom Blacklist.
- Added list of free proxies.
- Changed default RBL to sbl-xbl.spamhaus.org
- Added option to enable/disable checking.

version 1.0
- added plugin to check against opm.tornevall.org
- added custom phrase to be reported as error on registration start.


Using this Hack?
If you install this hack please click "Installed" to receive updates.

If you find this hack useful you can always hit that paypal button too...

[sinisterpain]

Originally Posted by Tom1234

I seem to be getting about 5 new threads created on each RBL match. I can't tell if the person registering is somehow looping through the registration process multiple times (like maybe they didn't enter all the required information and had to re-enter the form) or if it's a bug. They really shouldn't keep registering since I have it set to allow the registration attempt on RBL match. Since the timestamp of the posts often span a few minutes time, I suspect it is not a bug with this product.

Anyone else seeing this?

The only thing I have seen is some people trying to register with a bogus email which they do often. Vbulletin will not allow this so they may try different emails. Just a thought

[Tom1234]

It turns out that the reason I am seeing multiple threads created on an RBL match is because they are being denied registration even though I have "Allow Registration from IPs on RBL" set to YES. I would like the registration to be successful.

Looks like a bug.

[DaNIEL MeNTED]

Originally Posted by Tom1234

It turns out that the reason I am seeing multiple threads created on an RBL match is because they are being denied registration even though I have "Allow Registration from IPs on RBL" set to YES. I would like the registration to be successful.

Looks like a bug.

Do you have the latest version installed?

[Tom1234]

Yes, version 3.2

[Code Monkey]

You guys ever come to a definitive conclusion on which proxy lists to use?

[Code Monkey]

One thing I noticed. If you have this post in a forum. Then the poster shows as having posted using the IP that was denied. Which is undesirable to say the least.

[sinisterpain]

Originally Posted by Code Monkey

You guys ever come to a definitive conclusion on which proxy lists to use?

I use the three mentioned a few threads back

[DaNIEL MeNTED]

Originally Posted by Code Monkey

One thing I noticed. If you have this post in a forum. Then the poster shows as having posted using the IP that was denied. Which is undesirable to say the least.

Ha... you know I just noticed that today. I'll take a look at the code this weekend.

Does anyone have any "feature requests".

[Corporal Clegg]

Daniel,

First off, thank you very much for this hack. I installed it on my boards recently and when I had "open" registrations, it caught over 50 people trying to register with open proxies. I followed the advice of another poster to this thread and I am NOT using any of the RBL's that include spammers. I'm using the following RBL's, in the following order:

proxies.dnsbl.sorbs.net
tor.ahbl.org
ircbl.ahbl.org
opm.tornevall.org
list.dsbl.org

I have found that about 90% of the open proxy IP's are being caught by list.dsbl.org

One thing I was wondering, I have the hack set to allow rbl ip's to complete the registration, then ban those users to a group I created specifically for this hack. I tried it myself and the "error message" I got, was:

"You have been banned for the following reason:

Date the ban will be lifted:
Never"

As you can see, no reason is given for why the user is being banned.

Is there a way to make it so that when a user registers with a "banned" RBL IP, it would give a user defined reason, such as "registering via an Open Proxy IP"?

I checked the vbulletin phrases and I'm guessing it uses the $vbphrase[nopermission_banned] variable.

Is there any way I can add a "reason" to that and have it display in conjuction with the RBL hack? I've gotten a few angry emails and I think it's because the people saw they were banned after registering, but it gave them no reason.

Any ideas on how to adjust that? I hope you can see what I'm talking about here. I'm fairly good at tweaking vbulletin the way I like it, but having a specific reason for this hack show up in the error message has me stumped.

Thank you again for an excellent hack and if there's any more info you need from me about this, please ask.

Corporal Clegg

[Stanley Steamer]

This is my first kill.

ALERT!

Someone has tried to register using the IP Address 85.140.236.169 which is MATCHED IN THE RBL DATABASE of the sbl-xbl.spamhaus.org RBL.

This registration attempt has been allowed.

Registration Details: Very-old-gibon ( very_old_gibon@cashette.com )

I have a question. I received the PM from the program with this alert, but it was also supposed to post it in a hidden forum for the moderators.
Can this send the message to PM's and a forum, or just one or the other?
Do I use the full url of the forum or do I just write in the forum name and the ID number?