Anti-Spam Options - Hostname or Useragent Registration Ban

THIS ADD-ON IS NO LONGER AVAILABLE AND IS NOT SUPPORTED

This is an add-on that is designed with vBulletin 4.1.5. It may not work on earlier versions of vBulletin. It is known to be working on vB versions 3.8.7, 4.0.7 and 4.1.5 through 4.2.0. I don't know if it is compatable with all versions of vB or not.

On my site, I receive quite a few PMs asking me how I prevent spam from being posted there. While I can't release everything I use because some of it is server based (external from vBulletin), I can release one of the lines of defense that I use.

This mod allows you to ban Hostnames and Useragents from registering on your site.

If a hostname or useragent contains any of the words you specify and they are trying to register, they are presented with an error telling them they are forbidden from registering on your site. And no registration screen ever appears.

In the event the hostname is blank, a WHOIS can be performed to establish the identity of the system being used to register.

The 'External Content' pulled by this mod is only the WHOIS information when that is enabled.

WARNING: This mod has the potential of banning humans from registering. Choose what words you use carefully.

Personally, I am not very concerned about banning an occasional human from registering. So, from time to time my system may ban a human that uses an anonymous proxy.

NOTE: This mod has a 'Don't Ask, Don't Tell' clause. Please don't post telling people what words to ban. We don't need spammers getting around this mod by reading posts telling them what is being filtered.

REQUIREMENTS: In order for the WHOIS function used in this mod to work properly, your server must have OPENSSL installed.


* INSTALLATION *
---------------------
1) Upload the contents of the 'upload' folder to your forum's root.
(If your forum's location is http://www.example.com/forums/, the root is /forums/)

2) Import the product XML file (product-hostusercheck.xml) into the Product Manager in AdminCP.

3) Take some time to set the options in ACP->Settings->Options->Prevent Hostname or Useragent from Registering.

4) Be sure to turn on the mod when setting options in ACP->Settings->Options->Prevent Hostname or Useragent from Registering.



* History (Changelog) *
-----------------------------
1.0.3 (December 12, 2013)
- Fix hostname not being checked under certain circumstances.

1.0.2 (March 1, 2012)
- Fix error on registration page when Useragent or Hostname to ban is blank.

1.0.1 (February 24, 2012)
- Wrong hook being used for one of the plugins.

1.0.0 (January 22, 2012)
- Public Release

[nhawk]

Originally Posted by BadgerDog

PM's you with list, which is the one Ozz recommended...

Regards,
Doug

LOL, this one was simple.

It's blocked because 'tor' is in the list (monitor5.securi.net). So it did it's job.

In either case, securi.net has no business accessing register.php, so the add-on did it's job.

It didn't ban securi from accessing the site, it just stopped it from registering.

So, re-enable the add-on.

[Max Taxable]

Originally Posted by nhawk

LOL, this one was simple.

It's blocked because 'tor' is in the list (monitor5.securi.net). So it did it's job.

In either case, securi.net has no business accessing register.php, so the add-on did it's job.

It didn't ban securi from accessing the site, it just stopped it from registering.

So, re-enable the add-on.

And that is a oversight on my own part, since I compiled most of that list.

I'll be recommending "tor" be removed post haste. I think we have it covered with another definition anyway.

[BadgerDog]

Originally Posted by nhawk

LOL, this one was simple.

It's blocked because 'tor' is in the list (monitor5.securi.net). So it did it's job.

In either case, securi.net has no business accessing register.php, so the add-on did it's job.

It didn't ban securi from accessing the site, it just stopped it from registering.

So, re-enable the add-on.

Unfortunately, Sucuri needs to access out site as it's a primary security monitor and does complete server scans every 1/2 hour...

Regards,
Doug

[BadgerDog]

Originally Posted by Max Taxable

And that is a oversight on my own part, since I compiled most of that list.

I'll be recommending "tor" be removed post haste. I think we have it covered with another definition anyway.

Ok, I removed tor and have saved the mod and restarted it..

Thanks for all the help guys... :up:

Regards,
Doug

[nhawk]

Originally Posted by BadgerDog

Unfortunately, Sucuri needs to access out site as it's a primary security monitor and does complete server scans every 1/2 hour...

Regards,
Doug

It can access the site. The add-on doesn't stop that. It just threw an error to it saying it can't register.

[Max Taxable]

Originally Posted by BadgerDog

Unfortunately, Sucuri needs to access out site as it's a primary security monitor and does complete server scans every 1/2 hour...

Regards,
Doug

Once again... It does not and should not be trying to register. That is not part of its normal behavior.

[BadgerDog]

Originally Posted by nhawk

It can access the site. The add-on doesn't stop that. It just threw an error to it saying it can't register.

Roger that ... :up:

Thanks again...

Regards,
Doug

[lazytown]

Originally Posted by ozzy47

TBH, I would just turn off the PM's, once you know the mod is working after sending you some PM's, there is no need for them, you know it is working, so turn them off.

I prefer to keep logs, but a log with dozens of PMS a day is unmanageable. See ask the recent posts above for an example of why you'd would to keep a record so that you can search if later (sucuri being blocked).

[nhawk]

Originally Posted by lazytown

I prefer to keep logs, but a log with dozens of PMS a day is unmanageable. See ask the recent posts above for an example of why you'd would to keep a record so that you can search if later (sucuri being blocked).

Securi was not blocked from the site. Nobody is blocked from the site with this mod. Securi was blocked from registering. There's a big difference.

https://vborg.vbsupport.ru/showpost....7&postcount=86

[ozzy47]

Ok just a follow up on the Sucuri situation.

Sucuri will scan your site with several different user-agents (including the one you mentioned).
During this scan, the bot will crawl through all links found in the site, and looks like it's hitting the registration link.

Sucuri will not follow the robots.txt directives. Since it tries to behave as a "real user" it'll ignore that file. The only way to do it would be creating a .htaccess file to redirect SiteCheck to a 404 or a different page when hitting those forms.

So you can add tor back to the list if you wish, and add this to your htaccess file.

<Filesmatch "^(register)\.php$">
order allow,deny
allow from all
deny from 192.155.95.139
deny from 66.228.40.185
</Filesmatch>

That will stop Sucuri from hitting the registration trigger, and it is what they recommended to me.