Simple Machines Community Forum

Customizing SMF => Modifications and Packages => Topic started by: butchs on April 12, 2010, 05:23:56 PM

Title: Bad Behavior for SMF mod
Post by: butchs on April 12, 2010, 05:23:56 PM
Link to Mod (https://custom.simplemachines.org/mods/index.php?mod=2502)

Bad Behavior Mod
PHP-based solution for blocking link spam and robots
The Web's premier link spam killer



Written by:                   butchs (http://www.simplemachines.org/community/index.php?action=profile;u=77887)
Current BB version:      2.2.20
Compatibility:               SMF 1.1.21 & SMF 2.0.15
Supported languages: (http://www.simplemachines.org/site_images/lang/english.gif) english, (http://www.simplemachines.org/site_images/lang/spanish_es.gif) spanish_es, (http://www.simplemachines.org/site_images/lang/spanish_es.gif) spanish_es-utf8, (http://www.simplemachines.org/site_images/lang/spanish_latin.gif) spanish_latin, (http://www.simplemachines.org/site_images/lang/italian.gif) italian, (http://www.simplemachines.org/site_images/lang/italian.gif) italian_utf8
Translations:                Translations are accepted

Donations accepted to help support this mod (please specify the name of the mod when donating).
(https://www.paypal.com/en_US/i/btn/btn_donate_LG.gif) (https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=UJTMMF8FKGLZ6&lc=US&item_name=butchs%2f%20continued%20updates&currency_code=USD&bn=PP%2dDonationsBF%3abtn_donateCC_LG%2egif%3aNonHosted)


SMF integration for Bad Behavior / Bad Behaviour (http://bad-behavior.ioerror.us/).  Which is a PHP-based solution for blocking link spam and the robots which deliver it.

The mod includes plenty information in the help icons.  Just click on the (http://www.simplemachines.org/community/Themes/default/images/helptopics.gif) icons.

Standard option information is located at the core bad-behavior (http://bad-behavior.ioerror.us/) site.

This is the first implementation of Bad Behavior / Bad Behaviour for one of the major forum platforms.  This port has more features than the Core and most Ports on the internet.  It has taken many hours of hard work to create this mod.  I sure hope that the fruits of my labor reduces spammery on your SMF forum!

Sincerely,
butchs (http://www.simplemachines.org/community/index.php?action=profile;u=77887)


To test:
To insure that Bad Behavior is functioning correctly you can add the sting "Bad Behavior Test" to the User Agent (UA) of a HTTP request from someone who is not in the whitelist and is not the administrator.

If you look at the page source (just below the title) you will see the speed of this mod at work:  <!-- Bad Behavior 2.2.17 run time: 3.025 ms -->


Bad Behavior / Bad Behaviour icons for your front page:
Show everyone that you have taken the care to protect your forum from spammery:

(http://www.simplemachines.org/community/index.php?action=dlattach;topic=375980.0;attach=204000)
Code: [Select]
<p><a href="http://www.bad-behavior.ioerror.us/">
<img src="http://www.yoursite.com/bad-behavior-80x15.png"
alt="Bad Behavior" height="15" width="80" /></a></p>>

Please copy the above master image to your site and adjust only the image link.  Let the bad bots come to Bad Behavior.


How Bad Behavior Works:
Bad Behavior complements other link spam solutions by acting as a gatekeeper, preventing spammers from ever delivering their junk, and in many cases, from ever reading your site in the first place. This keeps your sites load down, makes your site logs cleaner, and can help prevent denial of service conditions caused by spammers.

Bad Behavior manages to block nearly all link spam without ever looking at the spam. While it might be useful to do so, for performance reasons, Bad Behavior does not analyze received spam. Ive found that this way lies madness; spammers are constantly buying new domain names, so its possible to miss a lot of spam by looking at it.

Instead, Bad Behavior pioneered an HTTP fingerprinting approach. Instead of looking at the spam, we look at the spammer. Bad Behavior analyzes the HTTP headers, IP address, and other metadata regarding the request to determine if it is spammy or malicious. This approach has proved, as one user said, shockingly effective. After all, spammers write their bots on the cheap, and have little incentive to code very well. If they could code very well, they probably wouldnt be spammers.

When Bad Behavior looks at a request, it determines if the request matches a profile of known malicious or spammy activity, and falls outside the bounds of a normal human browsing the web. If so, the request is blocked. But a way out is provided for any human beings with unusual configurations or viruses/Trojans on their computer who may be blocked.

From the start, Bad Behavior has had two overriding design requirements. The first is that it must be fast. Users will get annoyed by waiting around for their traffic to be screened for spammery.  Bad Behaviors run time, which is typically measured in milliseconds, and can be cut to hundreds of microseconds for very high traffic sites.

The second requirement is that it must block as few legitimate users as possible, and when one is blocked, they must be able to unblock themselves through an action simple and fast enough that they can simply hit the browsers reload button once theyve completed the action.

INSTALLATION:

Please look at all the preview images on the mod (http://custom.simplemachines.org/mods/index.php?mod=2502) page.

Adjust settings before you enable the mod.
(Mod will disable it's self when uninstalled)

Check all the options that are "Recommended" in "Bad Behavior Admin/ SETTINGS".

Whitelist all your regular members.  Read "WHITELIST MEMBERS HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3403306#msg3403306)" for details.

- - - - - - - - - - - - - - - - - - - - - - - OPTIONAL httpBL - - - - - - - - - - - - - - - - - - - - - - -
The core of the mod protects your site even if httpBL is not enabled.  It is recommended to increase protection by adding httpBL.

httpBL procedure:
Register your site at ProjectHoneyPot (http://www.projecthoneypot.org/faq.php#b).
Get the access key at ProjectHoneyPot (http://www.projecthoneypot.org/faq.php#g).
Add an OPTIONAL honey pot script for your site.
Copy the OPTIONAL honey pot  (http://www.projecthoneypot.org/manage_honey_pots.php) script to your site (the same location as the SMF folder).
Activate the OPTIONAL honey pot (http:// www.projecthoneypot.org/manage_honey_pots.php) script and confirm it is active.

Copy over the HoneyPot information in the "Bad Behavior Admin/ SETTINGS/ Project Honey Pot HTTP Blacklist" area:
•   http:BL Access Key - Access Keys are 12-alpha characters (no numbers). They are lower-case. You should copy the Access Key exactly as it appears at the Project Honey Pot network (http://www.projecthoneypot.org/httpbl_configure.php).
•   Minimum Threat Level - 25
•   Maximum Age of Data - 30
•   Honeypot Link - The link to the OPTIONAL honey pot Script Location or a QuickLink (http://www.projecthoneypot.org/manage_quicklink.php).
•   Honeypot Link word - A word you make up.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - OPTIONAL CloudFlare - - - - - - - - - - - - - - - - - - - - - - -
If you are successfully using CloudFlare:  Enter "Cf-Connecting-Ip" in "IP call to Reverse Proxy" and check "Enable Reverse Proxy".

THIS MOD ASSUMES THAT YOU MADE MODIFICATIONS TO SMF SUCH THAT CLOUDFLARE IS OPERATIONAL ON YOUR SITE.  See the Cloudflare mod here (http://www.simplemachines.org/community/index.php?topic=391926.msg2726085#msg2726085).
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - OPTIONAL Admin Choice - - - - - - - - - - - - - - - - - - - - - - -
Administrators are automatically whitelisted by the mod.  If you are paranoid, you can make the these changes.

Enter your personal admin IP address or CIDR range "Bad Behavior Admin/ SETTINGS/ Whitelist/ IP Address".  For more information read "ADVANCED WHITELIST HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023)".
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Check "Enable Bad Behavior".


FAQs:
•   WHITELIST MEMBERS HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3403306#msg3403306)
•   ADVANCED WHITELIST HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023)
•   USING OpenID HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3152400;topicseen#msg3152400)
•   USING PAYPAL HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3152326;topicseen#msg3152326)
•   SUSPICIOUS BBC TAG HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3122889;topicseen#msg3122889) and a follow-up (http://www.simplemachines.org/community/index.php?topic=375980.msg3873456#msg3873456) - Only for SMF 2.0 Gold.
•   UPGRADING FROM AN OLDER VERSION HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3478178#msg3478178).
•   MANY BOT HITS A WEEK (http://www.simplemachines.org/community/index.php?topic=375980.msg3565493#msg3565493)
•   RANDOM CHARACTERS ABOVE FORUM HEADER (http://www.simplemachines.org/community/index.php?topic=375980.msg3499684;topicseen#msg3499684)


Version History:
1.0.0 --  March 23, 2010
o   -  Initial release for SMF 2.0 RC2 & RC3 default theme only. Compatible with BB 2.1.2.
1.1.0 --  August 4, 2010
o   -  New compatibility with BB 2.1.4:  Added CloudFlare compatibility and one nasty anti-Forum program to the ban list.  This version requires updates of both part 1 and part 2.
1.1.1 --  August 7, 2010
o   -  An error was discovered in the "whitelist.ini" file.  Anyone who downloaded "bad_behavior_install_pt1of2.zip" between August 4, 2010 and August 7, 2010, who used the "whitelist.ini" file from "bad_behavior_install_pt1of2.zip" please download this new "bad_behavior_install_pt1of2.zip" version.
1.2.0 -- August 8, 2010
o   -  "whitelist.ini" file has been re-written.  It is suggested that all users review and modify this file.  New compatibility with BB 2.1.5:  Fixed CloudFlare compatibility. MSN bot and ereg errors fixed in core.  All users should upgrade your "whitelist.ini" file.  This version requires updates of both part 1 and part 2.  Backup your "whitelist.ini" before upgrading.
1.3.0 --  November 6, 2010
o   -   Now compatible with SMF 2.0 RC4.  Improved roundtripdns and cache.  Added yahoo check (will temporarily reports error as msnbot - waiting for BB to catch up), auto purge of BB cache.  Removed cloudflare check due to DNS issues at cloudflare.  Fixed RC4 bugs in admin area that prevented saving and displaying of detailed reports.  Mod now has its own cache, it no longer requires SMF caching to be enabled.
1.4.0 -- February 20, 2011
o  - Mod Rewrite. Big thanks to BigGuy at SMFHelper (http://www.smfhelper.info/) for testing.  Mod is compatible with SMF 1.1.x, SMF 1.1.x Bugs fixed, detected by ac19189 & packman.  No changes for 2.0 RCx, Spanish Translation(s) - thanks xaquin (http://www.simplemachines.org/community/index.php?action=profile;u=246023), Added Project Honeypot to admin panel, blank UA can  be blocked.  Spanish language files now auto load, Changes for mod_security compatibility - thanks Darkness*, Update Bad Behavior core to 2.1.12, Fix for Undefined index: id_group & description of error link (thanks Dmytro) in 1.1.x.  - Bad Behavior core to 2.1.13
1.5.0 - June 05, 2011
o 1.5.0  - Added random Google safe honeypot, httpBL suspicious visitors are now logged.
o 1.5.1 - June 18, 2011 - badbehavior_httpblnote error in 1.1.x(djkimmel), 'http_headers' can't have a default value 2.0 & 1.1x(evanoliver), updated core.inc.php & blackhole.inc.php.
o 1.5.2 - July 10, 2011 - Can't have a default valueFile (evanoliver), added httpBL on/off line & API key check, improved whitelist.
o 1.5.3 - July 25, 2011 - Fixed rare error with Cloudflare Server, added suspicious BBC for SMF 2.0 ONLY, limited front page honeypots
o 1.5.4 - August 4, 2011 - Fixed integration bug thanks mediaworksmt, Completed http:BL & BB installation validation, Bad Behavior 2.1.14 update
o 1.5.5 - September 19, 2011 - Upgrade to 2.0.1, File-access disabled fixed for some servers (jbw-creA2s), improved map trap
o 1.5.6 - October 21, 2011 - 1.1.x db errors fix, updated core to 2.1.15
o 1.5.7 - December 16, 2011 - Anti-bot security fixes, all users should upgrade to this version.
o 1.5.8 - February 4, 2012 - Updated core to 2.2.1.
o 1.5.9 - March 11, 2012 - Revamped reverse proxy, Upgrade to 2.2.2.
o 1.5.10 - May 27, 2012 - Added Lazybones badbehavior_bbc.gif, Upgrade to 2.2.6, improved reverse proxy address, moved whitelist to admin, updated Spanish by xaquin
o 1.5.11 - June 24, 2012 - Upgrade to 2.2.7, text corrections a bug fix
o 1.5.12 - September 3, 2012 - Upgrade to 2.2.9
o 1.5.13- September 3, 2012 - Added IP sort & username for SMF 2.x only, Upgrade to 2.2.11
o 1.5.14 - December 9, 2012 - Improved TESTING, Removed badbehavior_log_table modsetting, Upgrade to 2.2.12
o 1.5.15 - December 13, 2012 - Upgrade to 2.2.13
o 1.5.16 - May 5, 2013 - revised mysql, honeypot link height thanks RustyBarnacle, Upgrade to 2.2.14, updated httpbl search engines
o 1.5.17 - June 30, 2013 - SMF 1.1.X ONLY -  fixed undefined variable- thanks chrishicks
o 1.5.18 - January 25, 2014 - Upgrade to 2.2.15, Search Engine DNS updated, minor changes installDB
o 1.5.19 - December 27, 2015 - Upgrade to 2.2.17, changed SPAM traps, improved cache
o 1.5.20 - December 31, 2017 - Upgrade to 2.2.20, fixed $bballotted error, added italian, updated readme files
o 1.5.21 - February 5, 2018 - Removed carriage return in BadBehavior-SMF

Terms of use


By downloading and/or using this MOD you agree to adhere to the following conditions for all versions of the Bad Behavior mod:




mod bad-behavior

Antes de instalar este mod, establezca su zona horaria local en el archivo .htaccess o php.ini.

Como hacerlo en .htaccess:
Code: [Select]
#Establecer zona horaria
SetEnv TZ Europe/Madrid

Una lista de ubicaciones para que pueda elegir:
http://www.php.net/manual/en/timezones.php (http://www.php.net/manual/en/timezones.php)



En la instalaci√≥n en SMF 2.0x o posterior, SMF puede preguntarle si desea "Restaurar permisos de archivo" para  "banned.inc.php"..  No realice ning√∫n cambio!


Para probar:
Para asegurarse que Bad Behavior funciona correctamente puede agregar la cadena "Bad Behavior Test" al agente de usuario (User Agent) de una petición HTTP realizada por alguien que no conste en la lista de autorizados y no sea el administrador.


En el código fuente de la página (justo después del título) se puede ver la velocidad de trabajo de este mod:
<!-- Bad Behavior 2.2.17 run time: 3.025 ms -->




bad-behavior mod

Prima di installare la Mod assicurati che la tua Timezone locale sia impostata nel file .htaccess o php.ini.

Come configurarla nel file .htaccess:
Code: [Select]
#Set the timezone
SetEnv TZ America/New_York

Qui una lista di valori tra cui poter scegliere:
http://www.php.net/manual/en/timezones.php (http://www.php.net/manual/en/timezones.php)



Durante l'installazione di SMF 2.0x e/o successivamente, SMF potrebbe chiedere di During installation of SMF 2.0x and or at a later date, SMF may ask to "Restore File Permissions" for "banned.inc.php".  Do not make any changes!


Per verificare il funzionamento:
Per assicurarsi che Bad Behavior funzioni correttamente puoi aggiungere la stringa "Bad Behavior test" allo User Agent (UA) di una richiesta HTTP proveniente da un utente che non è nella Whitelist e non è l'Amministratore.

Se guardi il sorgente della pagina (subito sotto al titolo) potrai vedere la velocità di questa Mod:  <!-- Bad Behavior 2.2.17 run time: 3.025 ms -->
Title: Re: Bad Behavior mod
Post by: flapjack on April 12, 2010, 06:07:47 PM
finally it's approved :) good job!
Title: Re: Bad Behavior mod
Post by: butchs on April 12, 2010, 08:00:05 PM
Thank you.   It was the easiest mod approval I had to date.  I must be improving.   :D
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on April 13, 2010, 09:33:15 PM
I noticed that many people are downloading just the mod.  Please note that this mod is a 2 part mod.  Yea it is unusual but that is what we need to do.  You first need to run the install then the mod.  Otherwise it will not work.  See the first post for more details.
 :o
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: flapjack on April 14, 2010, 06:29:25 PM
aaargh, yes I forgot to ping you about this. any particular reason why you didn't pack all stuff into one file, just out of curiosity? I have a feeling that most feedback you will be getting will be because somebody didn't read mod's info... ;)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on April 14, 2010, 06:47:18 PM
I prefer to keep them apart for the following reasons:

For more details please read the installation and update portions of the readme and the SMF readme.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: flapjack on April 14, 2010, 07:03:29 PM
I'm just saying... ;)

did you think about automatic download of the core files from within your mod? this way you don't have to distribute two files, people won't scream at you, and it's an easy way to keep the core files up to date
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on April 14, 2010, 10:33:49 PM
I know but, Dude, I spent 7 months on this mod.  My insanity goes so far.   I have no idea how to do that, if it was possible I probably could find a way but, right now I plan to take a break form coding.  O:)

I tried to install the core then update it as one package.  It worked fine for the install but failed when I tried to uninstall it.  It was a nasty crash that caused reinstallation of SMF on the test server.  Two files were better.  People should be able to install two mods.   :P


edit:  The more I think about it a download will most likley have the same fate as a single mod that edits files (same as above).    ???
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on April 15, 2010, 07:29:45 AM
Ok today we have over 6:1 download ratio of the mod vs install package.  Since it is an international site, I can only assume that many people downloading do not read the text or do not read English that well.  So I renamed the zip files to:

This should help improve things.

No changes made to the actual code.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: clevelife on April 15, 2010, 03:15:12 PM
Thank you for this Mod, I will be trying it out today.  I will make sure to install only the 1st part  O:)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on April 16, 2010, 09:50:09 AM
Please let me know what you think?

By the way, though not recommended by all, I prefer to use strict mode.  It gets rid of those spammers hiding behind proxies.
 8)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: clevelife on April 16, 2010, 09:57:31 AM
Please let me know what you think?

By the way, though not recommended by all, I prefer to use strict mode.  It gets rid of those spammers hiding behind proxies.
 8)

I will do that.  I don't know how much it will work right away.  I've only got one person signed up this week.  :-\
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on April 20, 2010, 04:59:32 PM
I doubt you will see much until you get more members.  My board has a medium-low visitor rate.  I was getting over 150 visitors a day when I started using the mod.  the first week Bad Behavior rejected 180 bad bots, the next week it was 80, then it slowed down to around 40 per week.

One heavily used web pages I have seen numbers from 1,000 - 3,000 rejected bad bots per week.
 8)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: Wizzlefits on April 20, 2010, 09:11:28 PM
Been testing this puppy for a few days on a 2.0 RC3 test site.  Now, after checking all the blocked IPs there is just one thing to say.. It works GREAT!

The install, although very simple, was at first a bit confusing. But reading ALL of the instructions helped.

One question,
How does this work for an admin or user with a dynamic IP?  Just curious. :)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on April 20, 2010, 09:52:48 PM
Logged in admin users are skipped and are not checked.

I recommend that you put your IP in the whitelist just to be safe.  You can enter the IP range too.  I do not think that dynamic IP's will have a issue but if they do then they will need to enter the IP range of the host.

It is more important to review the whitelist and make sure that IP and URL of the forum is covered assuming that you have a non standard directory system.  ie.  "forum/index.php" instead of the standard "smf/index.php".
 8)

Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: HiramAbif on April 21, 2010, 05:15:33 PM
I have a question.  I have guest posting enabled and there is one dude who is maliciously spamming my board using what I believe to be imacros.  Would this stop someone who floods the board with the same topic over and over again?  Thank you.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: kizer on April 21, 2010, 06:37:58 PM
How does the email work on the ERROR 403 message? Meaning I really dont' want to give out my email address so I can go from a web spammer to a victim of email spam
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on April 21, 2010, 09:51:42 PM
I have a question.  I have guest posting enabled and there is one dude who is maliciously spamming my board using what I believe to be imacros.  Would this stop someone who floods the board with the same topic over and over again?  Thank you.

The mod does not check the number of posts it checks to see if the bot is bad.  If the dude is a real spammer chances are he will not be able to even get on your board.  But if he is a normal person playing games then you will need to use other measures.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on April 21, 2010, 10:05:00 PM
How does the email work on the ERROR 403 message? Meaning I really dont' want to give out my email address so I can go from a web spammer to a victim of email spam

The mod does not give out your email as a normal email.  If your email is admin@yoursite.com it shows admin at yoursite.com.  A human/ spammer will have to correct and type it in order to be able to send you a message.  So the chances are low that you will get spammed.

This is included so that regular users can contact you for access.  For example, someone you know logs in and gets ERROR 403.  They can then use this error to send you a message and get placed on the whitelsit by you.  If you did not give them a method to contact you, they will never be able to log in.

The email listed is from the "Webmaster Email Address" listed in "admin -> server settings -> general -> Webmaster Email Address".  It is not recommended but, if you do not want your email address showing up leave the above setting blank.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on April 22, 2010, 11:08:20 AM
Further clarification on my last post (It was late and I was tired).

Attached is a copy of what the spammer will see when they are caught.

If the spammer clicks on [nofollow] "admin at eastcoastrollingthunder.com" [/nofollow] then they will record  [nofollow] "admin at eastcoastrollingthunder.com" [/nofollow].  Which will not send an email to your site.

But if one of your members click on it their email program will pop up and they will have to fix the address before it the message is sent.

Whatever you do, do not use your personal email address as the "Webmaster Email Address".  Besides being a modified return address in ERROR 403 the "Webmaster Email Address" is used to report forum errors and as a return email address for all the Newsletters that you send.  If a spammer is a member they can harvest your email address.  Instead use an email address specifically for your forum that has some sort of spam filter installed or run it through a email forwarding service.  Most people use one of the free address provided by the hosting company for the forum admin email address.  In many cases, the hosting company offers a configurable spam filtering system that you can use before you forward the message to your real email address.   Then use the forwarding system provided by their hosting company to forward the message to a real email address.  I do the same thing but I forward my admin to a email forwarding service [nofollow]http://pobox.com/[/nofollow] that has a spam filter that in turn forwards the cleansed message to my real email address.
 8)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on April 22, 2010, 11:22:31 AM
I have a question.  I have guest posting enabled and there is one dude who is maliciously spamming my board using what I believe to be imacros.  Would this stop someone who floods the board with the same topic over and over again?  Thank you.

More clarification:
I use guest posting on my forum.  Besides this mod I use the standard smf "Anti-Spam Verification" (there are posts about this somewhere in this community that tell you how to set it up) for every non-member post in the guest area.  I do not have a spam problem in my guest area.
O:)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: Wizzlefits on May 04, 2010, 09:04:17 PM
Quote
Block china in your htaccess file!

Dp something like this list for your htaccess file.

Not  necessary for RC3, Bad Behavior stops the riffraff soooo very well.  ;D
Now 1.1.11, htaccess works to some degree, but still have spammers trying to use the quick reply with random IPs. ie: never use the same IP more than twice.

 
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on May 07, 2010, 07:29:20 AM
Quote
Not  necessary for RC3, Bad Behavior stops the riffraff soooo very well.

Thanks for the feedback.  I am interested to know how it works on other sites besides my own.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: Wizzlefits on May 07, 2010, 08:31:38 AM
Well, here's some feedback for ya.  ;)
Site Mods
Stop Spammer 2.3.7 (current state--On) Has caught nothing with BB turned on
httpBL 2.3.4 (current state--Off, but shows Honeypot trap link) will turn full on later
Bad Behavior 1.0.0 (current state---On)

176 spammers stopped in last 9 days
154 in last 7 days
2 spammers permitted to load 1 page then denied from then on.
Code: [Select]
METHOD: GET
URI: /index.php?board=24.0
PROTOCOL: HTTP/1.0
HEADERS: GET /index.php?board=24.0 HTTP/1.0 Accept: */* Host: www.xxxxx.com Referer: http://www.xxxxx.com/index.php?board=24.0 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)
AGENT: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)
ENTITY:
KEY: 00000000
PERMITTED REASON: Permitted
EXPLANATION:
ERROR: 200
xxxxx'd site out because it is not for public consumption, just for messing with spammers.  8)

Mod suggestions....
Just 1 so far, the option to sort logs by IP.

If there's anything else you'd like to know let me know. :)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on May 07, 2010, 01:25:31 PM
Interesting.  Thank you for the info.  :)

I will look into the sort for the next version.  O:)

Permitted users are questionable and may not be real spammers.  The reason they are listed is because they should be watched.  If you find one please email me the details.   ???

Bad Behavior (BB) should be used in along with httpBL mod.   The current release version of BB includes honeypot but it does not have all the nice forum features as httpBL so I left that portion out.  A feature that I added that is not in the origional is that when you enable httpBL the Bad Behavior warning page includes a present in the form of the Honeypot trap link from httpBL.  The other unique feature is the optional SMF caching.   :o

Here is what happened on my site:
Stop Spammer 2.3.7 (current state--On) Has caught nothing since BB was turned on.
httpBL 2.3.4 (current state--ON, shows Honeypot trap link)
Bad Behavior 1.0.0 (current state--On, strict mode enabled)
avatar_verification_1.0 (current state--On, over 100 verification images)  Gets 5-10 hits a day but nothing has passed it.  The hits seem to be spammers who are getting caught by other means.

The trend I have seen is that with Bad Behavior in strict mode is that it blocks their proxies and other bad things.  I saw around 180-190 in my first week.  Then the humans tried turning off the proxy to get past BB but then the httpBL Mod caught them.

They were not happy with my site so they decided to assault me with a DOS -- over 300 hits/ day several times.  Every attempt failed with BB and httpBL enabled.  fyi - I made a lean httpBL warning screen that is like the BB warning screen just for my site to reduce bandwidth usage during these attacks.

After a several months they seem to have mostly given up.  Now I see only a few hits a day from both mods - Spam free!
 8)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: kaamaru on May 08, 2010, 07:17:05 AM
Mine says <!-- Bad Behavior 2.1.2 run time: 0.000 ms -->. Does that mean it's not running at all? Also, will this allow google bots to browse the forum?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: kaamaru on May 08, 2010, 07:53:26 AM
I am not sure, it says ms in my source code. Thanks for the help, It seems to have stopped some spam :).

Quote
1523     91.214.44.233     2010-05-08 12:50:06     /     DENIED
#b7830251
1520    91.214.44.233    2010-05-08 12:50:03    /iphone/index.php    DENIED
#b7830251
494    78.26.187.42    2010-05-08 12:32:52    /    DENIED
#b7830251
485    78.26.187.42    2010-05-08 12:32:49    /iphone/index.php    DENIED
#b7830251
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: kaamaru on May 08, 2010, 08:12:13 AM
Interesting.  Thank you for the info.  :)

I will look into the sort for the next version.  O:)

Permitted users are questionable and may not be real spammers.  The reason they are listed is because they should be watched.  If you find one please email me the details.   ???

Bad Behavior (BB) should be used in along with httpBL mod.   The current release version of BB includes honeypot but it does not have all the nice forum features as httpBL so I left that portion out.  A feature that I added that is not in the origional is that when you enable httpBL the Bad Behavior warning page includes a present in the form of the Honeypot trap link from httpBL.  The other unique feature is the optional SMF caching.   :o

Here is what happened on my site:
Stop Spammer 2.3.7 (current state--On) Has caught nothing since BB was turned on.
httpBL 2.3.4 (current state--ON, shows Honeypot trap link)
Bad Behavior 1.0.0 (current state--On, strict mode enabled)
avatar_verification_1.0 (current state--On, over 100 verification images)  Gets 5-10 hits a day but nothing has passed it.  The hits seem to be spammers who are getting caught by other means.

The trend I have seen is that with Bad Behavior in strict mode is that it blocks their proxies and other bad things.  I saw around 180-190 in my first week.  Then the humans tried turning off the proxy to get past BB but then the httpBL Mod caught them.

They were not happy with my site so they decided to assault me with a DOS -- over 300 hits/ day several times.  Every attempt failed with BB and httpBL enabled.  fyi - I made a lean httpBL warning screen that is like the BB warning screen just for my site to reduce bandwidth usage during these attacks.

After a several months they seem to have mostly given up.  Now I see only a few hits a day from both mods - Spam free!
 8)

Awesome, so should I install httpBL 2.3.4 too (will it conflict with this mod?) and how do I enable strict mode? Also I don't understand the cache thing. Mine is set to 0. Could you explain?

Thanks!
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on May 08, 2010, 09:38:06 AM
Awesome, so should I install httpBL 2.3.4 too (will it conflict with this mod?)

You can install httpBL with no conflicts.

and how do I enable strict mode?

Check "strict" under the security option in the admin panel.  See attached.

Also I don't understand the cache thing. Mine is set to 0. Could you explain?

If you click on the i next to cache duration the help will say: 
Quote
The buffer time in seconds that the SMF Caching System is allowed to keep information for a readable IP address between Bad Behavior look-ups.  Because bots can look at multiple pages in your forum in a short amount of time this setting will allow either them or a visitor to view the forum or see the banned message within the duration using the least amount of processing effort.

If the SMF Caching System is not enabled you will get a warning message in the error log.

The time delay can be set between 0 and 99 seconds.  Zero disables this feature and prevents error log messages.  This number should be adjusted as low as possible based on server load.  Default is 0 seconds.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on May 08, 2010, 09:43:30 AM
Mine says <!-- Bad Behavior 2.1.2 run time: 0.000 ms -->. Does that mean it's not running at all? Also, will this allow google bots to browse the forum?

That is because you are the admin and you are bypassed.  It does not check admins.  If your IP is not whitelisted, log out to see the speed.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on May 08, 2010, 10:06:25 AM
More on caching duration since I am complicated.   Say you look at your cpanel and find the following bad bot hit your site:

Quote
/smf/index.php?topic=724.0            
   Http Code: 302   Date: Mar 15 15:06:37   Http Version: HTTP/1.0   Size in Bytes: -
   Referer: http://www.yourwebsite.com/smf/index.php?topic=724.0         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/            
   Http Code: 200   Date: Mar 15 15:06:45   Http Version: HTTP/1.0   Size in Bytes: 18214
   Referer: http://www.yourwebsite.com/         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/smf/index.php?board=7.0            
   Http Code: 302   Date: Mar 15 15:06:52   Http Version: HTTP/1.0   Size in Bytes: -
   Referer: http://www.yourwebsite.com/smf/index.php?board=7.0         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/smf/index.php?board=24.0            
   Http Code: 302   Date: Mar 15 15:06:55   Http Version: HTTP/1.0   Size in Bytes: -
   Referer: http://www.yourwebsite.com/smf/index.php?board=24.0         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/smf/index.php?board=8.0            
   Http Code: 302   Date: Mar 15 15:06:58   Http Version: HTTP/1.0   Size in Bytes: -
   Referer: http://www.yourwebsite.com/smf/index.php?board=8.0         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/smf/index.php            
   Http Code: 302   Date: Mar 15 15:07:02   Http Version: HTTP/1.0   Size in Bytes: -
   Referer: http://www.yourwebsite.com/smf/index.php         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/smf/index.php?action=forum            
   Http Code: 302   Date: Mar 15 15:07:04   Http Version: HTTP/1.0   Size in Bytes: -
   Referer: http://www.yourwebsite.com/smf/index.php?action=forum         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/smf/warning.php            
   Http Code: 500   Date: Mar 15 15:07:07   Http Version: HTTP/1.0   Size in Bytes: 646
   Referer: http://www.yourwebsite.com/smf/warning.php         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]      
   

Now look at the times:
15:06:37
15:06:45
15:06:52
15:06:55
15:06:58
15:07:02
15:07:04
15:07:07

The total duration of this bots rampage is 30 seconds (58-37+7+2).  So if you set cache duration to 8 Bad Behavior will check the bot 3 times during it's visit.  The remaining hits will be a repeat of the last check.

If the bot failed at "15:06:37" every hit on your site will be immediately rejected for 8 seconds.  After that it will check again at "15:06:45".

To date I have not seen a bot fail the first hit and ever pass a second hit.  But someday that may happen.

Standard Bad Behavior does not include this feature.  It is fast enough to check every hit.  This feature should only be used when you have a really bad bot problem or your site is large.
:o
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on May 08, 2010, 10:09:34 AM
I am not sure, it says ms in my source code. Thanks for the help, It seems to have stopped some spam :).

Quote
1523     91.214.44.233     2010-05-08 12:50:06     /     DENIED
#b7830251
1520    91.214.44.233    2010-05-08 12:50:03    /iphone/index.php    DENIED
#b7830251
494    78.26.187.42    2010-05-08 12:32:52    /    DENIED
#b7830251
485    78.26.187.42    2010-05-08 12:32:49    /iphone/index.php    DENIED
#b7830251

Yes it did.  If you do not have IE click within the highlighted area for more details.  If you have ie click on the underlined denied text to see the details.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on May 08, 2010, 10:40:52 AM
<!-- Bad Behavior 2.1.2 run time: 0.000 ms -->

No, that means it ran so quickly it didn't even taken 1/1000 of a second (I think ms is wrong here, unless you're really measuring 1/1,000,000th of a second)

I really did not look at that part too much since it was part of the std BB package.  EDIT  :)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on May 08, 2010, 10:49:53 AM
EDIT:
Now I am soooo confused.   :-[

ms was correct.  It multiplies 1000 to the number before displaying it.


having a bad bad day...  ;)

and yes, that time measurement code does display in slower blogs/ forums.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on May 08, 2010, 12:46:30 PM
Bla, you tell me...

start:
Code: [Select]
$bb2_mtime = explode(" ", microtime());
$bb2_timer_start = $bb2_mtime[1] + $bb2_mtime[0];

end:
Code: [Select]
$bb2_mtime = explode(" ", microtime());
$bb2_timer_stop = $bb2_mtime[1] + $bb2_mtime[0];
$bb2_timer_total = $bb2_timer_stop - $bb2_timer_start;

display:
Code: [Select]
echo "\n<!-- Bad Behavior " . BB2_VERSION . " run time: " . number_format(1000 * $bb2_timer_total, 3) . " ms -->\n";
 :)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: giveaway365.com on May 12, 2010, 04:51:10 AM
I have httpbl & stopspammer... and not getting any problem. Do I need to use this mod also?

in fact let me know which is the best combination of mods?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on May 12, 2010, 08:00:08 AM
I use all three:
 :D

My list:
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: Lou69 on May 30, 2010, 12:00:54 AM
Installed and working withour errors on RC3.

Followed the instructions, edited what needed to be edited and did the two part install.

Other than needing to chmod a few items ( my fault ), the install went without any problems.

Thanks

Lou  :)

Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on June 16, 2010, 07:28:18 PM
It has been six(6) months since I have deleted a spammer!
 8)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: kaamaru on June 16, 2010, 08:12:33 PM
Mods still working well with my site too! The only spam I have got is from humans.

Thank You very much!!!
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: kaamaru on June 25, 2010, 11:44:58 AM
I replicated a spam bot and got
Quote
Error 403


We're sorry, but we could not fulfill your request for
/ on this server.


An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.


Your technical support key is: 41af-850f-1756-6707


You can use this key to fix this problem yourself.


If you are unable to fix the problem yourself, please contact calumks at gmail.com and be sure to provide the technical support key shown above.




Warning:  Missing argument 2 for smf_db_query(), called in /home/public_html/iphone/Sources/bad-behavior/BadBehavior-SMF.php on line 70 and defined in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 235



Notice:  Undefined variable: db_string in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 263



Notice:  Undefined variable: db_string in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 267



Notice:  Undefined variable: db_string in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 277



Notice:  Undefined variable: db_string in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 322



Notice:  Undefined variable: db_string in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 345



Notice:  Undefined variable: db_string in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 372

Query was empty

Should I be getting those errors?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on June 25, 2010, 02:23:38 PM
Was the whole quote in the warning message?

If not please fix it so I can understand.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: kaamaru on June 26, 2010, 08:31:58 AM
The whole warning message is in the quote, if that's what you mean?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on June 26, 2010, 08:52:25 AM
Yes, I was not sure if it was the warning post and the SMF error log combined in the quote.

That should not happen.  I have not seen that before.  I need to try to duplicate that and see if it is indeed BB or another mod interfering.

Did you use "Bad Behavior Test" in the UA (if not what did you do) as the simulation?
Did it record your visit in the "DENIED Entries Log"?
Were there any entries in the log before you did the test or was it empty?
 :)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: kaamaru on June 28, 2010, 05:18:32 AM
Well, it could be because I wasn't trying to be a spam bot. I was trying to see my theme's browser compatibility and one of the ways of doing that made the forum think I was a spam bot. I'm afraid I'm not sure if it was in my denied entries log. There were entries in the log before I did the test and how do I do the Did you use "Bad Behavior Test" in the UA again?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on June 28, 2010, 07:45:27 AM
To test:
To insure that Bad Behavior is functioning correctly you can add the sting "Bad Behavior Test" to the User Agent (UA) of a HTTP request from someone who is not in the whitelist and is not the administrator.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: kaamaru on July 06, 2010, 05:42:25 AM
This error only appears when I view "http://ihackmyi.com" if I view "http://ihackmyi.com/iphone/index.php" no errors are displayed.

Look at the attachments.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on July 06, 2010, 08:45:22 AM
Both of them give me "Query was empty" at the end.  This is saying that it can not write to the database because the information does not exist.  But the information does exist otherwise it would have never made it to the "error message" in the first place.  Something is preventing the transfer of data from BB to the SMF database.  At this point it looks like something on your end.  So:

1.  "Subs-Db-mysql.php" may be corrupted.  Try to back it up and reinstall this file from the SMF master disk.
2.  Maybe the installation of BB is corrupt.  A re-installation of both parts would be a good idea.
3.  You cold have a forum permission problem.  Make sure the permissions for the BB files comply with SMF standards.

If that does not work I will need more detail.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: kaamaru on July 07, 2010, 11:58:21 AM
Thanks, I fixed the problem by reinstalling the mod. I think I installed them the wrong way round.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: butchs on July 08, 2010, 08:07:01 AM
I am glad to hear that it was a easy fix.
 :)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on August 04, 2010, 08:39:15 PM
Big update to BB 2.1.4 posted today.  Here are the updates:


1.  The mod supports 2.1.4 BB (now new install part 1) and a nasty Forum Spammer has been added to the ban list.
2.  Changes to BB 2.1.4:


The big addition to the mod is CloudFlare support.  This mod is fully compatible with my CloudFlare mod (http://www.simplemachines.org/community/index.php?topic=391926.msg2726085#msg2726085).  If you are using CloudFlare and this mod please make sure both mods are installed.

You MUST completely uninstall both part 1 and 2 and reinstall the new version part 1 and 2 of thios mod.  Do not forget to backup your "whitlist.ini" file.

Enjoy!!
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: kaamaru on August 05, 2010, 12:35:59 PM
I just got this all over my portal

Quote
Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Had to disable the mod. What could be the problem?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on August 05, 2010, 08:08:28 PM
If you installed the new "bad_behavior_install_pt1of2" you will see that there is only comment code on that line.  It is obvious to me that you are mixing the old bad behavior with the new mod.

Try backing up your "whitlist.ini" file and uninstalling both "Bad Behavior install" and "Bad Behavior Mod" and downloading and reinstalling "bad_behavior_install_pt1of2 and "bad_behavior_install_pt2of2.

When you have the correct versions installed you should see the following in package manager:

Bad Behavior install    2.1.4
Bad Behavior mod    1.1.0

 :)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Lou69 on August 07, 2010, 12:16:02 PM
There is a difference for the user between the old whitelist.ini and the new whitelist.

New is:

[useragent]
useragent[] = "Mozilla/4.0 (It's me, let me in)"


Old is:

[useragent]
; This is an example; you should remove it
; useragent[] = "Mozilla/4.0 (It's me, let me in)"

Is the change intentional?

thanks



Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on August 07, 2010, 01:37:25 PM
You are correct you need to remove it as follows:

; useragent[] = "Mozilla/4.0 (It's me, let me in)"
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Lou69 on August 07, 2010, 01:43:00 PM
thanks ... just wanted to make sure that was the intent

 :)

Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on August 08, 2010, 10:11:06 AM
The CloudFlare portion of Bad Behavior 2.1.4 dies not work with CloudFlare.  I am currently debugging 2.1.5 and expect to be able to release Bad Behavior 2.1.5 soon.  Along with a mod and whitlist update.

Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on August 08, 2010, 06:47:05 PM
New Version Posted today.

BB Mod 1.2.0
BB core 2.1.5
whitelist.ini

Mod changes:
Fixed email -  Streamed lined code and improvement for ip address.
Automatic detection of CloidFlare and IP addresses were resolved.

Core Changes
Improvements for CloudFlare.
The next official version will include some of the changes that are being installed by the above mod.
MSN bot error fixed.
ereg() is deprecated error fixed.

Whitelist Changes
Compatible with older versions of the mod.  Whitelist has been looked at more closely and comments were added.
More things are blocked to make it even more effective.
Only the base features were not commented.
This version is part of 2.1.5 and is recommended as a starting point for all users.
Your database server should be checked see (admin/Server Settings/Database and Paths/Database Server).

 :D
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: MattH41 on September 15, 2010, 09:51:15 PM
I want to say that this mod is amazing for SMF. I've had it installed for 3 days and these are the stats so far (running in strict mode):

Site #1:
2,622 Denied entries
20 Permitted entries

Site #2:
712 Denied entries
13 Permitted entries

Working great!

Quick question, if I want to move to 2.1.7 of Bad Behavior I just need to grab the files from the bad behavior site and drop them into the right location on the server, right?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on September 16, 2010, 07:31:19 AM
That is good news.  You should see a drop in a few weeks as they give up.

There is no need to upgrade.  I submitted the changes that were used in the mod to BB to make BB version 2.1.7.  So latest version of the mod (part 1 and part 2) has everything that is in BB 2.1.7.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: meadwench on September 20, 2010, 10:05:48 AM
Will this run with RC4? I tried to install it and got a 'corrupt package' error.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on September 21, 2010, 12:56:44 PM
Will this run with RC4? I tried to install it and got a 'corrupt package' error.

RC4 there is no official release of 2.0 RC4!  Maybe you mean RC3?

I sounds like there was an error either uploading to SMF or downloading the package from SMF.  If you are getting a package error try downloading the package again and reinstall.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: meadwench on September 21, 2010, 02:45:20 PM
Oops. sorry. I meant to say *Beta* 4.....

I'll try downloading again.....
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: meadwench on September 21, 2010, 02:50:45 PM
OK, just re-downloaded it. I was able to upload it to my site, but when I go to install it says "The package you are trying to download or install is either corrupt or not compatible with this version of SMF."

Thoughts?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Oya on September 21, 2010, 03:05:23 PM
the upgrade package cannot be used through the package manager

for upgrading please see Upgrading SMF (http://docs.simplemachines.org/index.php?board=3.0;sort=subject)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on September 21, 2010, 03:07:47 PM
If you upgrade to SMF 2.0 RC3 it will work.
 O:)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: meadwench on September 21, 2010, 03:34:35 PM
Ah ha. Will do!
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: meadwench on September 21, 2010, 04:11:16 PM
Yep, that worked. ::sigh:: Been spending too much time in other forum software, I fell behind in SMF! Thanks for the poke in the head to get my brain working again. Now to get this thing configured.....
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: kibtwane on October 15, 2010, 02:02:13 AM
This is a great mod with a not-so-helpful installation guide, which clearly is aimed at people with a fair degree of pc knowledge. Sorry but you lost me at the white.ini editing instructions and then the bad string thing. Whatever that is. Like the honeypot mod, this needs a simpler way to install it or some kind of an Installation for Dummies tutorial which doesn't presume that the person doing the installing is a tech-boffin.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on October 15, 2010, 06:32:53 AM
Sorry I guess I do not know how to do dummy tutorials.  If you like to take on the dummy project you have my permission.

Did you look at readme in the "bad_behavior_install_pt1of2" zip file?
Quote
It is recommended that you open /bad-bfolder/whitelist.ini and make the following changes:

Search for:
Code: [Select]
ip[] = "localhost"
Replace the word localhost wiht the IP address of your database if it is not localhost.

Starting on the next line enter:
ip[] = "xx.xx.xx.xx"
ip[] = "yy.yy.yy.yy"
Where xx.xx.xx.xx is the Admins IP address.
Where yy.yy.yy.yy is the Shared IP Address.

Save, then re-zip the package and install it on your forum like any other package.

If you do not want to open the package then install "The SMF File Management Tool" and edit the whitelist on the fly.


The above assumes that you are installing the mod in a forum that is a "smf" directory.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: mojosplurr on October 30, 2010, 03:29:05 PM
I did a manual install and made sure all code was copied and replaced correctly, have gone over it 5 times now. However the last bit I can't get past is the install_db.php, it gives me:

Database Error
No database selected
File: /var/www/dddd/xxxxx/zzzz/httpdocs/install_db.php
Line: 71
Back

I did make sure it is in the same folder as index.php, ssi.php etc, and I am not under the SMF directory. My website is the forum, so www.mywebsite.com instead of www.mywebsite.com/smf/

Also it shows up in admin section just fine, except logs give me error

Table 'db.smf_log_badbehavior' doesn't exist
File: /var/www/zzz/sss/dddd/httpdocs/Sources/BadBehavior-Admin.php
Line: 244

which is due to install_db.php not running..?

I am running Dzine, Overview theme.

Thanks in advance, hope to get this mod up and running.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on October 31, 2010, 08:48:08 AM
The 'db_extend" packages was not loading.  Try the attached.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: snoopy_virtual on November 02, 2010, 04:00:43 PM
@ mojosplurr As you told me somewhere else, you tried with that install_db.php file and still are getting the same "Database Error ...".

Try with this one instead. I think you will be able to install the DB now without errors.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on November 02, 2010, 08:28:10 PM
Mr show off?   Glad to see you are stepping up since I am done programming for a while.  ;)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: flapjack on November 02, 2010, 08:34:40 PM
installing in rc4 without a problem
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: snoopy_virtual on November 02, 2010, 08:51:40 PM
Mr show off?   Glad to see you are stepping up since I am done programming for a while.  ;)

A pity. I thought you were going to say I had another mistake somewhere.

You see: I wanted to win another free beer.  8)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on November 02, 2010, 08:59:14 PM
Egads, you go there after all that help I gave you?  Please do not try to taunt me.

It was fun but, no more time for php until the holidays.  Gotta real job now...
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on November 03, 2010, 05:13:30 AM
installing in rc4 without a problem

Yay!  That is great news!
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on November 03, 2010, 08:06:56 PM
To install the mod in RC4 do the following:

Download both parts of the mod.

Go to package manager:

Click on "Advanced" in lower right.

Change Emulate Version to:  SMF 2.0 RC3

Install part 1 and then part 2 of the mod.

Enjoy.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on November 06, 2010, 10:13:35 AM
There is a RC4 update to this mod but I can not download it because SMF is blocking me.

Quote
An Error Has Occurred!
The package id given in the uploaded file does not match the package id given by previous versions of this mod.
Package id in database: Bad_Behavior_mod
Package id in the uploaded file: Bad_Behavior_install

It will be updated when whoever at SMF decides to allow me to download the two(2) parts of this mod and when I have free time...

The changes that I am not able to download are as follows:

Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: snoopy_virtual on November 06, 2010, 10:34:05 AM
An Error Has Occurred!
The package id given in the uploaded file does not match the package id given by previous versions of this mod.
Package id in database: Bad_Behavior_mod
Package id in the uploaded file: Bad_Behavior_install

It doesn't matter if your mod has one file or a lot of them. Inside all the files the id need to be exactly the same one.

So if the id in the first file you uploaded to SMF (when you started this mod) was:

Code: [Select]
<id>JMiller:Bad_Behavior_mod</id>

All the rest of the files need to have exactly that id.

Of course inside every file you can change the name and version:

Code: [Select]
<name>whatever name you want for every file</name>
  <version>whatever version number it is</version>

But you cannot change the id.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on November 06, 2010, 12:32:49 PM
I tried that on my test server and it did not work.  I am sure SMF can sort it out...
 :'(
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on November 06, 2010, 09:36:41 PM
The new version is in the mod section.

The big change is that it no longer requires your server to have cache capabilities.  See reply 82 for details.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: MattH41 on November 22, 2010, 10:14:22 PM
I want to say how thankful I am for this mod. I've been using if for a few months and it's still knocking out like 400 requests per day (strict mode) without any adverse consequences for my users.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on November 23, 2010, 04:43:37 PM
You are welcome.  That is what Bad Behavior (BB) is about!

With your traffic you should try my new mod.  As a minimum you should al least use the ip address (ipv4 and ipv6) check along with the DOS prevention features.  Run it on logging mode for a few days before blocking.  My new mod has been waiting for SMF approval for 1 day short of a month.  I programmed/ tested to for more than six(6) months, it is by far my best anti-spam effort to date.  Along with BB you will see even more wasted bandwidth go away so your members can enjoy your site.

I think it is simply sitting in never-never land because it is a security mod and SMF wants to cover up security flaws and make it look like it has no security issues with SMF.  But the reality of my new mod is not about pointing out flaws in SMF but to rid the forum of bad visitors that try to pass known security flaws in other software...  These are the ones you do not want at your site.  I prefer to block ban bots/ people than to sanitize them like SMF.  Let SMF sanitize the posts, use there filters, give them a warm and cosy so they want to try more things.  Forum Firewall is all about chasing the unwanted away...

If you like you can find it at P.C. Tweakr (http://forum.pctweakr.com/index.php/topic,499.0.html).
 O:)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Malaky on November 24, 2010, 04:14:08 PM
Hi!

First great anti-spam mod, I have used several of them (httpbl, stop spammer), and yours is the only one to prevent 99,999% of the spam to reach my board (I need to have some boards fully open to posting from guests, so spam is a big problem for me).

Now, I've installed rc4 on a test site, (done a clean new install), then wanted to import through phpmyadmin the database of my main forum (rc3). It gives me this error:

Quote
CREATE TABLE `hip_log_badbehavior` (
id int( 11 ) unsigned NOT NULL AUTO_INCREMENT ,
ip varchar( 16 ) NOT NULL default '',
date varchar( 255 ) NOT NULL default '0000-00-00 00:00:00',
request_method varchar( 4 ) NOT NULL default '',
request_uri varchar( 255 ) NOT NULL default '',
server_protocol varchar( 15 ) NOT NULL default '',
http_headers varchar( 255 ) NOT NULL default '',
user_agent varchar( 255 ) NOT NULL default '',
request_entity varchar( 255 ) NOT NULL default '',
KEY varchar( 255 ) NOT NULL default '',
PRIMARY KEY ( id ) ,
KEY ip( ip ) ,
KEY user_agent( user_agent )
) TYPE = MYISAM ;

Quote
#1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'varchar(255) NOT NULL default '',
PRIMARY KEY (id),
KEY ip (ip),
KEY user_' at line 11

Do you know if this comes from your mod, what it is? could it come because I'm trying to import a db from a rc3 forum to a rc4 one?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on November 25, 2010, 07:23:31 AM
It is my understanding that when you change SMF version the SMF installer updates the database.  So if you attempt to to run a SMF RC3 database in RC4 you can get an error.

I recommend setting up a test server or a dummy server on the net and import the RC3 database in to a fresh copy of RC3 with no mods.  Upgrade the RC3 to RC4, which will update the database.  Back up the RC4 database, remove the software and install the RC4 database in your live MASTER RC4 with no mods installed.  Reinstall all mods and rock on...  :o
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Malaky on November 25, 2010, 07:59:52 AM
Thanks a lot!
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: macmend on December 27, 2010, 03:16:51 AM
I can see instructions that sya "install part 1 then part 2 of this Mod" but nowhere can i find the instructions of how to do this install, can someone point me in the right direction
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on December 27, 2010, 06:04:48 PM
You found them.  First you download and install part 1.  Then you download and install part 2.  :)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: ripystys on January 07, 2011, 04:00:22 AM
Hi butchs,

this is areally awesome mod!
Is there also a version for SMF 1.1?

Regards,
ripystys 8)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: darcysarto on January 07, 2011, 04:05:48 PM
I'm very sorry about this but I am a complete and utter novice.  I have set up a forum using smf 1.1.12, I've used forums and am quite comfortable just using them.  I wanted to stop some of the spam I've been getting as I really don't want to buy any ugg boots and that's what they all seem to be selling!

I have downloaded parts 1 and 2 and the whitelist ini but now have what is probably a stupid question to you knowledgable ones.  In the part 1 readme.txt it says this

It is recommended that you open /bad-bfolder/whitelist.ini and make the following changes:

Search for:
Code: [Select]
ip[] = "localhost"
Replace the word localhost wiht the IP address of your database if it is not localhost.

Starting on the next line enter:
ip[] = "xx.xx.xx.xx"
ip[] = "yy.yy.yy.yy"
Where xx.xx.xx.xx is the Admins IP address.
Where yy.yy.yy.yy is the Shared IP Address.


Well my database is hosted on my site so I assume I can leave that as locahost but am not sure what is meant by Admins IP address and Shared IP Address?  Is the Admin IP address the address of my home pc?  And Shared IP Address?

Sorry for asking what are basic questions.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on January 07, 2011, 05:07:05 PM
Sorry this mod does not work with smf 1.1.x.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: ACAMS on January 22, 2011, 01:14:38 AM
This mod is kinda hard to install, and I have some questions.
 
I have SMF 2.0 RC3
 
Before I uploaded to Packages and installed it, I extraced it to my desktop and opened the folder and inside it I found whitelist.ini and I found ip[] = "localhost" and changed it to ip[] = "mysql.mysite.orgy".............will that work?.....that is what was in my server info!
 
Starting on the next line entered:
ip[] = "MY IP address"
ip[] = "yy.yy.yy.yy" (I left this off, because I have NO CLUE what a shared address is....will it work?)
 
 
I saved it, then re-zipped the package and installed it on my forum like any other package.

 
I edited my .htacces to include the time zone per the instructions
 
Code: [Select]
#--- DH-PHP handlers ---
AddHandler fastcgi-script fcg fcgi fpl
AddHandler php-fastcgi .php
Action php-fastcgi /cgi-bin/dispatch.fcgi
Options -Indexes
ErrorDocument 403 /403.html
ErrorDocument 404 /404.html
ErrorDocument 500 /500.html

#Set the timezoneSetEnv TZ America/Chicago

^^^^Will that work?^^^^
 
 
 
I don't think it is working, because I don't have any error logs......and still have bots trying to log in guessing members passwords!!!
 
 
 
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: ACAMS on January 22, 2011, 01:26:50 AM
I enabled Verbose HTTP logging, and got 59 in just a couple of minutes......does that mean it is working?
 
 
I noticed bots that were in my block list trying to log in with usernames so I changed my .htacess to this.....do you see a problem with it?
 
Code: [Select]
#Set the timezoneSetEnv TZ America/Chicago
#--- DH-PHP handlers ---
AddHandler fastcgi-script fcg fcgi fpl
AddHandler php-fastcgi .php
Action php-fastcgi /cgi-bin/dispatch.fcgi
Options -Indexes
ErrorDocument 403 /403.html
ErrorDocument 404 /404.html
ErrorDocument 500 /500.html
<Limit GET HEAD POST>
order allow,deny
# ACAMS Pissed off
deny from 108.1.174.239
deny from 108.41.42.137
deny from 109.169.29.56
deny from 109.169.29.56
deny from 109.169.41.48
deny from 111.1.32.23
deny from 111.1.32.24
deny from 111.1.32.25
deny from 111.1.32.26
deny from 124.106.204.40
deny from 124.148.154.221
deny from 125.255.2.30
deny from 128.6.224.107
deny from 137.30.164.165
deny from 137.56.163
deny from 140.180.130.93
deny from 142.68.83.148
deny from 144.85.24.218
deny from 144.92.92.15
deny from 150.140.188.242
deny from 150.70
deny from 155.239.155.200
deny from 173.193.221
deny from 173.193.221.27
deny from 173.193.221.28
deny from 173.255.238.178
deny from 173.48.174.212
deny from 173.54.2.133
deny from 173.54.2.197
deny from 174.138.169.218
deny from 174.36.199
deny from 174.36.199.200
deny from 174.36.199.201
deny from 174.36.199.202
deny from 174.36.199.203
deny from 178.18.17.250
deny from 178.239.55.32
deny from 178.33.149.173
deny from 178.63.198.71
deny from 178.63.246.164
deny from 178.73.209.99
deny from 178.78.255.254
deny from 18.246.0.69
deny from 180.149.96.69
deny from 184.99.175.66
deny from 188.120.245.249
deny from 188.124.19.114
deny from 188.134.24.234
deny from 188.40.51.2
deny from 188.40.98.60
deny from 188.72.223.162
deny from 188.72.225.172
deny from 188.72.241.209
deny from 192.251.226
deny from 192.251.226.205
deny from 192.251.226.206
deny from 193.138.216.157
deny from 193.198.207
deny from 193.198.207.8
deny from 194.145.200.128
deny from 194.154.227
deny from 195.43.157.85
deny from 195.71.226.87
deny from 199.48.147
deny from 199.48.147.35
deny from 199.48.147.35
deny from 199.48.147.36
deny from 199.48.147.37
deny from 199.48.147.38
deny from 199.48.147.39
deny from 199.48.147.40
deny from 199.48.147.41
deny from 199.48.147.42
deny from 199.48.147.43
deny from 199.48.147.45
deny from 202.71.106.147
deny from 202.81.69.142
deny from 203.174.87.18
deny from 204.152.222
deny from 204.152.222.140
deny from 204.8.156.142
deny from 206.221.217.246
deny from 208.115.203.16
deny from 208.66.135
deny from 208.66.135.190
deny from 208.66.135.190
deny from 208.75.57.100
deny from 208.75.88.34
deny from 209.159.142.164
deny from 212.13.195.235
deny from 212.42.236.140
deny from 213.112.111.205
deny from 213.154.227.205
deny from 213.165.81.179
deny from 213.239.192.229
deny from 213.46.138.76
deny from 213.46.88.109
deny from 213.49.109.9
deny from 216.115.3.26
deny from 216.24.174.245
deny from 216.243.32.170
deny from 216.86.61.205
deny from 217.15.23.215
deny from 217.19.50.77
deny from 217.20.114.254
deny from 24.106.191.235
deny from 24.192.171.225
deny from 24.247.220.16
deny from 38.102.94.125
deny from 46.4.160.39
deny from 46.4.237.146
deny from 50.15.57.221
deny from 50.16.134.106
deny from 50.22.180.2
deny from 58.247.181.212
deny from 60.242.34.204
deny from 61.47.35.34
deny from 62.141.53.224
deny from 62.141.58.13
deny from 62.212.67.209
deny from 62.24.181.134
deny from 62.24.181.135
deny from 62.75.139.221
deny from 62.75.159.139
deny from 62.75.185.133
deny from 64.120.209.40
deny from 64.27.17.140
deny from 64.34.162.160
deny from 66.230.230.230
deny from 66.233.158.229
deny from 66.96.16
deny from 66.96.16.32
deny from 67.207.136.44
deny from 68.126.24.162
deny from 68.71.46.138
deny from 69.163.34.69
deny from 71.129.110.137
deny from 71.198.26.88
deny from 71.244.55
deny from 71.244.55.170
deny from 72.47.252.215
deny from 74.106.13.137
deny from 74.106.17.110
deny from 74.110.86.176
deny from 74.208.243.167
deny from 74.208.246.213
deny from 74.208.246.222
deny from 74.3.165.39
deny from 76.10.214.53
deny from 76.10.214.89
deny from 76.253.141.244
deny from 77.109.139.87
deny from 77.207.206.122
deny from 77.220.41.47
deny from 77.232.135.67
deny from 77.37.136.160
deny from 77.54.97.144
deny from 78.107.237.16
deny from 78.153.153.8
deny from 78.225.101.56
deny from 78.42.9.166
deny from 78.46.39.228
deny from 78.47.240.52
deny from 78.47.251
deny from 78.48.204.3
deny from 79.120.86.20
deny from 79.136.50.205
deny from 79.140.39.227
deny from 80.237.226.75
deny from 80.237.226.76
deny from 80.62.217.18
deny from 80.81.183.178
deny from 81.169.155.246
deny from 81.169.173.120
deny from 81.218.219
deny from 81.218.219.122
deny from 82.209.175.58
deny from 82.224.122.209
deny from 82.228.252.20
deny from 82.245.41.171
deny from 83.142.228
deny from 83.142.228.14
deny from 83.168.210
deny from 83.168.210.55
deny from 83.169.9.70
deny from 83.170.92
deny from 83.170.92.9
deny from 83.220.133.86
deny from 83.226.245.207
deny from 83.80.129.253
deny from 83.86.110.188
deny from 84.25.173.164
deny from 84.75.174
deny from 85.114.135.224
deny from 85.114.141.18
deny from 85.17.92.13
deny from 85.214.73.63
deny from 85.235.31.248
deny from 85.25.144.101
deny from 86.101.114.199
deny from 86.201.237.21
deny from 86.205.122.125
deny from 86.81.118.37
deny from 87.118.104.203
deny from 87.126.133.230
deny from 87.236.194
deny from 87.236.199
deny from 87.236.199.73
deny from 88.189.58
deny from 88.208.121.151
deny from 88.80.29.99
deny from 89.176.88.245
deny from 89.208.236.35
deny from 89.208.237.70
deny from 89.253.105.39
deny from 89.253.97.235
deny from 89.77.213.43
deny from 91.118.57.238
deny from 91.121.175.151
deny from 91.213.50
deny from 91.213.50.235
deny from 91.214.30.60
deny from 91.216.191.11
deny from 91.67.236.41
deny from 92.101.211.233
deny from 92.241.168.146
deny from 92.241.174.9
deny from 92.241.184
deny from 92.241.184.106
deny from 92.241.190.129
deny from 92.241.190.168
deny from 92.241.190.188
deny from 92.247.192.176
deny from 92.9.221.213
deny from 93.104.215.8
deny from 93.115.241
deny from 93.156.76.66
deny from 93.157.46.163
deny from 93.167.245.178
deny from 93.31.155.175
deny from 93.50.137.186
deny from 94.132.72.2
deny from 94.19.12.244
deny from 94.249.153.47
deny from 94.251.75.55
deny from 94.27.70.144
deny from 94.75.253.73
deny from 95.142.174.176
deny from 95.143.193.145
deny from 96.226.21.90
deny from 96.255.16.21
deny from 97.107.142.93
deny from 98.113.149.36
deny from 98.191.188.71
deny from 91.66.107.36
deny from 74.110.86.138
deny from 217.114.211.20
deny from 178.32.95.23
deny from 107.5.17.164
deny from 87.194.9.111
deny from 64.34.184.153
deny from 64.83.196.144
deny from 74.208.231.162
deny from 217.114.211.20
deny from 109.202.66.4
deny from 190.183.221.175
deny from 91.66.107.36
deny from 85.17.97.6
deny from 91.218.39.92
deny from 24.83.197.147
deny from 95.142.174.183
deny from 78.40.42.152
deny from 80.232.240.249
deny from 78.34.189.131
deny from 66.8.120.130
deny from 93.125.165.43
deny from 88.198.109.35
deny from 168.144.48.133
deny from 194.0.229.54
deny from 217.160.221.7
deny from 78.34.148.210
deny from 88.162.37.58
deny from 95.105.224.155
deny from 96.226.21.242
deny from 208.110.65.123
deny from 46.28.108.24
deny from 193.34.144.124
deny from 62.141.53.224
deny from 192.251.226.205
# bots be gone
allow from all
</LIMIT>
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on January 22, 2011, 10:57:52 AM
Yes BB is working.

I can not vouch on your htaccess file since the requirements differ host by host.

As far as your list goes it is a waste of time since the bots change their ip often.  You could end up blocking a good user.

I would prefer to see you add a better robots.txt file.  Search this site there are a few discussions on robots.txt.

If you insist on blocking ip via htaccess then do it by country and a few notable locals in your own country.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 08, 2011, 06:06:51 PM
Hi butchs,

this is areally awesome mod!
Is there also a version for SMF 1.1?

Regards,
ripystys 8)

Working on a new version.  Lots of improvements and changes.  Added SMF 1.1.x functionality.  I will be running beta tests for a few weeks at SMF HELPER (http://community.smfhelper.info/index.php/topic,5187.0.html).  So follow the link if you will like to try it.  I will test it there at least two weeks fore the official release.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: ACAMS on February 08, 2011, 07:52:01 PM
I have a member that is blocked and he gave me the technical support key number, but I have over 3000 entries in the block log.......How do I unblock him?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 08, 2011, 07:57:35 PM
Two ways:

1.  You can go to the BB (http://www.bad-behavior.ioerror.us/) Website and make a request.
2.  Add him to the whitelist.  In the last release version that will require you to add his ip address to the whitelist.ini file.  The beta will be a permission change.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: ACAMS on February 08, 2011, 08:58:35 PM
Thanks, I think we have it worked out.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 12, 2011, 06:33:55 AM
It is recommended that you completely uninstall this mod before applying the new "SMF 2.0 RC4 Security Patch".  You can reinstall the mod afterwards.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 19, 2011, 10:00:58 AM
New version, BB 2.1.11 support, works behind reverse proxies, "Search Engine DNS" check box, lots of changes and SMF 1.1.13 compatibility.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Lou69 on February 20, 2011, 02:11:49 PM
Looking at the download page for this mod, I see that it does not parse for the 2.0 RC4 + Security Patch but will parse for the RC 5. Is this indeed a fact or just an oversite showing the RC 4 + SP is not parsable?

thanks
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 20, 2011, 02:55:37 PM
I have the security patch and it installs just fine on my server.

But if you experience this go to "Admin/Package Manager/Browse Packages".  Click "Advanced Options" and confirm that "Emulate Version" is "SMF 2.0 RC4".
 8)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Lou69 on February 20, 2011, 03:18:14 PM
Thanks butchs, I will give it a go. If it worked for you then I am certain it shall work for me.

By the way, a 'thumbs up' on this mod and your ForumFirewall. The bad actors are being deflected by the bucket load.

thanks,

Lou
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: packman on February 21, 2011, 02:31:59 AM
Every few hours I get this error logged...

Quote
Database Error: No database selected
File: /home/mydomain.com/public_html/smf/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74

The errors correspond to 'users' hitting the httpBL warning.php file if that's significant.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: ac19189 on February 21, 2011, 05:50:02 PM
Having an issue with the mod I think when I turn it on I get the following error at the bottom of all pages. Any idea how I fix it?

Code: [Select]
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '}log_badbehavior AS bb
WHERE id >= 0' at line 2
File: /home/xxx/public_html/xxx/Forums/Sources/bad-behavior/BadBehavior-SMF.php
Line: 496

Note: It appears that your database may require an upgrade. Your forum's files are currently at version SMF 1.1.13, while your database is at version 1.1.5. The above error might possibly go away if you execute the latest version of upgrade.php.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: hardcore_f on February 21, 2011, 05:54:13 PM
Badb.  ver 1.4

When clicking on the  "key" col  in the denied records I get  a 404 error, is this correct?

DENIED
#17566707tuy
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 21, 2011, 09:30:58 PM
Badb.  ver 1.4

When clicking on the  "key" col  in the denied records I get  a 404 error, is this correct?

DENIED
#17566707tuy

You should not get any errors as long as you are logged in as the admin.  Seems you logged out or your session expired.

17566707 means and invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.  Required header \'Accept\' missing'.

Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 21, 2011, 09:36:15 PM
Every few hours I get this error logged...

Quote
Database Error: No database selected
File: /home/mydomain.com/public_html/smf/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74
The errors correspond to 'users' hitting the httpBL warning.php file if that's significant.

Odd, I have used both with no issues.  But I use SMF 2.0.  I need to get more info so I can find out what is going on...  But for now I will blame my bud snoopy.   ;)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 21, 2011, 09:41:33 PM
Having an issue with the mod I think when I turn it on I get the following error at the bottom of all pages. Any idea how I fix it?

I believe I am working with you over at SMF helper.  Lets do it in one place to keep things neat.  I am going to do what I can do to help you but please be patient with me because I have little time during the week to support my mods.  But is seems you have more of a forum installation issue and those SMF Helper guys are better than me with that stuff...
 8)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: busterone on February 22, 2011, 05:49:21 PM
butchs, I have an odd situation with B.B. and httpBL. It is a test forum that I have allowed bots into just to test B.B., so it is not an urgent issue.  I have a denied entry for an IP that I can confirm is a bad bot, but it seems to be a minor conflict with httpBL. My log shows that IP being caught by httpBL at 10:11:30, and the B.B. logs that it denied the IP at 10:11:32 from going to warning.php, which of course is where httpBL had just redirected it. It is not an issue to me, the bot was stopped, but I am wondering if this has been seen before, or am I the first?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 22, 2011, 07:17:53 PM
New version posted today.  It only contains changes for SMF 1.1.x.  SMF 2.0 RCx users need not upgrade.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 22, 2011, 07:21:31 PM
butchs, I have an odd situation with B.B. and httpBL. It is a test forum that I have allowed bots into just to test B.B., so it is not an urgent issue.  I have a denied entry for an IP that I can confirm is a bad bot, but it seems to be a minor conflict with httpBL. My log shows that IP being caught by httpBL at 10:11:30, and the B.B. logs that it denied the IP at 10:11:32 from going to warning.php, which of course is where httpBL had just redirected it. It is not an issue to me, the bot was stopped, but I am wondering if this has been seen before, or am I the first?

Sounds like snoopy is not ending php properly even after I told him how to do it several times.  He never listens to me...   :'(

Try this:

Search "warning.php" for "?>" and replace it with
"die();
?>".

That should force httpbl to stop further activity.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: busterone on February 22, 2011, 07:25:15 PM
Done. Will watch and see. Thanks.   :)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 22, 2011, 07:27:45 PM
Done. Will watch and see. Thanks.   :)

If I am correct, you get ot tell snoopy he goofed again.  If I told him, he will stalk me for a week.   :o
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: busterone on February 22, 2011, 07:30:29 PM
LOL.  ;D
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 22, 2011, 07:40:39 PM
Hah...  My site just proved that bots can pass thru httpbl unblocked!  Httpbl loads before BB so if a bot was stopped it would not reach BB.  A bot hit warning php but then then was blocked by BB.   8)

BB does have project honey pot capabilities, though not as good as httpbl but it does stop the bot.  BB author insisted that I retain all the capabilities.  So if you can not wait for snoopy to fix his code go to phpmyadmin in the "settings" DB entry and populate the following:

badbehavior_httpbl_key
badbehavior_httpbl_threat
badbehavior_httpbl_maxage
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: busterone on February 22, 2011, 07:59:44 PM
Since this is on a test forum, I populated the db to see what happens.   :)   
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: packman on February 23, 2011, 02:20:05 AM
badbehavior_httpbl_key
badbehavior_httpbl_threat
badbehavior_httpbl_maxage

httbl_key is obvious, but the other two values aren't quite so obvious? The httpBL mod has two threat values and three values that might correspond to maxage, or maybe your values mean something completely different?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 23, 2011, 08:03:26 PM
Here is what is happening.  BB is loaded after httpbl mod and httpbl mod (not associated with this mod) is allowing the bad guys to pass thru only to get blocked by this mod BB.

(http://img.photobucket.com/albums/v471/JdotMiller/httpbl.jpg)
 :o
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 23, 2011, 08:11:09 PM
badbehavior_httpbl_key
badbehavior_httpbl_threat
badbehavior_httpbl_maxage

httbl_key is obvious, but the other two values aren't quite so obvious? The httpBL mod has two threat values and three values that might correspond to maxage, or maybe your values mean something completely different?

BB has only one for each.  You exceed the set point(s) and the visitor will get blocked.


This is the Honey Pot Configuration for literally hundreds of thousands of BB installations throughout the world.  At this time I have no intension of expanding this feature beyond it's default.
 ::)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Glasso on February 25, 2011, 02:20:45 AM
Hi buchs,

Thanks for this great mod.

I have bad behaviour installed but most connections from phones are bloceked. Here is more detail:

Code: [Select]
ID: 90
IP: <IP reported correctly>
DATE: 2011-02-25 11:59:09
METHOD: GET
URI: /forum/
PROTOCOL: HTTP/1.1
HEADERS: GET /forum/ HTTP/1.1 Connection: Keep-Alive, keep-alive Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,image/png,*/*;q=0.5 Accept-Charset: iso-8859-1,utf-8;q=0.7,*;q=0.7 Accept-Language: en;q=1.0,en;q=0.5 Cookie: <removed>; <removed>; has_js=1; PHPSESSID=<removed>; OAID=<removed> Cookie2: $Version=1 X-Nokia-MusicShop-Version: 11.1014.15 X-Nokia-MusicShop-Bearer: GPRS/3G x-wap-profile: "http://nds1.nds.nokia.com/uaprof/NN97-4r100-3G.xml" Referer: http://<removed>.com/forum/ Accept-Encoding: gzip, deflate, x-gzip, identity; q=0.9 Host: <removed>.com X-Forwarded-For: 10.12.159.128 Via: 192.168.1.79:8080 (TeleDNA 2.0) User-Agent: Mozilla/5.0 (SymbianOS/9.4; Series60/5.0 NokiaN97-4/12.0.110; Profile/MIDP-2.1 Configuration/CLDC-1.1) AppleWebKit/525 (KHTML, like Gecko) BrowserNG/7.1.4 X-Network-Info: UDP, 10.12.159.128 Called-Station-Id: <removed> X-Mms-SgsnIp: <removed> X-Mms-SgsnMccMnc: 40473 X-Mms-Prepaid-Flag: N X-MSISDN: <removed>
AGENT: Mozilla%2F5.0%20%28SymbianOS%2F9.4%3B%20Series60%2F5.0%20NokiaN97-4%2F12.0.110%3B%20Profile%2FMIDP-2.1%20Configuration%2FCLDC-1.1%29%20AppleWebKit%2F525%20%28KHTML%2C%20like%20Gecko%29%20BrowserNG%2F7.1.4
ENTITY:
KEY: a52f0448
DENIED REASON: Header 'Connection' contains invalid values
EXPLANATION: An invalid request was received. This may be caused by a malfunctioning proxy server or browser privacy software. If you are using a proxy server, bypass the proxy server or contact your proxy server administrator.
ERROR: 400

Can you please help? Thanks.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Kindred on February 25, 2011, 11:09:02 AM
hmmm...   these errors just started showing up today:


2: in_array() [<a href='function.in-array'>function.in-array</a>]: Wrong datatype for second argument
File: /....../Sources/bad-behavior/bad-behavior/roundtripdns.inc.php
Line: 27

Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 25, 2011, 08:41:41 PM
Code: [Select]
[quote author=Glasso link=topic=375980.msg2967788#msg2967788 date=1298618445]
I have bad behaviour installed but most connections from phones are bloceked. Here is more detail:

DENIED REASON: Header 'Connection' contains invalid values
EXPLANATION: An invalid request was received. This may be caused by a malfunctioning proxy server or browser privacy software. If you are using a proxy server, bypass the proxy server or contact your proxy server administrator.
ERROR: 400

Bad Behavior it's self is extremely conservative, is being used by a large volume of web sites, the package has strong support and does everything possible to prevent blocking valid users.

In extremely rare circumstances, Bad Behavior may block actual human visitors. Bad Behavior was designed to target robots, not people. If this happens, the profile presented by your browser matched that seen from actual malicious robots. In some cases, this is caused by over-aggressive personal firewall/browser privacy software. In other cases, this is caused by improperly configured Web proxy server software.

First, make a note of the technical support key and e-mail address shown on the error page. Then click the link to “fix it yourself” for suggestions on how you may be able to resolve the problem.

If you continue to have trouble, contact the e-mail address on the error page and be sure to provide the technical support key "a52f0448". This will allow the site administrator to tell you what you need to do to resolve the problem.

If you are the site administrator receiving a trouble report from a user, contact me and provide the technical support key and a copy of the logs which Bad Behavior stores in the database showing the IP address which was blocked. The core author provide further assistance until the trouble is resolved.

For more information on how to diagnose a Bad Behavior blocking problem, see the Bad Behavior weblog entr (http://bad-behavior.ioerror.us/2007/12/07/what-to-do-when-bad-behavior-blocks-you-or-your-friends-2/)y on the topic.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 25, 2011, 08:46:55 PM
hmmm...   these errors just started showing up today:

2: in_array() [<a href='function.in-array'>function.in-array</a>]: Wrong datatype for second argument
File: /....../Sources/bad-behavior/bad-behavior/roundtripdns.inc.php
Line: 27

I need to think about this some...
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 26, 2011, 08:59:10 AM
Kindred.  Try the attached and let me know if it solves the issue?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Kindred on February 26, 2011, 12:12:15 PM
immediate errors

8: Undefined index: badbehavior_roundtripdns
File: /home/fortyk/public_html/community/Sources/bad-behavior/bad-behavior/roundtripdns.inc.php
Line: 25
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 26, 2011, 01:11:37 PM
That line did not change from the last version (Bad Behavior 1.4.1).  Version 1.4.1 includes the new 'badbehavior_roundtripdns' modsetting.  So if you do not have the latest version please update.  If you upgraded please go to the setting page and hit save so that the modsettings will get saved in to the mysql database.

The attached version should eliminate that in the future.  But it will not do anything unless the modsetting exists.

You may see an error burp if someone is online during the installation.  This happens when the file changes while it is being used.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Glasso on February 26, 2011, 01:23:51 PM
Code: [Select]
[quote author=Glasso link=topic=375980.msg2967788#msg2967788 date=1298618445]
I have bad behaviour installed but most connections from phones are bloceked. Here is more detail:

DENIED REASON: Header 'Connection' contains invalid values
EXPLANATION: An invalid request was received. This may be caused by a malfunctioning proxy server or browser privacy software. If you are using a proxy server, bypass the proxy server or contact your proxy server administrator.
ERROR: 400

Bad Behavior it's self is extremely conservative, is being used by a large volume of web sites, the package has strong support and does everything possible to prevent blocking valid users.

In extremely rare circumstances, Bad Behavior may block actual human visitors. Bad Behavior was designed to target robots, not people. If this happens, the profile presented by your browser matched that seen from actual malicious robots. In some cases, this is caused by over-aggressive personal firewall/browser privacy software. In other cases, this is caused by improperly configured Web proxy server software.

First, make a note of the technical support key and e-mail address shown on the error page. Then click the link to “fix it yourself” for suggestions on how you may be able to resolve the problem.

If you continue to have trouble, contact the e-mail address on the error page and be sure to provide the technical support key "a52f0448". This will allow the site administrator to tell you what you need to do to resolve the problem.

If you are the site administrator receiving a trouble report from a user, contact me and provide the technical support key and a copy of the logs which Bad Behavior stores in the database showing the IP address which was blocked. The core author provide further assistance until the trouble is resolved.

For more information on how to diagnose a Bad Behavior blocking problem, see the Bad Behavior weblog entr (http://bad-behavior.ioerror.us/2007/12/07/what-to-do-when-bad-behavior-blocks-you-or-your-friends-2/)y on the topic.

Hi butchs,

I understand; I have sent you the logs by email. Appreciate your help, thanks.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 26, 2011, 01:31:08 PM
No problem but, the core author is Michael Hampton.  He will investigate your request and make adjustments or suggestions as required based off of your feedback and the thousands of others he gets every day.  Then I will incorporate those changes into the SMF port.
 O:)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Glasso on February 26, 2011, 02:14:56 PM
No problem but, the core author is Michael Hampton.  He will investigate your request and make adjustments or suggestions as required based off of your feedback and the thousands of others he gets every day.  Then I will incorporate those changes into the SMF port.
 O:)

Man, Michael is quick! He confirmed there is indeed an issue with what header the Nokia phone/service provider is sending and that BB is working as expected.

Butchs, if you don't mind taking a look at the Forum Firewall log with a bunch of 'keep-alive's in the IP field, please PM me your email id.

Many thanks.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 26, 2011, 02:37:58 PM
Butchs, if you don't mind taking a look at the Forum Firewall log with a bunch of 'keep-alive's in the IP field, please PM me your email id.

What happened in BB is not the same as FF.  The tests are not the same.  BB does not look at the ip address field.  It checks the "Connection " where Keep-alive are supposed to reside.  When that field is in error it is blocked.

Now Michael has been working on the Core for over 5 years and the core is so widely used that he actually has the umph to have Nokia fix the header or face being blocked from many sites.

This is why BB is the choice for spambot protection by many sites.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on February 27, 2011, 08:12:00 AM
New update posted today.  Changes are minor, only upgrade if you are experiencing errors in your log.
  :D
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: fiver on March 01, 2011, 01:13:38 AM
SMF 2 RC5
Bad Behavior 1.4.2


What should the permission be for core.inc.php? Mine is set 666. Is that correct?





2: require_once(/Sources/bad-behavior/bad-behavior/banned.inc.php) [<a href='function.require-once'>function.require-once</a>]: failed to open stream: Permission denied

File: /Sources/bad-behavior/bad-behavior/core.inc.php (http://www.fivearts.net/index.php?action=admin;area=logs;sa=errorlog;file=L2hvbWUvZml2ZWFydHMvcHVibGljX2h0bWwvU291cmNlcy9iYWQtYmVoYXZpb3IvYmFkLWJlaGF2aW9yL2NvcmUuaW5jLnBocA==;line=19)
Line: 19
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 01, 2011, 06:51:22 PM
Do not change the permission of banned.inc.php.  Ignore the change request.

The reason is the method I have to install the mod, first I install the BB  package then write over the banned.inc.php file.  I checked my file in cpanel and it's permissions were fine so no changes are required.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 01, 2011, 07:10:52 PM
The read me has red letters that tell you that when you install the mod with 2.0x you may get a permission error.  If you listen to SMF and change the permission, I have found exactly what that user has posted.  So unless his server acts differently than my test server uninstall the mod, reinstall it and do not change the permissions and it should work.

Here is the readme text:
During installation of SMF 2.0x, SMF may ask to "Restore File Permissions" for "banned.inc.php".  Do not make any changes!

If not then you find that you need to change the permission do it in cpanel.  Make it the same as all the other files in the BB folder.

Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 01, 2011, 07:19:16 PM
Duuh, if you do not follow the instructions in the read me during installation then you risk having a problem after installation.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 01, 2011, 07:40:17 PM
Each server may have a different set of default permissions.  Sites such as host gator do not allow you to use 666 or 777 because they are world writeable.  If you do not know what works on your server contact your host and ask them what permission to use.

Besides, I run a gentile Web Site and as such do not have files set with the Devils Permissions.   O:)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 05, 2011, 02:16:45 PM
The following was taken fro the Forum Firewall thread:
Butchs, this is causing some genuine googlebot requests to be blocked as I see in my webmaster logs. I can send you some trail that I had with Michael where he thought roundtripdns is not fully reliable, if you believe it is worthwhile to go deeper.

A statement by Michael may not apply with the SMF version.  My version has improved DNS tests and has been running on my site for well over 6 months with ZERO issues.  Needless to say that it is not 100%, fake bots can still get past.  As per the help icon "?" and stated before my roundtrip works fine for some sites but if your host is using Ubuntu 10.x it may not work.  In that case uncheck "Search Engine DNS".

The following is taken from the core website:
Quote from: bad-behavior.ioerror.us
Google operates a proxy server for “feature phones” (dumb mobile phones; perhaps should be called feature limited) with limited Web browsers which reformats web pages into a simpler format for viewing on such phones. While it is now rarely used, requests from this proxy server, known as Google Wireless Transcoder, were being treated as search engine requests (and denied for not being a search engine). This issue has been fixed.

Please note the rare statement.  I personally have not seen the google wireless bot get blocked.  So unless you have a popular website with over 400 visitors a day there is the chance that the bot you are seeing may or may not be a fake.  This is the internet and anything can be spoofed.  Do you think the bad guys will never try to edit google?    ::)

I do not know what to tell you, nothing is perfect.  BB runs on many sites that get thousands of blocked visitors a day.  He uses his best judgement.  When the core author sees a major problem he will upgrade and this mod will follow.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Glasso on March 05, 2011, 03:12:02 PM
The following was taken fro the Forum Firewall thread:
Butchs, this is causing some genuine googlebot requests to be blocked as I see in my webmaster logs. I can send you some trail that I had with Michael where he thought roundtripdns is not fully reliable, if you believe it is worthwhile to go deeper.

A statement by Michael may not apply with the SMF version.  My version has improved DNS tests and has been running on my site for well over 6 months with ZERO issues.  Needless to say that it is not 100%, fake bots can still get past.  As per the help icon "?" and stated before my roundtrip works fine for some sites but if your host is using Ubuntu 10.x it may not work.  In that case uncheck "Search Engine DNS".

Butchs, I am providing my feedback to you because I love your mod and appreciate your efforts. I was thinking further inputs will help you make it watertight for all of us, but I will step back if you see this as fault finding! I have stepped on enough peoples' toes today already. ;)

I looked for the "?" before I made any posts but could not find any for BB (the way I see for FF, for example). Not sure if it is just an issue for me - please see attachments 1 & 2.

My server is not Ubuntu, I have disabled Search DNS today anyway.

Please note the rare statement.  I personally have not seen the google wireless bot get blocked.  So unless you have a popular website with over 400 visitors a day there is the chance that the bot you are seeing may or may not be a fake.  This is the internet and anything can be spoofed.  Do you think the bad guys will never try to edit google?    ::)

I would not contest anything you say since you are the expert here, I can only give you an example why I thought a genuine request was blocked and you can take a call. Please see attachments 3 & 4, where I tried to pick a BB block and find the corresponding line in google webmaster log - I may be off the mark in trying to correlate thus.

I do not know what to tell you, nothing is perfect.  BB runs on many sites that get thousands of blocked visitors a day.  He uses his best judgement.  When the core author sees a major problem he will upgrade and this mod will follow.
Agreed. I see you as the two architects working hand in hand to implement this great tool, so I do not want to risk misrepresenting anything here. I rest my case here and thank you for your time and support.  8)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 05, 2011, 05:41:03 PM
I have disabled Search DNS today anyway.

I have known about this for a while and was notified of the same issue many posts ago.  This feature is an option because it will not work for everybody.  There is no way for me to tell where it will and will not work.  It seems that the test did not work for you at that time.  In your case I would leave the "Search Engine DNS" option disabled.  This is also why it is disabled when the mod is installed.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Blade_Runner on March 08, 2011, 07:24:14 AM
This mod blocks RSS view in iPhone. How to fix this problem?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 09, 2011, 06:46:28 PM
I answered that one over at SMFhelper.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Jesna on March 11, 2011, 11:30:20 AM
Hi butchs

Is there an update/news on the fail like this:

Code: [Select]
Database Failure: No database selected
Fil: /home/XXX/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Linie: 74

/Jakob
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 12, 2011, 06:43:20 AM
No one else is experiencing that error.  It looks like the mod did not install all the way and the DB was not installed.  Try installing again.  If you went manual you need to run "install_db.php".
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Illori on March 13, 2011, 05:07:49 PM
Hi butchs

Is there an update/news on the fail like this:

Code: [Select]
Database Failure: No database selected
Fil: /home/XXX/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Linie: 74

/Jakob

I am getting this error as well on my forum, I did not do a manual install, but attempting to run install_db.php gives this message:

No database selected
File: ..../install_db.php
Line: 263
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 13, 2011, 05:36:35 PM
For some reason your DB is not set on your site.  You should check your "Settings.php" file and confirm the DB is correct.  Try running Repair Settings.php (http://download.simplemachines.org/?tools) and see if you have an issue.  Then try to completely uninstall the mod and reinstall it.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Illori on March 13, 2011, 06:39:51 PM
the database is just fine the mod seems to work just fine as well, other then that error message.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 13, 2011, 08:24:57 PM
All I know is that there was a problem with the old SMF 1.1.x (possibly beta) version where it did not use the correct $db_prefix.  This was fixed in a newer version.

If you completely uninstall the mod including deleting the DB or the "smf_settings: badbehavior_log_table" entry in phpmyadmin and reinstall the latest version that old version bug should go away.

Other than that, any thing could be causing it, including another mod/ portal, I will need to be able to somehow duplicate the error or see it in person in order to tell you what is going on.  Try the above and if it does not go away then please provide  your SMF version and a list of all your mods/ portals.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Illori on March 13, 2011, 08:28:40 PM
my forum is not that old to have that problem, it started with 1.1.11 and upgraded to 1.1.12-1.1.13.

currently installed mods
Code: [Select]
1. Aeva Media 1.4  [ Uninstall ] [ List Files ] [ Delete ]
2. Internal_Links_Use_Same_Window 1.2  [ Uninstall ] [ List Files ] [ Delete ]
3. Easy Edit Meta Data 1.1  [ Uninstall ] [ List Files ] [ Delete ]
4. Bookmarks 2.3 [ Apply Mod ] [ List Files ] [ Delete ]
5. Custom Profile Field Mod 3.20  [ Uninstall ] [ List Files ] [ Delete ]
6. SMF 1.0.21 / 1.1.13 Update 1.0  [ List Files ] [ Delete ]
7. Version Emulate Dropdown 1.1  [ Uninstall ] [ List Files ] [ Delete ]
8. SMF 1.0.20 / 1.1.12 Update 1.0  [ Uninstall ] [ List Files ] [ Delete ]
9. Who Voted What? 1.1.3  [ List Files ] [ Delete ]
10. DisableTemplateEval 1.2  [ Uninstall ] [ List Files ] [ Delete ]
11. Bad Behavior mod 1.4.2  [ Uninstall ] [ List Files ] [ Delete ]
12. Allow Access while in Maintenance Mode 1.1  [ Uninstall ] [ List Files ] [ Delete ]
13. Forum Firewall 1.0.8  [ Uninstall ] [ List Files ] [ Delete ]
14. Ad Managment 2.3.6.1  [ Uninstall ] [ List Files ] [ Delete ]
15. Downloads System 1.3.4.2  [ Uninstall ] [ List Files ] [ Delete ]
16. Bot Buster 1.1  [ Uninstall ] [ List Files ] [ Delete ]
17. httpBL 2.5.1  [ Uninstall ] [ List Files ] [ Delete ]
18. Login Detector 1.0  [ Uninstall ] [ List Files ] [ Delete ]
19. SMF 1.0.21 / 1.1.13 Update 1.0  [ List Files ] [ Delete ]
20. SMF 1.0.21 / 1.1.13 Update 1.0  [ List Files ] [ Delete ]

in the error message the file being called is index.php.

Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 13, 2011, 08:35:44 PM
my forum is not that old to have that problem, it started with 1.1.11 and upgraded to 1.1.12-1.1.13.

I can not help you if you do not work with me and try what I ask.

Why do you have two of there "SMF 1.0.21 / 1.1.13 Update   1.0     [ List Files ] [ Delete ]"?  This does not look right...
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Illori on March 13, 2011, 08:36:58 PM
the update was applied one time, but for some reason the package shows up 2 times no idea why. since the rest of the forum works fine i am not going to play with checking settings.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 13, 2011, 08:38:51 PM
Then I can not help you.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Illori on March 13, 2011, 08:40:16 PM
well then this mod is useless to have on my forum as i will get no support from the author. there goes 2 of the mods off my forum.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 13, 2011, 08:43:17 PM
Do you think I have ESP or something?  How could I help you when you will not work with me?

Honestly, I created the mods for my site.  They worked so well I decided to share them.  If you do not want to use them so be it...
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 13, 2011, 08:47:30 PM
In reply 158 I gave him instructions.

If you completely uninstall the mod including deleting the DB or the "smf_settings: badbehavior_log_table" entry in phpmyadmin and reinstall the latest version that old version bug should go away.

He refused.  Therefore, I can not help him.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Illori on March 13, 2011, 08:49:29 PM
first off you gave HER instructions and i replied with the needed information, you said the prefix issue was with an OLD version of smf which i dont run and never have on this site, I gave you a list of my mods that are installed and you refuse to look further into the issue. I have wasted enough of my time in this thread.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 13, 2011, 08:52:25 PM
If you want to be a her then show your sex.  I do not have ESP.   :(

I was talking about the mod.  Read the posts again.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Daley on March 20, 2011, 01:17:50 PM
First off, thanks Simple Machines for an awesome forum software. Easy to use, easy to maintain and easy to admin. Second, thanks butchs for not only the amount of time you've put into the mod, but also the amount of time you've spent supporting it.

I've spent a few hours (well more than that actually, but don't want to admit how much!) trying to get the mod installed and working. I'm on .13 and was able to successfully upload the package, apply the mod and install. I get the "settings" page, so it *appears* as though everything's there - but when I add the test string to my UA, I don't get blocked and no matter what I've tried I don't get the string of text for BB when I view source. I've tried from a few different machines with various OS's as well as a few different IP's (from work as well as from home).

As I read through this (or possibly another) thread, I remember seeing that there are two parts to installing this - the mod itself and then an install; however, I can't seem to find the "install" part - the page linked to in the first post has the mod (which installs fine), but there's no separate install that I've been able to find.

What am I missing?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 20, 2011, 02:09:44 PM
Thank you.

That is good.  If you are logged in as the ADmin the test string will not work.  Log out and try it, then it will work.

This is done to prevent you from being blocked.
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Daley on March 20, 2011, 02:49:33 PM
Thanks for the quick reply! I did try it as admin, as a normal user and as guest, testing with and without the UA string set - I still see nothing. In fact, I don't even see the BB text in the HTML source, no matter what I've tried. It seems like I'm missing a piece somewhere. Is there only supposed to be the one download or should there be both a "mod" and "install" package?

What information can I provide in order to help with this?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 20, 2011, 05:10:47 PM
If you have a UTF8 sight you will need to copy the "Themes/default/languages/BadBehavior.english.php" and rename the copy "BadBehavior.english-utf8.php".  Reload your browser.  Then you can see the Bad Behavior menu in the admin section below "Configuration/Themes and Layout".  You will need to go there and turn on (enable) the mod in order to start to protecting your site.

The mod is now only 1 part.  A second part is not required.

To test the mod you will need to log out of your forum and replace your UA with "Bad Behavior Test".
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: Daley on March 20, 2011, 06:54:39 PM
Success! Well, sorta... I found that the mod's "status" text in the footer only appears with the default theme (my forum's default theme isn't the SMF default). Your point about renaming the BB.english.php file clued me in - that file is located in the ./Themes/default/... directory, so I reverted back to the default theme for my test user account and started seeing all the things I was missing (footer, BB message in HTML source, etc.).

Thanks again!
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 20, 2011, 06:58:55 PM
Even though it was dumb luck on my part I am glad I could help you.  ;)
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Five Years
Post by: butchs on March 26, 2011, 08:06:19 AM
New version was released today.  No code changes were made to the English version.  Support for Spanish has been added.

Thanks to xaquin this is the only release of Bad behavior that completely supports spanish-es, spanish-es-utf8 and spanish-latin languages.

The SMF mod is in Spanish as are the help icons and the BB core has been translated.
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 02, 2011, 10:02:41 PM
New version:

Added project honey pot to the admin panel.   This was hidden for some time.
Improved spanish loading.  The last version did not load all the files.
Added an option to block blank UA's.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Smog on April 03, 2011, 06:53:52 AM
Thanks for the new version 1.4.4, how to update from v1.4.2?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 03, 2011, 07:07:56 AM
Uninstall the old version.  You can keep the database.  Delete the old version.  Then download and install the new version.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Smog on April 03, 2011, 07:12:35 AM
OK, thanks for the reply.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 03, 2011, 08:11:55 PM
You are welcome. :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Omebolle on April 06, 2011, 10:08:24 AM
Installed after being harassed by spam bots yesterday. But I'm a rookie and have no idea what you mean by this : To test:
To insure that Bad Behavior is functioning correctly you can add the sting "Bad Behavior Test" to the User Agent (UA) of a HTTP request from someone who is not in the whitelist  
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Kindred on April 06, 2011, 10:14:34 AM
google is your friend
http://johnbokma.com/mexit/2004/04/24/changinguseragent.html
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Omebolle on April 06, 2011, 10:22:53 AM
will try that, thanks 8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 06, 2011, 08:33:02 PM
You need to log out to test.   Or you can wait.  You should see something on the "DENIED ENTRIES LOG" long in a day or two.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Omebolle on April 07, 2011, 03:53:11 AM
Ok I'll wait a bit because that testing with UA goes beyond me  :-\
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: ziycon on April 07, 2011, 03:57:41 AM
Nice mod, been using it 24 hours now and its catching a nice few spam bots :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Omebolle on April 07, 2011, 04:18:49 AM
Sorry, maybe not the place to discuss this, but don't know where to talk about it elsewhere :-[

I have a small  forum, never thought of setting the registration to "wait for approval by admin" did that after the spam and now I have caught one unknown member with the same IP address as the spam bot. So that may be why the mod didn't log a spam bot yet. Can those bots bypass that "approval by me"?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 07, 2011, 08:03:47 PM
You can drastically improve protection by registering with project honeypot (http://www.projecthoneypot.org/) and entering a "Access Key", Threat Level and age.  Click on the "?" for more info.

 
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Omebolle on April 09, 2011, 05:10:57 AM
Think I managed that, but caught one more like this... Thanks for the info
I looks like they can't bypass the approval by admin?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 09, 2011, 07:26:36 AM
Besides CrawlProtect, Forum Firewall and Bad behavior I use Stop Spammer and Avatar Verification with over 100 images.  This has proven to be highly effective in stopping spam.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Robi052 on April 10, 2011, 02:14:01 PM
After upgrade to 1.4.5 cannot open key on log.

SMF 2.0RC4

mods

1.   RSS Feed Icon    1.1
2.   SMF 2.0 RC4 Security Patch    1.0
3.   Simple Audio Video Embedder    1.1.1
4.   Separated Birthdays from Events    1.1.6     
5.   Facebook_Like v.1.4   
6.   Login Security    1.0.2.2     
7.   AvatarSelect    1.2.1     
8.   Ultimate Profile    0.9.1     
9.   No Reply Emails    1.3.7 
10.   LMGTFY BBcode    3.7 
11.   Bad Behavior mod    1.4.5 
12.   PNG Message Icons    1.3.1 
13.   Pretty URLs    1.0RC5 
14.   Global Headers Footers    2.0 
15.   CSS Message Boxes    1.1     
16.   Advanced Reputation System    1.8.3 
17.   New Topic in Seperate Color    1.1 
18.   Dynamic_Memberlist    2.0.5     
19.   Users Online Today    1.5.6     
20.   last login    2.5     
21.   Wireless/RSS amount displayed   1.1.0
22.   Happy Birthday    0.2.2     
23.   Password Strength Meter    1.1
24.   Anti-Spam Links    1.0.1     
25.   ENotify    2.0     
26.   Project Snow 1.1   
27.   Default Avatar
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 10, 2011, 04:21:58 PM
I saw that this morning and made a change.  I thought no one grabbed a copy.  Try to re-download a fresh copy and install.


Any 2.0 installations that uploaded before this post was made will need to re-upload.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: KDD on April 10, 2011, 10:52:00 PM
Thank you for all your time you spent creating and supporting this mod  ;D. I am new to SMF and making my around installing different mods (this one too).
I am running 2.0RC5 with Simple Portal.

1. What files should I copy the Bad Behavior image code to ?
2. Do have to sign-up to HoneyPot to get the access key for my site?
3. If # 2 is true, will I get a HoneyPot link for my settings?
4. Is it advisable to block empty user Agents if paypal is not involved at our site yet?

Thanks again.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 11, 2011, 05:26:40 AM
1.  None just install the mod.
2.  Yes.
3.   Yes you can.
4.  Not recommended but a few do.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: KDD on April 11, 2011, 05:50:14 AM
Thanks, where are the images suppose to be displayed?
I don't see any images in the footer. If that is where they are displayed.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 11, 2011, 05:59:52 PM
You mean something you tried to post?  I have no clue.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: KDD on April 11, 2011, 07:37:13 PM
Quote

Code: [Select]

<p><a href="http://www.bad-behavior.ioerror.us/">
<img src="http://www.bad-behavior.ioerror.us/images/bad-behavior-80x15.png"
alt="Bad Behavior" height="15" width="80" /></a></p>>

No, this image from the OP.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 11, 2011, 07:58:48 PM
You need to put the image on your your site and adjust the image link.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 12, 2011, 02:08:24 AM
Core update to 2.1.12.  No mod changes.

What's new:
Quote
Google is now operating a new IP address range in China, from which it is crawling some Web requests. Interestingly, it is crawling all countries from this Chinese address range. Bad Behavior is now aware of this address range and will no longer block requests from Google which originate in China.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: ALLSTARR on April 13, 2011, 08:41:43 AM
Sorry but i only see one rar file !
Bad Behavior 1.4.6
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 13, 2011, 08:04:06 PM
I do not understand.  The mod does not have a rar file.  It is compressed in winzip.  This is the standard for SMF.  The mod now only needs the one zip file.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: busterone on April 13, 2011, 09:26:43 PM
I think I understand what he meant. Looking at the mod download page, the only 2 files listed is  Bad_Behavior_1.4.6.zip and  BB_Language.zip.

Oh, I missed that too. There is a difference between the core and the mod itself. He probably did not see that. 
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: ALLSTARR on April 14, 2011, 06:40:57 AM
So where is the link for the corefile then?
Sorry but im kind off busy with that hole honey pot stuff,but really...i dunno where too put the links intoo?
do they mean in the index.template file?and where too put it?just copy and paste somewhere?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 14, 2011, 06:41:26 PM
No.  I explained this before.  The mod is not a 2 part mod anymore.  Version 1.4.x includes both the core and the mod.  The language file is only for translating the mod to another language.  If you want the mod and core install the latest version of the mod to have both.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Smog on April 17, 2011, 05:04:25 AM
Want to uninstall Bad Behavior v1.4.2 and install v1.4.6, regrettably no uninstall button available, uninstaller file is missing (anyway, I assume), only the 'list files' and 'delete' buttons are visible. What to do?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 17, 2011, 07:48:30 AM
The uninstall file is present in the package.  First you have to uninstall the old version before downloading the new version.  Whatever you do, do  not install the new version until after you uninstall the old version.  If you do you will have to manually edit your SMF files.

I guess there could be the chance that the "Bad_Behavior_1.4.2.zip" in your Package directory became corrupt via your host?  If you have a copy on your local drive the try using ftp to replace the "Bad_Behavior_1.4.2.zip" in your package directory.  If you do not have a copy plz PM me you email.

Otherwise I think you may have a package directory issue that may be something SMF support will be better at resolving.

Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Smog on April 17, 2011, 08:04:13 AM
The uninstall file is present in the package.  First you have to uninstall the old version before downloading the new version.  Whatever you do, do  not install the new version until after you uninstall the old version.  If you do you will have to manually edit your SMF files.

I guess there could be the chance that the "Bad_Behavior_1.4.2.zip" in your Package directory became corrupt via your host?  If you have a copy on your local drive the try using ftp to replace the "Bad_Behavior_1.4.2.zip" in your package directory.  If you do not have a copy plz PM me you email.
Performed as suggested (replaced Bad_Behavior_1.4.2.zip in the package directory by a copy on my PC via ftp) but the uninstall button is still missing. What's the name of the uninstall file in the package?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 17, 2011, 08:16:07 AM
package-info.xml contains the uninstall script.  This link (http://www.simplemachines.org/community/index.php?topic=408778.msg2848033#msg2848033) may be of interest.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Smog on April 17, 2011, 08:44:38 AM
Assume I found the cause and the fix, will report back atm I have finished successfully the uninstall v1.4.2
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Smog on April 17, 2011, 10:50:34 AM
Cause of the prob: installed the mod on a SMF 2 version older than 2.0 RC2

During install v1.4.2 I encountered no probs, I emulated SMF 2.0 RC2 and the mod installed without any protest. Didn't expected that for uninstall it was also demanded to emulate SMF 2.0 RC2, atm I emulated to RC2 the uninstall button appeared.  :)

Some questions:

Search Engine DNS: what is advisable, activating or not?
Cache Duration: the time delay can be set between 0 and 99 seconds, zero disables this feature, standard is the value zero. Is it advisable to set a time delay, and if yes, what value at least to be effective?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 17, 2011, 03:18:27 PM
Interesting...

Search Engine DNS: what is advisable, activating or not?

I use it and it works well for my site.  I have been using it for 6 months now.  It blocks a fake google and etc every now and then.  But some servers such as Ubuntu have issues.  If you try it, I suggest you monitor it for a few days to make sure no regular members get blocked.

Cache Duration: the time delay can be set between 0 and 99 seconds, zero disables this feature, standard is the value zero. Is it advisable to set a time delay, and if yes, what value at least to be effective?

This feature was designed to reduce the amount of checks the mod makes when testing a user for large forums.  For example, if a bad guy hits your site BB will test it the first time.  If the bad guy is blocked the mod will forgo testing and block the bad guy the remaining duration of the cache set point.  The same is true if a regular member comes to the forum.  The member will not be tested again the duration of the cache set point.

Typically you like to set this to half the average duration of a bad bot visit but in most cases no more than 20 or 30 seconds.  As a minimum you will like to test a bot two times a visit.  Some people prefer three to four times.

If you have cpanel or some other way of tracking the last 100 users, you can look at visitor ip records.  Take the duration of the average visit and divide by at least two.  If you can not do this then 2-8 seconds can be a good starting point.

Why use this feature?  Well, a bad bot can hit you once or twice every second and eat up your bandwidth and/ or processor speed.  This feature can make your site faster because it will send the bots packing before SMF fully loads (ie page images/ icons).

The reason it is not recommended is because Bad behavior is extremely fast in the first place.  Bad behavior's core author has informed me that the package has been installed on some large CMS sites and it sill completes all tests in less than 10 milliseconds.  If you look at the page source (just below the title when viewing the main index) you will see the speed of this mod at work:  <!-- Bad Behavior 2.1.12 run time: 3.025 ms -->.

However, if you are using the Project Honey Pot portion and/ or enable the Search Engine DNS features or have a large web site I will recommend using a little cache.

The reason for using cache on a large forum is obvious so I will not get into it.  The other two are less obvious.  The reason I recommend cache for them because they both look up information at a remote site.  Some say this can slow things down.  So by using cache you reduce the amount of remote lookups your site makes.
 8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Smog on April 17, 2011, 04:09:40 PM
Thanks for the comprehensive reply, appreciated. I also appreciate all the time and efforts you invest in this mod, even more because the mod work extremely well.

Malicious or spam related activities are a serious problem and have heavy, severe impact on sites and their legal visitors. Problems related to mentioned activities are immense and on the rise, OTOH there are several solutions to limit or even to cease malicious activities on sites. Bad Behavior is one of the solutions and I must say, till yet the most effective solution, there is no doubt about that fact. Using Bad Behavior together with a http:BL Access Key the mod work deathly effective and block almost all malicious site activities, hence Bad Behavior is a must have tool for site owners taking their job serious: protecting their site as well customers and legal visitors.

Also important to mention: till yet no legal visitor, search engines included, was blocked, we shouldn't underestimate the importance of this.

I'm very pleased about the mod, and will unconditionally recommend it to fellow site owners.

Kind regards,

Smokey
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 17, 2011, 05:17:07 PM
You are welcome.

Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Col on April 18, 2011, 08:56:10 PM
Hi,

Does the 'local timezone' refer to my personal timezone, or the zone where the server is located?

What is the purpose of this setting?

Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Col on April 19, 2011, 11:56:02 AM
Oh, and where do I have put the .htaccess file? Is the site root, or the BB root?
Title: Re: Bad Behavior mod - Turning the Spam Flood Into a Trickle for Years
Post by: Col on April 19, 2011, 06:37:07 PM
The mod does not give out your email as a normal email.  If your email is admin@yoursite.com it shows admin at yoursite.com.  A human/ spammer will have to correct and type it in order to be able to send you a message.  So the chances are low that you will get spammed.

This is included so that regular users can contact you for access.  For example, someone you know logs in and gets ERROR 403.  They can then use this error to send you a message and get placed on the whitelsit by you.  If you did not give them a method to contact you, they will never be able to log in.

The email listed is from the "Webmaster Email Address" listed in "admin -> server settings -> general -> Webmaster Email Address".  It is not recommended but, if you do not want your email address showing up leave the above setting blank.

Hello Butchs,

I've never looked into it, but I assume that spammers have systems in place to automatically remove simple obfuscation from harvested e-mail addresses. This must be a trivial matter compared to cracking anti-spam measures such as reCaptcha, etc. So, I will be changing this behaviour to protect my website from possible spam. I think it would be better to instead provide an admin setting so that we might specify a URL. The destination webpage could be a contact form (my intention), or just a set of instructions for how the visitor might fix the problem (in my view, not the best solution).
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 19, 2011, 08:28:00 PM
Does the 'local timezone' refer to my personal timezone, or the zone where the server is located?

What is the purpose of this setting?

Where do I put htaccess?

In most cases you will not need that setting.  You only need to worry about it if you get an error.

An error will look like this:
Quote
Strict Standards: bb2_install() [function.bb2-install]: It is not safe to rely on the system's timezone settings. Please use the date.timezone setting, the TZ environment variable or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/New_York' for 'EDT/-4.0/DST' instead in .../BadBehavior-SMF.php on line 202

Notice: Undefined index: logging in .../BadBehavior-SMF.php on line 202

If you get it ask your host for assistance.  Some times they do it in the php.ini file.  It depends on the provider.  If so, it will be your home time zone.

I've never looked into it, but I assume that spammers have systems in place to automatically remove simple obfuscation from harvested e-mail addresses...

I have looked into it and my method is rather unique.  It is even different than the BB core.  I am not going to tell you what I do... Rest assured at publishing time my methods were not used anywhere else on the net.  I only write code for SMF so it is way too much trouble for a bot to make code just to harvest email addresses from my mods.  Caputa is much easier since it is more common.

Edit the following to make it even harder:
Take "BadBehavior.english.php" and change $txt['badbehavior_theadmin'], $txt['badbehavior_nospam'], $txt['badbehavior_dot'] and $txt['badbehavior_dash'] to something unique.

You are safe with the SMF BB mod.

The destination webpage could be a contact form (my intention), or just a set of instructions for how the visitor might fix the problem (in my view, not the best solution).

You miss the point of bad behavior.  BB provides a link to the BB home address and a support key.  So the support is dealt remotely by the BB home site or by you.  This is the power of the mod.  Literally millions of other sites use the same support system.  The following is taken from the BB site:

In extremely rare circumstances, Bad Behavior may block actual human visitors. Bad Behavior was designed to target robots, not people. If this happens, the profile presented by your browser matched that seen from actual malicious robots. In some cases, this is caused by over-aggressive personal firewall/browser privacy software. In other cases, this is caused by improperly configured Web proxy server software.

First, make a note of the technical support key and e-mail address shown on the error page. Then click the link to “fix it yourself” for suggestions on how you may be able to resolve the problem.

If you continue to have trouble, contact the e-mail address on the error page and be sure to provide the technical support key. This will allow the site administrator to tell you what you need to do to resolve the problem.

If you are the site administrator receiving a trouble report from a user, contact me and provide the technical support key and a copy of the logs which Bad Behavior stores in the database showing the IP address which was blocked. I will provide further assistance until the trouble is resolved.

For more information on how to diagnose a Bad Behavior blocking problem, see the Bad Behavior (http://bad-behavior.ioerror.us/) weblog entry on the topic.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Col on April 20, 2011, 08:44:14 AM
Hi,

Thank you for your reply, Butchs.

I had someone else try entering my test forum using Modify Headers - I was reliant upon their feedback. They had a problem with a malconfigured email client, so their email program did not start when they clicked the contact email link provided. I had them instead right-click the email link to provide me with address - it was address listed for Webmaster Email Address in Server Settings, but with some no-spam obfuscation. This is where I'm confused by your reply - I thought this unobfuscated address easily discernible.

I am also confused by the practical difference between providing a direct email link and a link to a contact page, which generates an email to me, without ever revealing even an obfuscated version of my address. Reading your reply, I'm sure I must be missing something - but what is it!?

I don't properly understand how BB works (I don't really need to), but I like the idea of addressing this spam problem at a more fundamental level, without the need to resort to checking content, IP address, etc. I have my own (human) system in place, to act as a final check, before the first post of the new member ever makes it to the open forum (few make it this far). Any member of the team can approve the account by approving their first post, so there is usually little delay to genuine members. I do not anticipate needing Project Honeypot that you have usefully integrated into BB, as I never have spam reaching my forum boards. But I do suffer from an inordinate number of spam accounts (swamping the membership list), and bandwidth being eaten up by their attempts to join up and post at the forum. I anticipate substantial bandwidth savings using BB.

Again, thank you,

Colin.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 20, 2011, 09:11:19 PM
Only with the stand alone core but this is not the core!  This is the SMF Version which is much more secure...

You need to look for yourself and not rely on people who are trying to sell you something.  There are way too many people who are into smoke and mirrors who make up things to sell something.  Lame...

Take the troll I finally rid my mod posts from.  He claimed to be trying to help but if you read his posts they were nothing but self promotion.  All along he simply wanted to copy my ideas.  Glad the posts were deleted...

Edited because I have been mean to my troll so I decided to chill out and let things be.  Sorry...

The truth of the matter is that bots look at source code.  If you want to see what the warning page looks like to a bot look at it in your browsers view source mode.  Your webmasters email will be different on every page load.

Even if you click on your email address you will get an address as I described with the "BadBehavior.english.php" edits.  Basically the bot will have to edit the email to make it usable.  If you edit "BadBehavior.english.php" yourself, as advised, it will be even more unique.  Which is great for stopping spam.

There is no such thing as a webmaster "direct email link" or "unobfuscated address" with this mod unless you make it that way.   The mod only provides an obfuscated address that the emailer has to figure out.  They are usually easily discernible to experienced internet users.  But as stated before you can edit them to whatever you desire.

Bots are automated scripts when you throw something at them they never encountered they fail!

Nevertheless, I do not understand your concerns?  As stated in my last post the member has the ability to  “fix it yourself” through the vast Bad Behavior network.  So your webmaster email is the last resort not the first or only resort.  Please re-read my last post...  Then you will realize it is the last resort.

Now this mod has another feature that BB core does not have and that is the ability to place a Project Honey Pot - Honey Pot or a QuickLink in the Warning Page.  What this means if a bot went nuts and clicked on all the links in the warning page it will get penalized with an increased Project Honey Pot warning level.  Not only a deterrent but a no win situation for the bot.

So when it comes to webmaster link security rest assured, I have all the bases covered and will up the technology if and/ or when required.   8)

Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Col on April 21, 2011, 06:31:28 PM
Only with the stand alone core but this is not the core!  This is the SMF Version which is much more secure...

You need to look for yourself and not rely on people who are trying to sell you something.  There are way too many people who are into smoke and mirrors who make up things to sell something.  Lame...

Take the troll I finally rid my mod posts from.  He claimed to be trying to help but if you read his posts they were nothing but self promotion.  All along he simply wanted to copy my ideas.  Glad the posts were deleted...

Hello Butchs,
 
Thank you for the very fulsome reply.
 
No one is trying to sell me anything.

Quote
The truth of the matter is that bots look at source code.  If you want to see what the warning page looks like to a bot look at it in your browsers view source mode.  Your webmasters email will be different on every page load.

Even if you click on your email address you will get an address as I described with the "BadBehavior.english.php" edits.  Basically the bot will have to edit the email to make it usable.  If you edit "BadBehavior.english.php" yourself, as advised, it will be even more unique.  Which is great for stopping spam.

I tried it out for myslef, after I was pretty confident I would not lock myself out of the forum. I had a look at the source - I'll take your word for it that a bot is highly unlikely to be able to make sense of what looks to me (as a non-coder) to be some sort bastardisation of html numbers and unicode.

Those that fail the BB requirements are presented with the following:

Quote
Error 403 We're sorry, but we could not fulfill your request for /forum2/ on this server.
You do not have permission to access this server.
Your technical support key is: xxxx-xxxx-xxxx-xxxx
You can use this key to [link]fix this problem yourself[/link]
If you are unable to fix the problem yourself, please contact the WEBMASTER and be sure to provide the technical support key shown above

My forum has some of the least technically able, and most cognitively impaired people on the planet. I do not like the idea of them trying to work out how to edit the displayed email address to remove all the "+nospam-nospam" obfuscation. Even if I edited the message, and changed the obfuscation words, many of them would have hard time with this.

Quote
There is no such thing as a webmaster "direct email link" or "unobfuscated address" with this mod unless you make it that way.   The mod only provides an obfuscated address that the emailer has to figure out.  They are usually easily discernible to experienced internet users.  But as stated before you can edit them to whatever you desire.

Bots are automated scripts when you throw something at them they never encountered they fail!

I understood that the address is obfuscated. I was worried that a spammer might have automated processes in place that would convert the code into a regular email address (after all, my e-mail client does this); and that they would automatically remove instances of "+nospam-nospam" from the email address (I understand though, as you pointed out, if I edit the obfuscation strings, this will be very unlikely to occur). This aside, the fact remains that many of my members would struggle to determine the correct email address and make the required edits.

Quote
Nevertheless, I do not understand your concerns?  As stated in my last post the member has the ability to  “fix it yourself” through the vast Bad Behavior network.  So your webmaster email is the last resort not the first or only resort.  Please re-read my last post...  Then you will realize it is the last resort.

Again, I'm not sure how my members will fair. When they fail BB, they are presented with the following at the "fix this problem yourself link":

Quote
  Technical Support Your request was intercepted by Bad Behavior (http://www.bad-behavior.ioerror.us/), security software which protects the Web site you visited from malicious activity, such as hackers, spam and viruses. We apologize for the inconvenience, but your request matched a profile of suspicious activity. This problem is usually quite easy to fix.
You accessed the Web site using software which is banned due to malicious activity associated with that software. Uninstall it from your computer and contact the software's author for assistance. In the meantime, you may access the site using different software, such as Firefox.
This problem may be caused by misconfigured or malfunctioning browser privacy software or personal firewall software. If you use this type of software, turn it off or reconfigure it and try again. (Example: For Norton Internet Security, you need to disable the Stealth Mode Browsing feature.)
This problem may be caused by viruses or spyware on your computer, or by malicious software that pretends to be anti-virus or anti-spyware software. Ensure that you have REAL anti-virus and anti-spyware software on your computer, that they are kept up-to-date, and that you have run a full system scan using each tool. Once your system is cleaned of viruses and spyware, please try your request again.
The free Microsoft Security Essentials (http://www.microsoft.com/security_essentials/) provides reasonable protection against a wide variety of malicious software.
If the above suggestions fail to resolve the problem, click Back and contact the e-mail address you were given for further assistance.
 

They will end up needing to contact me, and they will struggle with the obfuscated email address. This is why I am instead considering directing them to a contact form.

Quote
Now this mod has another feature that BB core does not have and that is the ability to place a Project Honey Pot - Honey Pot or a QuickLink in the Warning Page.  What this means if a bot went nuts and clicked on all the links in the warning page it will get penalized with an increased Project Honey Pot warning level.  Not only a deterrent but a no win situation for the bot.

So when it comes to webmaster link security rest assured, I have all the bases covered and will up the technology if and/ or when required.   8)

I will consider adding Honey Pot to the mix. I am just not as convinced as you that those that fail BB will be able to either sort out the problem for themselves, or contact me via the provided email link.

Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Col on April 22, 2011, 09:31:15 AM
Hello again, Butchs,

I installed BB on my live forum last night, and all seemed well. It was late, so did not spend the time I probably should have done testing out the new feature. The forum and BB appeared to work flawlessly, but when I logged on this morning I found that BB was restricting all visitors on all webpages outside of the forum pages. This problem does not occur when logged into the forum. It appeared to be an SSI issue, so I commented out the SSI entry - this has resolved the immediate problem.

Spam registrations are much lower, but still significant. This was the even the case before I disabled the SSI function. Still, it is early days.

What are the likely consequences of removing the SSI function? I had to edit my SSI file so that manager could apply the BB modification. "// Do we allow guests in here?" did not appear in my SSI file, so I added the line to about where it would have appeared originally. Is it critical where the the following BB SSI function appears in the file?

Code: [Select]
// Bad Behavior Start
require_once($sourcedir . '/bad-behavior/BadBehavior-SMF.php');
// Bad Behavior End

Here's the BB function and surrounding code from my SSI file:

Code: [Select]
// Get rid of $board and $topic... do stuff loadBoard would do.
unset($board);
unset($topic);
$user_info['is_mod'] = false;
$context['user']['is_mod'] = false;
$context['linktree'] = array();

// Load the user and their cookie, as well as their settings.
loadUserSettings();
// Load the current or SSI theme. (just ues $ssi_theme = ID_THEME;)
loadTheme(isset($ssi_theme) ? (int) $ssi_theme : 0);

// Take care of any banning that needs to be done.
if (isset($_REQUEST['ssi_ban']) || (isset($ssi_ban) && $ssi_ban === true))
    is_not_banned();

// Load the current user's permissions....
loadPermissions();

// Bad Behavior Start
// require_once($sourcedir . '/bad-behavior/BadBehavior-SMF.php');
// Bad Behavior End

// Do we allow guests in here?

// Load the stuff like the menu bar, etc.
if (isset($ssi_layers))
{
    $context['template_layers'] = $ssi_layers;
    template_header();
}
else
    setupThemeContext();

// Make sure they didn't muss around with the settings... but only if it's not cli.
if (isset($_SERVER['REMOTE_ADDR']) && !isset($_SERVER['is_cli']) && session_id() == '')
    trigger_error($txt['ssi_session_broken'], E_USER_NOTICE);

I don't know what modification is responsible for the code changes to the SSI file - I'll try to determine this later today or tomorrow. This issue might be the result of my content management system, MODx, although it works fine with SSI calls, except where sessions might be involved (I cannot, for example, make the SSI Logout function work with MODx).

Please let me know if anything immediately springs to mind, or if there is any specific information I can provide to help you determine the cause of this error. There was other error information from MODx displayed with failed webapges that indicated a template. I'll reproduce the error later and copy it here.

Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 22, 2011, 06:01:54 PM
You are welcome.  Now that my troll is gone I can post without worrying about him harping in and mucking up things.

Edited because I have been mean to my troll so I decided to chill out and let things be.  Sorry...

They will end up needing to contact me, and they will struggle with the obfuscated email address. This is why I am instead considering directing them to a contact form

Though I recommend against it because most users of this mod report little if any members getting blocked.  So, even if you edit the "BadBehavior.english.php" file to un-obfuscate the address, your address will still be difficult for a bot to read and easy for a member to link to.

Please let me know if anything immediately springs to mind, or if there is any specific information I can provide to help you determine the cause of this error. There was other error information from MODx displayed with failed webapges that indicated a template. I'll reproduce the error later and copy it here...

Could be MODx since I did not write or test for it.  Other possibilities: Your "$sourcedir" may not be properly defined in your settings.php file or "$sourcedir" global  is not defined as a global when the function started. 

Other than that I will need to see the error. 
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Col on April 23, 2011, 09:22:25 AM
Hi Butchs,

Thank you for the reply. Here's a copy of the error message:

Quote
Error 400
We're sorry, but we could not fulfill your request for / on this server.

An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.

Your technical support key is: xxxx-xxxx-xxxx-xxxx

You can use this key to fix this problem yourself.

If you are unable to fix the problem yourself, please contact the WEBMA5TER and be sure to provide the technical support key shown above.

« MODx Parse Error »
MODx encountered the following error while attempting to parse the requested resource:
« PHP Parse Error »
 
PHP error debug
  Error:  include(header.php) [function.include]: failed to open stream: No such file or directory   
  Error type/ Nr.:  Warning - 2   
  File:  /home/xxxxxxx/public_html/forum/Sources/Load.php(1746) : eval()'d code   
  Line:  174   
 
Parser timing
  MySQL:  0.0435 s (0 Requests)
  PHP:  2.2996 s   
  Total:  2.3432 s   

I obfusacted the the support key number since I don't know if tehre are any possible issues with copying it here. Let me know if you need it for any reason.

What is the purpose of the SSI function in BB? What are the implications of disabling the function?

Again, thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 23, 2011, 11:45:17 AM
Thank you for the reply.  The error did not give me enough information for a solid fix.  Maybe in a future version I will try to detect Modx.

The only reason to leave the support key alone is that ties in with Bad Behavior home site and is useless otherwise.

The mod should not be used with that error as it provides too much information.  The code you commented out is duplicated in index.php so as long as the mod works when you are logged in and logged out it should be fine.  I would test it logged out and test it logged in as a regular member who is not an admin.  If it works then you are fine.

I believe this is a modx issue.  If it does not work fine with the code you commented out, I will have to load Modx on my test server.  But I doubt it.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Col on April 23, 2011, 09:18:06 PM
Hi,

I guess I can live with this not working across my whole website. It probably will have little impact, since I do not have any interactive sections outside of the forum.

A few hours ago, I turned on the Honey Pot function. Yes, I joined up, added a key, and even a quicklick. However, I do not detect any reduction in the nuymber of registrations. There is activity in the denied log, but it is not very busy. I still seem to attract the best part of 100 spam accounts a day. They are not getting to the forum, but they are cluttering-up the membership list, and do cause some minor inconvenience for our a approval system.

A more pressing problem is that it appears that every click on the forum is adding the following error to the forum forum error log:

Quote
Apply Filter: Only show the errors with the same message
8: Undefined index: id_group
File: /home/xxxxxx/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Line: 436

Do you know what might be behind this problem?

Thanks.

Edit: line 458 sometimes shows up in the error log too.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 24, 2011, 07:59:32 AM
The mod is designed to work in the SMF system.  Most CMS's will need their own mods.

Try enabling strict mode.

Try replacing "id_group" on line numbers 436 & 458 with "ID_GROUP"?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Col on April 25, 2011, 09:15:54 AM
Replacing with ID_GROUP did the trick. However, there is an occasional new error. It might be an pre-esiting error, but previously hidden by the myriad of other error log entries before I deleted them (there were thousands of pages of entries).

Quote
http://www.xxxxxxxxx.com/forum/index.php?q=favicon.ico
Apply Filter: Only show the errors with the same message
Database Error: No database selected
File: /home/xxxxxx/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74

Any ideas?

I think I will install my forum from scratch, adding the modifications afresh. However, I'll first add BB with the minimum of other modifications and see how things go. At the moment, BB seems to be making little difference. My core forum installation is old, so the core code has been knocked around for a long time.

Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on April 25, 2011, 07:13:29 PM
The mod does not use "favicon.ico".  Not sure what the issue is but if it happens infrequently then do not worry.  Could be a bot checking for vulnerabilities or an issue with your CMS.

BB blocks bad bots but does not protect registration.  You should see many bots bet blocked.  It takes 1-2 weeks before they slow down.  If you want registration protection may I suggest "Avatar_Verification" with 100 images.

I saw you site the other day and it looks easy to log in there.  I do not know how bad you problem is but if you are still getting hit hard after the above mod is installed then you may need to try the big gun Forum Firewall.

If you do make sure you run it in log mode for a few days before blocking things.  You will have to make the same sorta change to ssi.php.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 01, 2011, 08:32:10 AM
New version posted today.  They are minor bug fixes and the core was updated to 2.1.13:

New in this Core release:
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: sharks on May 01, 2011, 08:47:23 AM
This mod seems very promising. Thanks for the updated version, butchs. Keep up the excellent work!

BTW, what exactly changed in this new version?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 01, 2011, 08:59:57 AM
Fix for Undefined index: id_group & description of error link (thanks Dmytro) in 1.1.x. 

Updated to Bad Behavior core version 2.1.13 (see my last post for the list of changes).
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Smog on May 01, 2011, 10:56:01 AM
Thanks for the update butchs.  :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Storman™ on May 03, 2011, 05:15:24 AM
butchs

I'm not sure if this was corrected in 1.4.7 (I'm still on 1.4.6) but I've noticed that in the Denied Entries Log, when you click on the DENIED key, the resulting link to the details is incorrect.

The last bit of the link is coming up as:

Code: [Select]
............area=badbehavior;sa=report_denied;%20bbbbid=116
when I think it should be:

Code: [Select]
............area=badbehavior;sa=report_denied;%20bbid=116
Too many b's

See attchment for the area I'm referring to.

Cheers  ;)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 03, 2011, 05:16:48 AM
Yea that was one of the 1.4.7 fixes.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Storman™ on May 03, 2011, 06:50:45 AM
Cool  ;)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Daniel Hofverberg on May 03, 2011, 05:58:59 PM
Thank you for providing this mod. I have just installed it for the first time, but it looks very promising.

One potential problem though. As far as I can make out, the error messages (the link to "Fix it yourself" etc.) are hard-coded in English, and doesn't seem to use the language files. It could be a problem, if the site is used on a non-English site and a legitimate user who doesn't know English happens to get caught by the script. It's no big deal and will probably affect very few people, but it would still be nice to be able to change the error messages to the site's language.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 03, 2011, 07:13:01 PM
You are correct and there is not much I can do about the Fix it yourself" message at this time.  The link to Fix it yourself" is part of the Bad Behavior core site.  Bad Behavior core is English only and this is the only port that supports other languages.  Maybe for a future version I can try something different for that message in a non-English language.  I will plan to to discuss this with the core author.
 :-X
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: J-Bird on May 06, 2011, 11:18:40 AM
Guest    Today at 10:07:29
http://www.gearsofgaming.com/forums/index.php
Database Error: No database selected
File: /home/gear2129/public_html/forums/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74

SMF 1.1.13 Any suggestions? Im using FPS theme and have applied the needed necessary manual edits to the themed files per the parser.
Im getting the above error about 12 times a day or so.



Modification Packages
   Mod Name    Version    
1.    SP Block for HacksPark ShoutBox    1.0    [ Uninstall ] [ List Files ] [ Delete ]
2.    Stop Spammer    2.3.9    [ Uninstall ] [ List Files ] [ Delete ]
3.    HacksPark shoutBox    1.2.1    [ Uninstall ] [ List Files ] [ Delete ]
4.    SMF 1.0.21 / 1.1.13 Update    1.0    [ Uninstall ] [ List Files ] [ Delete ]
5.    httpBL    2.5.1    [ Uninstall ] [ List Files ] [ Delete ]
6.    Custom Profile Field Mod    3.19    [ Uninstall ] [ List Files ] [ Delete ]
7.    Ultimate Profile    0.9    [ Uninstall ] [ List Files ] [ Delete ]
8.    reCAPTCHA for SMF    0.9.5.4a    [ Uninstall ] [ List Files ] [ Delete ]
9.    Googlebot & Spiders Mod    2.0.4    [ Uninstall ] [ List Files ] [ Delete ]
10.    DisableTemplateEval    1.1    [ Uninstall ] [ List Files ] [ Delete ]
11.    SimplePortal    2.1.1    [ Uninstall ] [ List Files ] [ Delete ]
12.    FlashChat Integration    1.0    [ Apply Mod ] [ List Files ] [ Delete ]
13.    Bad Behavior mod    1.4.7    [ Uninstall ] [ List Files ] [ Delete ]
14.    Google Verification META Tag    1.0    [ Uninstall ] [ List Files ] [ Delete ]
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 07, 2011, 07:22:27 AM
When you do a manual installation you need to run the routines in "install_db.php" for the database to be set-up.  Otherwise it will not work.


Also, do not forget to copy the cache directory...

See "package-info.xml" for more info.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Col on May 07, 2011, 08:27:56 AM
Hello butchs,

Your BB modification seems to be working quite well, but I decided, like you, to add Stop Spam and httpBL. The warning page for httpBL has a poorly obfuscated e-mail address system in place - I tried copying the unicode generated by your system to help protect the address from harvesters, but when saved it is converted to plain text in the HTML. What did you do to protect your e-mail address in httpBL?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: J-Bird on May 07, 2011, 09:00:57 AM
When you do a manual installation you need to run the routines in "install_db.php" for the database to be set-up.  Otherwise it will not work.


Also, do not forget to copy the cache directory...

See "package-info.xml" for more info.

What I actually did was an automatic install, then applied edits needed to the theme files.
Was that incorrect?
I put install_db.php in the root and went to that path and got a blank white screen, so not sure if that was successful or not?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 07, 2011, 08:59:28 PM
What did you do to protect your e-mail address in httpBL?

The current version of BB uses Project Honey Pot so I stopped using httpBL mod and enabled the honey pot feature of BB.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 07, 2011, 09:16:40 PM
I put install_db.php in the root and went to that path and got a blank white screen, so not sure if that was successful or not?

J-Bird, I just went to your site and the mod is working.  Scratch number 2.  So the only issue I can think of is the log working?  If not check phpadmin.

Use phpadmin to check to see if thee is a "log_badbehavior".  If the file is missing then the db was not installed.

Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: floridaflatlander on May 11, 2011, 07:50:44 AM
My link to bad behavior is missing from my Admin > configuration section of my forum.

I installed it two days ago and it was working fine, I also installed honeypot then and it was working well too. However last night bad behavior disappeared as mentioned above and my honey pot  says ...

Mod httpBL is ON, it is up-to-date and the connection with HoneyPot is perfect. (But it does not have a green background like it had when I first put it on my site.)

AND whenever I click spammers log, human log or help I get

An Error Has Occurred!
Unable to load the 'httpBL' template.

Are the two problems  the same, is it a honey pot problem?

Thanks
S
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: floridaflatlander on May 11, 2011, 12:23:38 PM
I uninstalled and then reinstalled it and it seems to work fine.

Sorry, didn't think about that until after my above post
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: StarScream123 on May 11, 2011, 03:23:14 PM
I've had some reports of some of my members getting trapped in this. I'm using the http:bl feature and some of their ips match what's in the database but the members are also logged in and as such have the bad behaviour whitelist group permission. Why are they getting checked if they have this permission?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 11, 2011, 06:30:21 PM
Being logged in does not automatically give you whitelist permissions.  You will need to set their group permissions in:

The following will check both their user name and last used ip address:
Manage Permissions/General Permissions/Bad Behavior Whitelist Group


and/ or you can put their ip address in the BB file for a fixed ip address or range:
s0urces/bad-behavi0r/bad-behavi0r/whitelist.ini

The former is the best.  But if their ip address changes every day the latter may be the better choice.  However, I will use it sparingly.
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: StarScream123 on May 12, 2011, 08:37:14 AM
Quote
The following will check both their user name and last used ip address:
Manage Permissions/General Permissions/Bad Behavior Whitelist Group

You mean this checks them if they have this permission? Why is it called whitelist? The members had this permission.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 12, 2011, 07:39:30 PM
You mean this checks them if they have this permission?

The admin sets the permissions for each member group.  You need to check the box I described above.

[ Why is it called whitelist?

It is an term selected by the BB core author (http://bad-behavior.ioerror.us/).

The members had this permission.

If they were blocked then the SMF cookie expired and they had to re-log in.  If their ip address changed then they could ben blocked again.  If this is the case then use "whitelist.ini" with their ip range as described above.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: tabletsdroid on May 20, 2011, 01:38:19 AM
just a quick question...

Do I need to enable project honeypot for this mod to work correctly?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 20, 2011, 07:03:57 AM
The mod will work without it.  Adding project honeypot will improve results.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: tabletsdroid on May 20, 2011, 07:10:54 AM
great, thanks for the quick response. It seems to be working rather nicely as is at the moment, so won't bother with honeypot unless things change.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 20, 2011, 05:44:55 PM
I am glad to hear that.
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: K33NY on May 31, 2011, 12:25:02 PM
Hello i posted ina the support forum and you told me that this was the right place.


I feel so seriosly stupid and noobed I have NO clue what to do now :S

You told me I had to manually uninstall the mod, I have no clue how to :S

I have the 1.4.7 version, and Im clueless how to manally uninstall, I dont want to crash the site again, now since the other guy in my clan is having is wife on hospital with theire baby coming I have no support from him

The last thing he told me was that I had to make the mod run in english and uninstall all the other language packages beckause the mod fails on a file, how do I do that or shall I just uninstall it manuall?

In that case how? :S when uninstalling it in the admin panel site crashed :S i dont want to fukk it up now :S

Please tell me how
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: K33NY on May 31, 2011, 12:31:38 PM
Please help me cus the mod made AEVA media fukk it up now now, so many errors poping up!!!!
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 31, 2011, 03:17:20 PM
The best prevention is to install a mod once.  You need admin/ FTP access to manually uninstall a mod.

I can not guarantee this but you can try the following (if you have SMF 1.1.x - 2.x will require more work):
Unzip the mod and copy everything that is in the Sources directory in the mod to the Sources directory in your server.  Then copy the compressed mod to your Packages folder on your server.

All should work.  Wait until your tech comes back from the honeymoon and try to uninstall the mod again via the package manager.

They you should be fine.  But whatever you do never install any mod twice!

The last thing he told me was that I had to make the mod run in english and uninstall all the other language packages beckause the mod fails on a file, how do I do that or shall I just uninstall it manual?

That is not true.  The mod will run in the language you set in the SMF admin panel.


Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: K33NY on May 31, 2011, 05:54:31 PM
we are running SMF 2.0 RC5 and I have FTP access, shall I try what you told me or better to wait until he comes back?

Allso I wonder, should I uninstall all mods, for then to be sure i install them 100% correct again later?

I was thinking of doing this, I would rather spend hours installing mods properly than using hours installing wrong to having them make errors.....

Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 31, 2011, 06:52:50 PM
If all is well wait.  If not then for SMF 2.0 copy the following files onto your server in the order they appear in package-info.xml.

If everything is working.  Wait for your tech returns he should be able to uninstall the second copy of BB in package manager.

the above is not a manual uninstall, it is more or less a workaround I developed when I double installed things on my test server when I was up too late programming.   :o

Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: K33NY on May 31, 2011, 07:00:11 PM
ok then I will wait, I think, I want to learn this stuff myself but I dont know anyone to teach me, so I will ask him to uninstall all mods properly for me :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on May 31, 2011, 07:04:55 PM
Yea, it is not that hard to learn SMF.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: K33NY on May 31, 2011, 07:27:06 PM
No I found this much easier then what we used before, but still bit much for me at once :P
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 01, 2011, 06:46:53 AM
Oh, I just read you other post.  You can not uninstall mods by simply deleting files.   Mods must be uninstalled via package manager.   If you reinstall the files you deleted, your site will work again.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 02, 2011, 03:46:23 PM
FYI - If you use the honeypot link feature please note that you have to use the complete address.  ie http://www.yoursite.com/folder/honeypot.php
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 05, 2011, 06:28:42 PM
New version for the upcoming SMF 2.0 and past versions.

Additions are:
1.  Advanced automatic random Google safe scattered honeypot generates many different invisible spam traps on front page and warning page.  Currently this mod generates more types of spam traps than any other mod.  This makes the spam traps generated by this mod more effective.  Honey pots must be entered in the mod admin page as a complete link.  ie:  "http://community.smfhelper.info/honeypot.php".
2.  httpBL suspicious visitors are now logged as "Permitted Entries" when logging and HttpBL are enabled.
3.  Bug fixes and etc...
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Kurogane on June 09, 2011, 09:49:05 PM
Butchs, can you give me sql query of install_db.php for fresh install? for some reason can't install it via smf or manually always get stuck in

Code: [Select]
No database selected
File: /home/user/public_html/forum/install_db.php
Line: 269

Edit: i see the entry is there in setting badbehavior_* and log_badbehavior_* but always give me the error

Code: [Select]
Database Error: No database selected
File: /home/user/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 10, 2011, 08:41:15 PM
Odd.  Try adding the attached to your package.

EADIT:  removed for security reasons please PM author for a copy.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Kurogane on June 11, 2011, 03:00:48 PM
Same, here line BadBehavior-SMF.php problem.

Code: [Select]
function bb2_db_query($query) {
global $db_prefix; <-- Error here

if ((!isset($query)) || (empty($query))) return false;
$link = db_query($query, __FILE__, __LINE__);
if (!isset($link) || empty($link)) return false;
if ($link === true) {
$affected_rows = bb2_db_affected_rows();
if ($affected_rows >= 1) {
return true;
} else { return false; } 
} else {
$number_of_rows = mysql_num_rows($link);
if ($number_of_rows == '0') {
return false;
} }
$qresult = bb2_db_rows($link);
return $qresult;
}
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 11, 2011, 08:30:01 PM
Sounds like a host issue to me. The mod works fine on thousands of other sites.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: djkimmel on June 12, 2011, 05:02:58 PM
I uninstalled and reinstalled the mod on my site and reduced the number of Database Error: No database selected errors. I used the version 1.5 I re-downloaded from SMF today.

I'm still getting this error whenever an IP is DENIED however. It seems to be working on my 1.1.14 forum (greatlakesbass.com/forum). I have the database tables and the errors are getting logged in log_badbehavior. I checked everything that I found in earlier posts in this thread. I already had httpBL and Stop Spammer installed.

5 of these errors in the last 1/2 hour. Here's the mods I have installed:
Code: [Select]
Mod Name Version
1. Tidy Child Boards 1.2 [ Uninstall ] [ List Files ] [ Delete ]
2. Stop Spammer 2.3.9 [ Uninstall ] [ List Files ] [ Delete ]
3. SMF 1.0.17 / 1.1.9 / 2.0 RC1 Update 1.0 [ List Files ] [ Delete ]
4. SMF 1.0.12 / 1.1.4 / 2.0 b1.1 Update 1.0 [ List Files ] [ Delete ]
5. SMF 1.0.21 / 1.1.13 Update 1.0 [ List Files ] [ Delete ]
6. Bad Behavior mod 1.5.0 [ Uninstall ] [ List Files ] [ Delete ]
7. SMF 1.1.14 Update 1.0 [ Uninstall ] [ List Files ] [ Delete ]
8. SMF 1.0.19 / 1.1.11 Update 1.0 [ List Files ] [ Delete ]
9. SMF Gallery Pro 3.0.21 [ Uninstall ] [ List Files ] [ Delete ]
10. SMF 1.0.11 / 1.1.3 Update 1.1 [ List Files ] [ Delete ]
11. Anti-Spam Verification Questions 1.02 [ Uninstall ] [ List Files ] [ Delete ]
13. SMF 1.0.13 / 1.1.5 / 2.0 b3.1 Update 1.0 [ List Files ] [ Delete ]
14. Bookmarks 2.3 [ List Files ] [ Delete ]
15. PaypalDonations 2.0 [ List Files ] [ Delete ]
16. httpBL 2.5.1 [ Uninstall ] [ List Files ] [ Delete ]
17. SMF 1.0.14 / 1.1.6 Update 1.0 [ List Files ] [ Delete ]
18. Simple Audio Video Embedder 2.0.1 [ Uninstall ] [ List Files ] [ Delete ]
19. SMF 1.0.16 / 1.1.8 Update 1.0 [ List Files ] [ Delete ]
20. SMF 1.0.18 / 1.1.10 / 2.0 RC1-2 Update 1.0 [ List Files ] [ Delete ]
21. SMF 1.0.15 / 1.1.7 Update 1.0 [ List Files ] [ Delete ]
22. Addthis widget in first post 1.0 [ Uninstall ] [ List Files ] [ Delete ]
23. SMF 1.0.20 / 1.1.12 Update 1.0 [ List Files ] [ Delete ]
24. ARIN URL Fix 0.1 [ Uninstall ] [ List Files ] [ Delete ]
25. SMF Gallery Pro Profile Link 1.1 [ Uninstall ] [ List Files ] [ Delete ]
26. SMF Gallery Pro SSI 2.1.1 [ Uninstall ] [ List Files ] [ Delete ]

Any more ideas on how to get rid of this error message? Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: djkimmel on June 12, 2011, 05:04:54 PM
Also, minor, whenever I click on the About link in Bad Behavior I get the following error:
Code: [Select]
http://www.greatlakesbass.com/forum/index.php?action=badbehavior;sa=bbabout;sesc
Apply Filter: Only show the errors with the same message
8: Undefined index: badbehavior_httpblnote
File: /home/accountname/public_html/forum/Themes/default/BadBehavior_Admin.template.php (badbehavior_about sub template - eval?)
Line: 144

I was getting this before I reinstalled Bad Behavior the 2nd time too. Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 12, 2011, 05:21:16 PM
I just went to your site and ran "Bad Behavior Test" and it seems to be working.

Not sure what is going on with the DB errors.  From past experience it was usually a bad install.  Could be left over cache from the old install or it could be that files are in the incorrect locations.  Maybe you have SMF 2.0 files mixed with 1.1.x files?  Since you have a custom theme I would check what is installed where.

If not please provide more info.  I run 2.x live so I can only test 1.1.x locally.  EDIT:  Went back to the test forum, upgraded it to 1.1.14 and forced a log entry, I get no DB error with Apache 2.0.63 ,MySQL 5.1.44 & PHP 5.3.2.

The attached should fix badbehavior_httpblnote for 1.1.x.  Thank you.  It will be added to a future revision when I collect more.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 12, 2011, 06:12:49 PM
I will revisit this post:

Same, here line BadBehavior-SMF.php problem.

Code: [Select]
function bb2_db_query($query) {
global $db_prefix; <-- Error here

if ((!isset($query)) || (empty($query))) return false;
$link = db_query($query, __FILE__, __LINE__);
if (!isset($link) || empty($link)) return false;
if ($link === true) {
$affected_rows = bb2_db_affected_rows();
if ($affected_rows >= 1) {
return true;
} else { return false; } 
} else {
$number_of_rows = mysql_num_rows($link);
if ($number_of_rows == '0') {
return false;
} }
$qresult = bb2_db_rows($link);
return $qresult;
}

From what I see you are running SMF 1.1.x, the global "$db_prefix" is required to locate your database.  It is defined in your "Settings.php" located in the smf root directory.  Please run "repair_settings.php (http://download.simplemachines.org/index.php?thanks;filename=repair_settings.php)" to confirm that it is set correctly or inspect the "Settings.php" file directly.

The "$db_prefix is used in the "BadBehavior-mysql.php" for the "bb2_insert" function.  SMF 1.1.x requires it to be in the format of "{$db_prefix}xxx".  This is not required for SMF 2.0.x so if you will get errors with the wrong "xxxr-mysql.php"  file.   Custom theme installers need to be careful.

If you have a SSI front end then you need to add the xml changes in both the the "index.php ' & "SSI.php" files.
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: djkimmel on June 12, 2011, 06:31:32 PM
The new file fixed that minor issue for the About link badbehavior_httpblnote for 1.1.x - thanks!

Bad Behavior seems to be working as it should. If you mean non-Bad Behavior files I don't think I could have SMF 2.0 files on there since I've never used any 2.0 install/update on that account. I do see that the version 2.0 Bad Behavior files were installed in /public_html/forum/Sources/bad-behavior and /public_html/forum/Sources/bad-behavior/bad-behavior. Is that okay?

My theme is an edit I did of the default theme myself a long time ago. I'll check files some more today or tomorrow and see if everything seems to be where it is supposed to. I don't normally have any strange errors or problems installing things. I haven't seen indications in the past that files weren't where they were supposed to be. Guess I can check the install manually in detail to see if all the Bad Behavior changes were made as they should be. I manually edited my index.template.php file in my theme with the two changes.

The leftover cache possibility would be nice because then I expect it will go away. That would be nice. So far, still getting the error in my log whenever someone is denied.

On my theme I have an index.php, index.template.php and style.css, and an images folder in the glbtheme2 folder under Themes. Everything else is in the default folder. That was what happened when I ran the process 'Create a copy of Default named:' in SMF way back.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 12, 2011, 06:42:13 PM
If you are getting "Denied Entries" in the mod log then it is working.  Something else may be the issue???

Try this:
Check your "Settings.php" as mentioned in reply 262.  Check the other issues too.

Another thing will be to install "DisableTemplateEval (http://custom.simplemachines.org/mods/index.php?mod=2054)" and disable it.  Then send me some of the errors you are getting from the SMF Error log (a/k/a Forum Error Log).

You can manually force them by logging out and changing your UA to "Bad Behavior Test".
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 12, 2011, 06:59:20 PM
Bad Behavior seems to be working as it should. If you mean non-Bad Behavior files I don't think I could have SMF 2.0 files on there since I've never used any 2.0 install/update on that account. I do see that the version 2.0 Bad Behavior files were installed in /public_html/forum/Sources/bad-behavior and /public_html/forum/Sources/bad-behavior/bad-behavior. Is that okay?

Not sure if I understand.  You need to look at "package-info.xml".  If you uncompress the mod zip file,  BB files in "Sources" and "Themes" folders are for 1.1.x.  Most of the the 2.0 files are in the root folder.  The common files are the language files.

This is a mute point if you used package manager as it installs the correct version.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 12, 2011, 07:41:24 PM
I have the database tables and the errors are getting logged in log_badbehavior. I checked everything that I found in earlier posts in this thread. I already had httpBL and Stop Spammer installed.

log_badbehavior is not collecting errors, it is keeping a log of the blocked visitors.  If the log is maintained the DB errors you see are most likely from something else.  It is impossible for "log_badbehavior" not to be found and write to the DB at the same time.  If there was a BB DB error it would not write to the log at all...   The procedure I outlined above may assist you in locating the real source.

SMF errors are kept in the Forum Error Log.
???

httpBL is redundant when using this mod.  This mod does everything that mod does plus a whole lot more.  Plus this mod is much less complicated when it comes to Project Honey Pot.
 :-X
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: djkimmel on June 12, 2011, 08:09:48 PM
I used the Package Manager. Not exactly sure how to read what the package-info.xml files does. It appears you are saying that the files in /forum/Sources/bad-behavior/bad-behavior are for version 1.1.14.

By errors I did mean it is logging the blocked visitors. Since it is writing to the log in the database I thought it odd that it would report 'Database Error: No database selected' even though it is writing to the database. The IP addresses in my errors log where this message is being reported match the IP addresses being denied by Bad Behavior along with the times they are recorded in log_badbehavior.

I am getting denied entries. 6 more since 8pm EST. I'll try the eval and settings stuff and see what I come up with.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: djkimmel on June 12, 2011, 08:29:28 PM
Okay. I went through the database and looked at things closely since I'm not getting this error with every denied IP address. Only some of them. I see a pattern. I have Prismotube installed under a different subdirectory - greatlakesbass.com/vid/ - than the forum and for some reason Bad Behavior is also checking requests for /vid/ video pages. Not sure how or why this is happening since they are outside of the forum path?

So when an IP address is denied by Bad Behavior along the greatlakesbass.com/vid/ path instead of the greatlakesbass.com/forum/ path, I usually get the 'Database Error: No database selected' error on the forum. I have other PHP programs running on greatlakesbass.com but the forum and the video sections are my highest traffic areas.

I notice Bad Behavior is also checking requests against greatlakesbass.com at the root level too. I thought it would only check traffic to the forum? No indication so far that it is also checking traffic against my blog software. Is it possible it is checking against the root and the video section because I call SSI.php on them?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 12, 2011, 08:41:12 PM
This is my last post for today.  Gotta go to bed...   O:)

I used the Package Manager. Not exactly sure how to read what the package-info.xml files does. It appears you are saying that the files in /forum/Sources/bad-behavior/bad-behavior are for version 1.1.14.

Yes.  I believe you have installed it correctly.

By errors I did mean it is logging the blocked visitors. Since it is writing to the log in the database I thought it odd that it would report 'Database Error: No database selected' even though it is writing to the database.

True.  If the log is maintained the mod is working.

The IP addresses in my errors log where this message is being reported match the IP addresses being denied by Bad Behavior along with the times they are recorded in log_badbehavior.

Okay. I went through the database and looked at things closely since I'm not getting this error with every denied IP address.

When I visited your site with a "Bad Behavior Test" UA there should have been a "log_badbehavior" entry and nothing in the error log for my ip (please do not post my ip).  If this is the case you are being attacked.  :)

Could it be that you are are being hit by bots that are trying to access your forum DB?  The errors you see in the errors log could be the bots trying to write to your forum without permission.  I would move over the httpBL information to BB and disable mod httpBL so BB will block both.  No need for redundant mods.  Besides this way you can take full advantage of the cache feature and block other attempts.

Check the time stamps.  Bots hit rapidly but the time stamps should match if it was really a mod error.  If not, cache will catch the bots even longer.

I would add some cache to the BB mod 8-15 seconds so it will block other access attempts from the same IP address the duration of the cache until the bot tide blows bye.

Bots try many different things.  Some times they are caught by BB some times by the project honey pot feature.  Other times they get a free pass.  But with cache they get blocked a little longer.  Cache also reduces the wear and tear on your forum.

Only some of them. I see a pattern. I have Prismotube installed under a different subdirectory - greatlakesbass.com/vid/ - than the forum and for some reason Bad Behavior is also checking requests for /vid/ video pages. Not sure how or why this is happening since they are outside of the forum path?

Me either?  Unless it has the same path as the forum.  Maybe Prismotube has its own copy of BB?

So when an IP address is denied by Bad Behavior along the greatlakesbass.com/vid/ path instead of the greatlakesbass.com/forum/ path, I usually get the 'Database Error: No database selected' error on the forum. I have other PHP programs running on greatlakesbass.com but the forum and the video sections are my highest traffic areas.

The path for the forum db is set in "Settings.php" via the "Database Info" section.

I notice Bad Behavior is also checking requests against greatlakesbass.com at the root level too. I thought it would only check traffic to the forum? No indication so far that it is also checking traffic against my blog software. Is it possible it is checking against the root and the video section because I call SSI.php on them?

Could be.  But the path to the db will not change.  Maybe bots are trying to access your forum db when they are at the forum like I said before.  If it is logged in "log_badbehavior" then the db is working.  This is why I am perplexed and have the suspicion that it is a bot attack.

Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: djkimmel on June 12, 2011, 09:44:28 PM
Thanks for your help. Well I wish I could figure it out a little better. My forum path is greatlakesbass.com/forum in Settings.php. I have to believe it is the SSI.php connection since that is the common denominator between my home page, the forum and Prismotube. Prismotube does not have a Bad Behavior function of its own. I now see Bad Behavior ran against another path outside the forum that also has an index.php file that uses SSI.php.

I realize the path of Bad Behavior doesn't change but there is some kind of path problem when Bad Behavior runs against my Prismotube files on greatlakesbass.com/vid/ and other non-forum paths.

I increased the cache time from 8 to 15. I turned off the httpBL mod since I have the settings in Bad Behavior. I'll see what happens with that.

Out of the 1440 records already in the Bad Behavior log, I have no idea which one is your entry anyway so your IP address is safe.

Next time your awake and read this, what would be the ramifications of removing the Bad Behavior code from SSI.php? Would that stop Bad Behavior from running against all the non-forum pages? Not sure if I want to do this but I am getting a lot of the no database selected errors.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 13, 2011, 01:08:18 AM
I like the idea of SSI helping the mod protect your whole site.  SMF never fails to amaze me.  I would advise not to touch it...

Out of sight, out of mind?  If you disable the mod by tampering with SSI the bots will not stop.  Even if you do not see them they will still be attacking your site.  They will never go away unless you use the mod.

Why blame the mod for protecting your site?  The errors are not from the mod because the mod is logging the violations.  Bots are causing the errors in your forum error log.  The mod is blocking the bots.  Some times bots step up their assault when threatened.  Just because the IP's match it does not mean the mod is at fault.  Your problem is and always was the bots.  Let the mod do it's job and in a few weeks things will slow down and they will go elsewhere.

You have less than 300 blocked.  The other 1,100 are permitted.  Look in the denied log for the ones that were blocked.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Kurogane on June 13, 2011, 02:35:53 AM
I will revisit this post:

Same, here line BadBehavior-SMF.php problem.

Code: [Select]
function bb2_db_query($query) {
global $db_prefix; <-- Error here

if ((!isset($query)) || (empty($query))) return false;
$link = db_query($query, __FILE__, __LINE__);
if (!isset($link) || empty($link)) return false;
if ($link === true) {
$affected_rows = bb2_db_affected_rows();
if ($affected_rows >= 1) {
return true;
} else { return false; } 
} else {
$number_of_rows = mysql_num_rows($link);
if ($number_of_rows == '0') {
return false;
} }
$qresult = bb2_db_rows($link);
return $qresult;
}

From what I see you are running SMF 1.1.x, the global "$db_prefix" is required to locate your database.  It is defined in your "Settings.php" located in the smf root directory.  Please run "repair_settings.php (http://download.simplemachines.org/index.php?thanks;filename=repair_settings.php)" to confirm that it is set correctly or inspect the "Settings.php" file directly.

The "$db_prefix is used in the "BadBehavior-mysql.php" for the "bb2_insert" function.  SMF 1.1.x requires it to be in the format of "{$db_prefix}log_badbehavior".  This is not required for SMF 2.0.x so if you will get errors with the wrong "BadBehavior-mysql.php"  file.   Custom theme installers need to be careful.

If you have a SSI front end then you need to add the xml changes in both the the "index.php ' & "SSI.php" files.
 :)

Yeah i'm using SMF 1.1.13  and i ran"repair_settings.php" all fine here.

For the moment i upgrade smf 2.0 and i still modifying some things for the migration when i done this i'll try again with smf 2.0



I'm still getting this error whenever an IP is DENIED. I have the database tables and the errors are getting logged in log_badbehavior.


This is the exact problem i have. I got this error when all the IPs are DENIED, i'm not really sure if the errors i getting logged in log_badbehavior are the actual or updated but it saves the registry, that's for sure.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 13, 2011, 05:30:26 AM
Again, if the mod is maintaining a log then the mod is working.  log_badbehavior  is not an error log.  It tracks the denied and suspicious permitted visitors.

Sounds like bots are causing the errors by taking advantage of a flaw in SMF 1.1.x.  No matter what version of SMF you have bots will try to place errors in your forum error log.  They are trying to retaliate because you are blocking them.  That is what they do!

Please do not blame the mod for doing it's job.  Set up the mod correctly and the bots will eventually slow down and give up.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Kurogane on June 13, 2011, 10:28:44 AM
I'm not blame you for doing it's jobs, In my case I can put hands on fire they are not a bots they are legit users only the IP their using is reported for comment spammer or malicious IPs (Dynamic IP problem) i know this because i investigate the IP reported and the users using the IP and are known users.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: djkimmel on June 13, 2011, 11:53:44 AM
Oh I appreciate the help. Just wondered what would happen if I edited SSI.php. I like information and learning. I'll leave it as is because the bots are relentless. Same as the number of IP addresses constantly attempting to log into my server. Endless and relentless. I appreciate the protection. After editing the permissions I have not seen any indication of real members being blocked or affected by Bad Behavior. I had a few affected by httpBL mod but I shut that off at your suggestion.

I had only one signup so far today that was stopped by Stop Spammer. I used to get 12 to 18 like that a day. It is amazing to me the effort spammers will go to to get around all the walls we throw up in front of them.

Thanks for your help and information.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 13, 2011, 07:15:31 PM
Kurogane if "Search Engine DNS" is checked uncheck it.

You can put your members on a whitelist.  Make a Membergroups for them and check "Bad Behavior Whitelist Group" in the Permissions.  This will only work if their ip does not change from the last one they used on your site when they are logged out.  If their ip does changes after they log out they will not be white listed.  If they do not log out then they are ok.  Another option is to add the ip range in "whitelist.ini" in your "sources/bad-behavior" folder.

djkimmel you are welcome.  Not sure what will happen but I know it will not work on a SSI site with the ssi stuff turned off.  I suggest letting things go for a week.  What I have seen is that when BB starts blocking bots the bots hit the site hard.  They get blocked and after a week or two they take you off the list and visit less frequently.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 13, 2011, 07:38:58 PM
Maybe placing your most active membergroups in the "Bad Behavior Whitelist" is not a bad idea?  All member groups with 50+ posts get automatically white listed.

I had only one signup so far today that was stopped by Stop Spammer. I used to get 12 to 18 like that a day. It is amazing to me the effort spammers will go to to get around all the walls we throw up in front of them.

I was shocked when I discovered how many attempts the bots were making on my site a day.  No more...   :)  8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: djkimmel on June 13, 2011, 08:27:29 PM
I did whitelist all my members. I haven't had a spammer get all the way on past Stop Spammer in a while so I should be okay. I'll change permissions to exclude members with less than 10 posts from the whitelist is things change.

It will be good to see the bots traffic down on my site. I'm starting up other websites and I want to be able to have tools to minimize their impact on those sites too. Thanks again.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: tabletsdroid on June 13, 2011, 09:57:09 PM
since I installed smf 2.0 gold, bad behavior has stopped working completely. Tried uninstalling, deleting and installing the new version - still not working at all.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 14, 2011, 03:23:58 AM
When the mod is uninstalled it disables its self.  You need to check "Enable Bad Behavior" to turn it back on after installation.   8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 14, 2011, 03:37:22 AM
I did whitelist all my members. I haven't had a spammer get all the way on past Stop Spammer in a while so I should be okay. I'll change permissions to exclude members with less than 10 posts from the whitelist is things change.

It will be good to see the bots traffic down on my site. I'm starting up other websites and I want to be able to have tools to minimize their impact on those sites too. Thanks again.

Good idea!  Now your members will not be tested.  Drastically reducing possible conflicts with the Project Honey Pot part.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: tabletsdroid on June 14, 2011, 07:47:34 AM
When the mod is uninstalled it disables its self.  You need to check "Enable Bad Behavior" to turn it back on after installation.   8)

It is enabled but since installing smf 2.0 gold - it has stopped working, even with project honey pot configured correctly. My forum is now being overrun by ze nasty gremlins :(
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: rgho on June 14, 2011, 02:10:33 PM
Hi, I've recently installed Bad Behavior on my site and it appears to be working (there have been denied connections, all appear to be spammers).  But I had one slip through (as is bound to happen).  When I checked the ip on project honeypot I saw it's threat level was 45, which confused me. 

I have a minimum threat level of 25 in the config on the site, and I have my http:BL Access Key set, so I would have expected that it would have filtered that out?  The person was added to the "PERMITTED entries log", but I'm just not quite sure I have everything setup right so I thought I would ask what the appropriate behavior should be?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 14, 2011, 08:21:16 PM
Yes it would have been filtered.  I suspect its threat level was below 25 when it first visited your site.

If you have a honey pot they could have clicked it ands raised their level while on your site.  The honey pot routines generated by the mod are quite effective.  If caught, they paid a heavy price spamming you by getting black listed.

Their threat level could have been raised elsewhere.  Nevertheless, they recently visited a honey pot and will not be able to access your site for a while.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 14, 2011, 08:24:01 PM
It is enabled but since installing smf 2.0 gold - it has stopped working, even with project honey pot configured correctly. My forum is now being overrun by ze nasty gremlins :(

Any errors in the SMF Error log?

What happens when you log out and visit your site with the "Bad Behavior Test" as your UA?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 16, 2011, 05:23:49 AM
There is going to be an update this weekend for both 1.1.x and 2.0.x.  In the mean time please replace the attached in your sources/bad-behavior/bad-behavior folder.  It will not effect un-installation.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: 4b11l on June 16, 2011, 06:42:24 PM
Hello all,

I am curious if I have to do anything after installing this mod? Being a complete noob to this particular aspect of SMF, I would not be sure what to do. Can it just be installed we me not having to do anything after?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 16, 2011, 07:55:53 PM
You need to enable the mod.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: 4b11l on June 16, 2011, 08:07:47 PM
You need to enable the mod.


Well, besides that obviously. :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 18, 2011, 08:36:03 AM
New update.  Fixed some project honey pot issues.  If you use httpBL and the mod is working you can just replace the core.inc.php & blackhole.inc.php files to get the features of the update.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: hawaiiautopages on June 21, 2011, 07:30:31 PM
Hi, new to this mod.  After mod was installed I get weird random characters on the top left corner of my forums.  Sometimes there's nothing but if I keep hitting refresh the characters will sometimes appear or change.  Is this normal?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on June 22, 2011, 07:13:47 PM
With honeypot traps enabled, the mod generates many random project honey pot traps in an effort to catch bad bots.  The mod generates more traps than any other mod in SMF or other forums that I know about.  The traps vary and some are unique.  I created several new ones that bots never seen before.  The traps dramatically increase the effectiveness of the traps and deter the bots from clicking everything.  Details of the traps are confidential since bot authors regally read these threads.

The more "mild" traps are placed on your front page.  Where more "aggressive" traps are used when a visitor is blocked via the warning page.

Some times the mod will put something up top.  You should not see anymore than a extra blank line up there.  If you see actual characters else, please PM me it to me.
 8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: LC on July 10, 2011, 02:48:30 AM
Just thought I'd share:

"Bad Behavior has blocked 769 access attempts in the last 7 days." I installed this mod two days ago. Holy crap.  :o

I saw "Request contained a malicious JavaScript or SQL injection attack" on a few of the denied log entries. I think that would explain why my site was sluggish before installing this mod? Among other attacks I suppose.

I am glad I installed this mod. I will be recommending it to everyone I know who has a blog, website or forum.

Great mod.  8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on July 16, 2011, 01:36:47 PM
New version.  Can't have a default valueFile (evanoliver), added httpBL on/off line & API key check, improved whitelist.
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on July 16, 2011, 05:57:41 PM
Just thought I'd share:

"Bad Behavior has blocked 769 access attempts in the last 7 days." I installed this mod two days ago. Holy crap.  :o

I saw "Request contained a malicious JavaScript or SQL injection attack" on a few of the denied log entries. I think that would explain why my site was sluggish before installing this mod? Among other attacks I suppose.

I am glad I installed this mod. I will be recommending it to everyone I know who has a blog, website or forum.

Great mod.  8)

Thank you very much for the kind words.  :'(
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on July 18, 2011, 08:13:47 PM
I have a personal best at my website with this version:

Quote
Bad Behavior has blocked 718 access attempts in the last 7 days.

400 of them were today!

ROCK and ROLL!!!   :P
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: ziycon on July 20, 2011, 10:04:49 AM
I've updated to 2.0 and I'm having a problem with BB, basically, the hidden url its creates in the head of the forum pages, it sometimes ads the link text as a html character code or a html comment, these show up as a white bar about 12px high across the top of all forum pages.

If the random link text is a string it works fine and doesn't show the white bar, any ideas?
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on July 20, 2011, 08:11:17 PM
I believe it's the random honeypot trap.  Not sure which one. 

If you like view your source to identify it, PM me it and I can tell you where it is...
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: Dai Li on July 23, 2011, 05:41:16 PM
Mine hit:
Bad Behavior has blocked 1322 access attempts in the last 7 days.
Within four days of installing, before we changed servers and the URL went down for a while. Ridiculous. I had never realized we'd gotten so much bot traffic before. It would have been higher no doubt had I not cleared out the logs to make the DB smaller. 52.3 MB, and 51 of those MB were all BB logs. >>
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on July 23, 2011, 05:58:06 PM
The BB Logs clear themselves after 7 days.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on July 25, 2011, 06:58:45 PM
New version.

What's included?

Besides some minor bug fixes for cloudflare uses, a option to limit the honeypots on the front forum page, I will introduce a new BBC code for SMF 2.0 only (It is too difficult to implement in 1.1.x).  This code will block content from suspicious visitors who are guests.

For example, if you have a meeting and want to post your email address, instead of just posting it you can enclose the content in the new BBC code.  If a guest gets flagged suspicious by BB they will not be able to see the information.  But a logged in user or a guest who is not suspicious will be able to see the information.

This has been the path I have been heading to for a while and is the goal of the final 1.5.x version of the mod.  The integration hooks in SMF 2.0 gold finally made it possible.
 :P
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: MiY4Gi on July 27, 2011, 05:57:16 PM
Great stuff.

Gonna uninstall 1.5.2 then install 1.5.3. I'll let you know how it goes.

EDIT

Installed successfully. Need to give it a test ride for a few days.  :D
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: .Vapor on July 27, 2011, 06:29:46 PM
Great mod...thank you very much !
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: MiY4Gi on July 27, 2011, 07:41:34 PM
The mod just permitted a very dangerous looking bot. For now, I banned the bot using my .htaccess file.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on July 27, 2011, 08:00:26 PM
Interesting.  Still waiting for info on that bot...  But at least it will not be able to see anything in the suspicious BBC tags.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: MiY4Gi on July 28, 2011, 02:54:35 AM
I also remember seeing that same bot in the denied list yesterday, but I can't seem to find it now. Strange.

Anyway, I recently almost got blocked by my ForumFirewall. The log said I was attempting to hack my custom theme's image folder. I fixed it by re-installing ForumFirewall onto my forum and custom theme. This may or may not be the right place to say it, but the email address I saw on the warning page looks way to confusing, and ugly for humans to interpret. Wouldn't it be possible to use Javascript to cloak the email address? Project Honey Pot (http://www.projecthoneypot.org/how_to_avoid_spambots_3.php) seems to think so. With Javascript the email address looks just like an email address, yet bots haven't been programmed to read it (nor any other javascript).
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on July 28, 2011, 05:23:53 AM
Funny, I just read that yesterday.  If you read that thread Java is not supported by all browsers.  I need to make the mod compatible with many people or they will complain.  What I do it a little more harder to beat than what they call "Advanced Munging" so I expect greater than 85% bots stopped.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: MiY4Gi on July 28, 2011, 06:10:39 AM
Funny, I just read that yesterday.  If you read that thread Java is not supported by all browsers.  I need to make the mod compatible with many people or they will complain.  What I do it a little more harder to beat than what they call "Advanced Munging" so I expect greater than 85% bots stopped.

Well, you won't find a one-size-fits-all solution, but it would be nice if users could choose the size that fits them. In other words, having javascript, images, and munging as obscuring options would be nice. And, newer browsers DO support Java afaik.

Also, some forum's only attract technical users who run the latest open source browsers.
Title: Re: Bad Behavior mod - The Web's premier link spam killer
Post by: butchs on July 28, 2011, 06:20:28 PM
Every other version of BB replaces "@" and "." with a special string.  As I said what the mod dees is far more advanced than what they call mugging.  It is so unique that it should be more effective than a published java script.  If you do not believe me then go with the java.

You have my permission to post an image or Javascript instead of my code.  Open banned.inc and replace "<?php echo bb2_email_scramble(); ?>" with the code you get from the link.
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on July 30, 2011, 08:13:31 AM
SUSPICIOUS BBC TAG HELP - Only for SMF 2.0 Gold.

This feature is intended to provide additional security when posting an email address, phone number, personnel information and/ or a special forum event...

Attached is the BBC image created exclusively for the SMF 2.0 version of the mod.  The image is available when you post or modify a message.  The image will enclose the content in "suspicious" tags.  All content will NOT be viewable by any visitor in the "PERMITTED ENTRIES LOG".

There is am image of the BBC location on the mod (http://custom.simplemachines.org/mods/index.php?mod=2502) page.

There are two methods for a visitor to gain access to the "PERMITTED ENTRIES LOG" log:
httpBL Example:
Assume the following settings are in "Bad Behavior Admin/ SETTINGS/ Project Honey Pot HTTP Blacklist":

     Minimum Threat Level:    25
     Maximum Age of Data:    30

The mod will check the Project Honeypot Database:
What happens when a visitor is deemed suspicious?

CONCLUSION:
Only guests who are suspicious will not see the content enclosed in the BBC tags.

Enjoy.   :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mediaworksmt on August 03, 2011, 12:52:43 PM
I'm running into an odd error when trying to install the Bad Behavior 1.5.3 package on SMF 2.0 RC3...


I can install/uninstall other packages without issue, but this one seems to be giving me troubles.

Any ideas or suggestions would be very sincerely appreciated!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 03, 2011, 05:51:37 PM
Your session timed out while posting. Please go back and try again.

Guess 1:  I only see that message when my cookies are off.

Guess 2:  Maybe you should edit the htaccess after mod installation?

Guess 3:  you have have to manually adjust the permissions for the bad behavior folder.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on August 03, 2011, 08:20:51 PM
Butchs

I use a broadband usb dongle (flashkey) where everytime I log onto the internet a new number is used.

Would my logging into the forum be affected by the mod?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mediaworksmt on August 04, 2011, 10:55:22 AM
butchs,

Thanks for your reply - After trying all of your suggestions, including a number of different variations of permissions, I finally noticed that an error_log file was being produced when I try to enable the package. Here's the information from it:

Code: [Select]
PHP Fatal error:  Call to undefined function  add_integration_function() in /public_html/user-forum/Packages/temp/install_db.php on line 66
Any further suggestions? I again really, REALLY appreciate your help - Thanks again!

edit: Looks like I may have found my answer in another thread (http://www.simplemachines.org/community/index.php?topic=334955.1060) - It seems add_integration_function() doesn't exist in 2.0 RC3, but was added in 2.0 RC4. Going to try upgrading to the latest SMF version and will let you know how things turn out.

edit2: Successfully upgraded to 2.0 RC5, and the "Bad Behavior" package now works like a charm! :-)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 04, 2011, 08:00:51 PM
Yea, sounds probable, I keep writing it for the latest versions.    :P
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 04, 2011, 08:03:01 PM
Butchs

I use a broadband usb dongle (flashkey) where everytime I log onto the internet a new number is used.

Would my logging into the forum be affected by the mod?

I do not know.  Try accessing into the Bad behavior (http://bad-behavior.ioerror.us/) home site as a test.
If you can get on there you are okie dokie.  :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Sudhakar Arjunan on August 11, 2011, 03:51:06 AM
Nice mod.

Works perfectly without any issues.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: infoseeker on August 11, 2011, 04:13:49 AM
Help me bro.
I activated honeypot.

In the fourth step of installation i got somelinks from projecthoneypot and they recommend me to include the link in my honeypot page.

I dont know where to include or adding those links in my smf forum.

Plz tell me where can i add these links.

<a href="hxxp:mydomain.com/myhoneypot.php [nonactive]"><!-- wildlife --></a>

<a href="hxxp:mydomain.com/myhoneypot.php [nonactive]"><img src="wildlife.gif" height="1" width="1" border="0"></a>

<a href="hxxp:mydomain.com/myhoneypot.php [nonactive]" style="display: none;">wildlife</a>

Etc...

Help me. Where can i add or include these links.

Thanking you all.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 11, 2011, 05:37:57 AM
Just add "hxxp:mydomain.com/myhoneypot.php" to "Honeypot Link" and "wildlife" to "Honeypot Link word" in the mods admin page.  The mod will do the rest for you.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: infoseeker on August 12, 2011, 01:01:04 AM
Thanks you very much butchs.

You are the saviour of SMF.

wish you all the best.

Now everything is fine.

God Bless You
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on August 13, 2011, 07:14:49 PM
How do I add the bad behaviour image to the bottom of the forum?

I had a go but kept being given an error.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: MiY4Gi on August 13, 2011, 07:41:59 PM
How do I add the bad behaviour image to the bottom of the forum?

I had a go but kept being given an error.

Bad behavior image?

By the way butchs, does that Honeypot keyword actually do anything?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on August 13, 2011, 07:43:33 PM
How do I add the bad behaviour image to the bottom of the forum?

I had a go but kept being given an error.

Bad behavior image?

By the way butchs, does that Honeypot keyword actually do anything?

The one on the first post of the mods topic which many forums using this have displayed.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 13, 2011, 07:45:21 PM
How do I add the bad behaviour image to the bottom of the forum?

Instructions are here (http://custom.simplemachines.org/mods/index.php?mod=2502).
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 13, 2011, 07:48:12 PM
By the way butchs, does that Honeypot keyword actually do anything?

Yea, it is a word that attracts a click.  Pick a good one.

The link requires "http:://bla bla..."

I am testing complete httpBL validation for the next release.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on August 13, 2011, 07:51:31 PM
I did that and still had the error.

Which is the image link?



Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 13, 2011, 08:02:50 PM
Error?  You did not detail an error.   ::)

The image file is here (http://bad-behavior.ioerror.us/images/bad-behavior-80x15.png).  You will need to download it and copy it on your server to a location you can pull it form then change the link to the image.
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on August 13, 2011, 08:09:08 PM
Throw a bucket of cold water over me.

The error was an unknown < on line 510 (ish).
As for the image link.

I think I gotcha. I keep all my images on photobucket.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 13, 2011, 08:11:12 PM
You may want to keep this one in your root directory.  Not everyone can read photobucket images.  Photobucket is blocked by some secure servers.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 13, 2011, 08:19:49 PM
FYI - When I post images and etc to my site I enclose them with the suspicious BBC codes from the mod.  Then the bad guys will not be able to mess with them.
 O:)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on August 14, 2011, 10:38:11 AM
The mod is working perfectly.

Within two minutes of installing there were two blocked attempts.

This now stands at 36.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 14, 2011, 02:34:02 PM
New Version:
Fixed integration bug with old SMF version - thanks mediaworksmt
Complete http:BL & BB installation validation - Now all project honeypot input data is checked
Bad Behavior 2.1.14 update - ???

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on August 14, 2011, 05:23:05 PM
Ya mean I shoulda waited 24 hours.

 :o

Is it the usual uninstall or not a complete one?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: MiY4Gi on August 14, 2011, 05:47:37 PM
Is that update critical? I don't feel like updating it if there's hardly any benefit.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 14, 2011, 06:17:29 PM
Is it the usual uninstall or not a complete one?

Sorry I did not know that the Bad behavior author was going to publish an update today.

Not sure of the changes to the core but i think it has something to do with good bots.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 14, 2011, 06:18:56 PM
Is that update critical? I don't feel like updating it if there's hardly any benefit.

Not sure.  The stuff I did is not critical.  It is just more user friendly. 12 vs 24 hr time display and validation checks of inputs.

But I am waiting for the list of changes to the core.  I am sure it can wait a week?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: ziycon on August 27, 2011, 06:47:10 PM
Can I clear out the 'log_badbehavior' table as its taking up a lot of space? I tried running the two scheduled tasks but they didn't seem to do much if anything?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 28, 2011, 10:41:54 AM
The scheduled tasks are for daily cache purging and weekly log purging.

The log table automatically deletes it's self every week.

The mod will still protect your site if you turn off "Logging".  Logging is basically useful for testing.  Once you know it is working turn it off and in 7 days  the 'log_badbehavior' table will empty it's self.


EDIT:  I meant cache purging.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: ziycon on August 28, 2011, 10:49:24 AM
The scheduled tasks are for daily cookie purging and weekly log purging.

The log table automatically deletes it's self every week.

The mod will still protect your site if you turn off "Logging".  Logging is basically useful for testing.  Once you know it is working turn it off and in 7 days  the 'log_badbehavior' table will empty it's self.
Nice one Butchs, thanks for the help again.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 28, 2011, 08:10:27 PM
You are welcome.    :)

Contrary to popular belief, I thought of many scenarios for this mod...   :o ???

I should let you know that, if you turn off logging you should also turn off "Display statistics" because the statistics only works when logging is ON.  With logging OFF, "Display statistics" will no longer count the bad guy hits and will provide an incorrect lower count.

Same is true for my other mod...

If for some reason, you feel the mod is not working change your UA as described in "to test" in the first post of this thread...

 
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Alex' Manson on August 30, 2011, 02:32:56 AM
Project Honey Pot is offline!

from 2 days.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Inti31 on August 30, 2011, 04:10:25 AM
it is not. it is working, also yesterday it was available.
my connection with HoneyPot is perfect.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 30, 2011, 05:29:23 AM
Really nothing we can do.  I noticed it has been up and down lately.

Not a big deal since the mod protects you via other means...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: InfoStrides on August 30, 2011, 06:32:27 PM
Good mod! How do I whitelist an IP address with this mod?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 30, 2011, 08:17:56 PM
ADVANCED WHITELIST HELP
In SMF you can whitelist member groups only.  Unlike httpBL, this mod will use the last known ip address of a whitelisted member and not block them if they are not logged in and their ip address has not changed.

This tutor details advanced whitelisting methods that allow you to whitelist just about anything else in "Bad Behavior Admin/ SETTINGS/ Whitelist".  this feature is typically used to whitlist the administrators IP (optional) and for PayPal (http://www.simplemachines.org/community/index.php?topic=375980.msg3152326#msg3152326) and OpenID (http://www.simplemachines.org/community/index.php?topic=375980.msg3152400#msg3152400) functionality.

Inappropriate whitelisting WILL expose you to spam, or cause Bad Behavior to stop functioning entirely! DO NOT WHITELIST unless you are 100% CERTAIN that you should!

"Bad Behavior Admin/ SETTINGS/ Whitelist/ IP Address":The only recommended whitelist address are:
Code: [Select]
64.191.203.0/24
208.67.217.130

WARNING:  The following RFC 1918 IP addressees are standard with the core Bad Behavior package and are NOT recommended for SMF.  The reason is that SMF will not work if you have the forum set up to use a RFC 1918 IP (private IP).  SMF will only work with using an external static IP or domain name:
Code: [Select]
   10.0.0.0/8
   172.16.0.0/12
   192.168.0.0/16

"Bad Behavior Admin/ SETTINGS/ Whitelist/ URL":
Code: [Select]
/example        would match "/example.php" and "/example/address".

"Bad Behavior Admin/ SETTINGS/ Whitelist/ User Agent":
Code: [Select]
Mozilla/4.0 (It's me, let me in)

WARNING: The core Bad Behavior package uses an emergency back door User Agent "Mozilla/4.0 (It's me, let me in)" that has been removed from the SMF version because it can be exploited.

 O:)

EDIT:  Moved whitelist to the admin panel in version 1.5.10 - All the information that was once in whitelist.ini in now in "Bad Behavior Admin/ SETTINGS/ Whitelist"  Obsoleted information removed.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Maxtor on September 03, 2011, 04:34:17 AM
since i installed this mod, paid subscriptions doesnt work. its blocked somehow. can you tell me how to fix it?

error code 403 Forbidden (from IPN History)

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 03, 2011, 08:09:03 AM
You posted this in another thread.  Taking a shotgun approach to get support is frowned upon here.
I have enabled paid subscriptions, and after i installed these 2 mods:

Mod Name: Bad Behavior mod
http://custom.simplemachines.org/mods/index.php?mod=2502

Mod Name: httpBL
http://custom.simplemachines.org/mods/index.php?mod=2155

paid subscriptions are failing with error code 403 Forbidden (from IPN History)

Code: [Select]
Notification URL: http://maxcheaters.com/forum/subscriptions.php

HTTP response code: 403

Delivery status: Failed

No. of retries: 16

This mod has nothing to do without outgoing traffic.  Delivery status looks like something to do with your subscription configuration.

That being said...  Not sure how subscriptions works but there is a option in this mod called "Offsite Forms".

Allow Offsite Forms (default false):
Bad Behavior normally prevents your site from receiving data posted from forms on other web sites. This prevents spammers from, e.g., using a Google cached version of your web site to send you spam. However, some web applications such as OpenID require that your site be able to receive form data in this way. If you are running OpenID, enable this option.

If you still have issues you can place the ip address of your service in the whitelist (see a few posts back).
 8)

Lastly, it could be that other mod.  The SMF 2 code is based off a beta version and has little SMF 2x support.   Try enabling the Project Honeypot feature in Bad Behavior instead.   :o
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Maxtor on September 03, 2011, 08:37:30 AM

This mod has nothing to do without outgoing traffic.  Delivery status looks like something to do with your subscription configuration.
subscriptions were working 3 years now. 1.x and 2.x versions.

That being said...  Not sure how subscriptions works but there is a option in this mod called "Offsite Forms".

Allow Offsite Forms (default false):
Bad Behavior normally prevents your site from receiving data posted from forms on other web sites. This prevents spammers from, e.g., using a Google cached version of your web site to send you spam. However, some web applications such as OpenID require that your site be able to receive form data in this way. If you are running OpenID, enable this option.
let me try this and inform you.
If you still have issues you can place the ip address of your service in the whitelist (see a few posts back).
 8)

Lastly, it could be that other mod.  The SMF 2 code is based off a beta version and has little SMF 2x support.   Try enabling the Project Honeypot feature in Bad Behavior instead.   :o

ip address of my service? where is that on paypal?

i dont think its httbl, this is only for spamers.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 04, 2011, 07:53:48 AM
USING PAYPAL HELP
(other payment services may be similar)

Quote from: Core Engine Author
Due to ongoing issues with various web services such as OpenID and PayPal IPN behaving in strange ways which trigger Bad Behavior, a new whitelist has been added. You may now add URLs of your site to Bad Behavior’s whitelist. When a URL is added, Bad Behavior will ignore any HTTP request to that particular URL. If you need this feature, please check the bad-behavior/whitelist.inc.php file for further information. This feature was driven largely by the PayPal IPN web service, which sends POST requests with no User-Agent string, a common indicator of malicious activity. PayPal has refused to add a User-Agent string for years and has never given a reason, good or bad, for not including it. Reports from PayPal merchants who have contacted me indicate that PayPal is finally considering adding a User-Agent string to IPN requests; interested merchants should contact PayPal to express their support for this feature.

By default, Bad Behaviour blocks calls from payment services like PayPal’s IPN, meaning subscriptions won’t get told when a valid payment has been made. This blocking applies to any automated payment notification, as well as calls by subscriptions itself.

Until PayPal IPN clears up its POST requests it is recommended that you whitelist all IPN related addresses in this link.  Remember to place ";" before comment lines.

Here is an example of changes you can make to "Bad Behavior Admin/ SETTINGS/ Whitelist/ IP Address":
Code: [Select]
; IP address for PayPal servers
;------------notify.paypal.com(IPN)------------
216.113.188.202
216.113.188.203
216.113.188.204
66.211.170.66

; Starting September 29, 2011 www.paypal.com will be hosted by Akamai.
;------------ipnpb.paypal.com------------

64.4.240.0/20
66.211.160.0/19
216.113.160.0/19
173.0.80.0/20

; Additional IP addresses starting Q1 2012:
118.214.15.186
118.215.103.186
118.215.119.186
118.215.127.186
118.215.15.186
118.215.151.186
118.215.159.186
118.215.167.186
118.215.199.186
118.215.207.186
118.215.215.186
118.215.231.186
118.215.255.186
118.215.39.186
118.215.63.186
118.215.7.186
118.215.79.186
118.215.87.186
118.215.95.186
202.43.63.186
69.92.31.186
72.247.111.186
88.221.43.186
92.122.143.186
92.123.151.186
92.123.159.186
92.123.163.186
92.123.167.186
92.123.179.186
92.123.183.186
92.123.199.186
92.123.203.186
92.123.207.186
92.123.211.186
92.123.215.186
92.123.219.186
92.123.247.186
92.123.255.186
95.100.31.186
96.16.199.186
96.16.23.186
96.16.247.186
96.16.255.186
96.16.39.186
96.16.55.186
96.17.47.186
96.6.239.186
96.6.79.186
96.7.175.186
96.7.191.186
96.7.199.186
96.7.231.186
96.7.247.186

It is the responsibility of the admin to insure that the addresses are up to date.

It is also advised to whitelist the php file that communicates with paypal.

For example in "Bad Behavior Admin/ SETTINGS/ Whitelist/ URL:
Code: [Select]
/subscriptions.php
/Sources/Subscriptions-PayPal.php

ref

EDIT:  Moved whitelist to the admin panel in version 1.5.10 - All the information that was once in whitelist.ini in now in "Bad Behavior Admin/ SETTINGS/ Whitelist"  Obsoleted information removed.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 04, 2011, 10:43:15 AM
USING OpenID HELP

Offsite Forms must be checked for openID in the bad Behavior admin panel.

Quote from: Core Engine Author
Allow Offsite Forms (default false):
Bad Behavior normally prevents your site from receiving data posted from forms on other web sites. This prevents spammers from, e.g., using a Google cached version of your web site to send you spam. However, some web applications such as OpenID require that your site be able to receive form data in this way. If you are running OpenID, enable this option.

The OpenID server must be added to the Bad Behavior  whitelist.

For example, make the following changes in "Bad Behavior Admin/ SETTINGS/ Whitelist/ URL":
Code: [Select]
/Sources/Subs-OpenID.php
ref

EDIT:  Moved whitelist to the admin panel in version 1.5.10 - All the information that was once in whitelist.ini in now in "Bad Behavior Admin/ SETTINGS/ Whitelist"  Obsoleted information removed.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Maxtor on September 04, 2011, 01:52:55 PM
after adding these lines at whitelist i got this from paypal IPN history (today)

Code: [Select]
Date/time created: 9/4/2011 08:16 PDT

Original/Resent: Original

Latest delivery attempt date/time: 9/4/2011 09:42 PDT

Notification URL: http://maxcheaters.com/forum/subscriptions.php

HTTP response code: 403

Delivery status: Retrying

No. of retries: 10

so its failed again.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 04, 2011, 02:04:47 PM
It has been working for others for quite some time.  Look at the reference on the bottom. 

Your url should be:

Code: [Select]
/forum/subscriptions.php
I do not know what else to tell you...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Maxtor on September 04, 2011, 02:38:23 PM
http://img6.imageshack.us/img6/2713/bad1b.png
http://img269.imageshack.us/img269/8343/bad2u.png

check this and tell me what is wrong.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 04, 2011, 02:58:27 PM
Looks correct and the ip range is whitelisted on my 2.0 Gold test server.

Could be the forum, server or bad behavior cache not resetting.

If you have cloudflare purge it.
If you uninstall and reinstall a mod the forum disc cache will reset.
Not sure how to reset server specific cache -  You will need to consult your host or look it up.
 ;)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Maxtor on September 04, 2011, 03:02:51 PM
Looks correct and the ip range is whitelisted on my 2.0 Gold test server.

Could be the forum, server or bad behavior cache not resetting.

If you have cloudflare purge it.
If you uninstall and reinstall a mod the forum disc cache will reset.
Not sure how to reset server specific cache -  You will need to consult your host or look it up.
 ;)


maybe conflicts with nginx?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 04, 2011, 03:07:52 PM
Naw, Cloudflare uses nginx (as other tested servers) and it works with that.  CF uses ngnix as a front end caching proxy.  When changes are made the cache has to be purged.

Did you purge the cache on your server?

I believe there is be an accelerator that is keeping stuff in memory.

2) Try to copy your whitelist into the Sources/bad-behavior directory of the mod zip file and reinstall?

EDIT:  I was able to duplicate your error.  Item 2 fixed it on my test server with 64M Zend Engine v2.3.0  & XCache v1.3.0 enabled.

So much for taking off until November...
Title: trauma overcome with FTP
Post by: unblinkable on September 28, 2011, 03:46:45 PM
First time SMF user: long time phpBB user.

SMF 2.0.1 via softaculous (as I do not have time to manually manage all things interweb)

I had difficulty installing this mod. 

(1) fail

The integrated package browser would not play well.

(2) fail

browsing this sites mod listings for 2.0.1 compatible entries I copied the URL of the larger zip file to the package uploader of my SMF instance, upload, repeat for smaller file.  But SMF complained that the second file (~15kB was empty).  I tried copy/paste in reverse order (small then large zip file).  File not found complaints.

(3) win

Once I FTP'd the two files into ./Packages, returned to 'Browse packages', and clicked 'install' for BadBehavior was I permitted to proceed

Proposed installation seems good with either 'test successful' or 'file skipped' :: no failures in red listed.

"congratulations"

----

I appreciate the time you have invested in this mod but hope other people can overcome the manual requirements.


cheers
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on September 28, 2011, 03:53:26 PM
???   Must be some odd configuration of your host.

The mod installed just fine for me, using the package manager.....
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 30, 2011, 04:37:41 AM
The package was re-uploaded with a fix to the spanish translation.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: RustyBarnacle on October 11, 2011, 03:01:59 PM
My appologies if this has already been discussed, but I searched and didn't see it.  Every once in a while I get the following image in the top left corner and white space across the top of my screen.  Everything installed correctly with the theme so I'm not sure what's wrong.

The image is a link to the worm.php file.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 11, 2011, 08:23:09 PM
Click on the "?" for help in the admin panel.

That is your and the honeypot spam trap and "worm.php" is the Honeypot Link you entered in the admin panel.

The mod generates several random spam traps that are used to lure in the bad guys.  Select "Limit honeypot on forum" to make the trap unnoticeable and simple.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: RustyBarnacle on October 14, 2011, 05:11:31 PM
Excellent, thank you!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: frytec on October 17, 2011, 03:51:26 PM
is this mod the same of HTTP:BL mod?

what are their differences?

wich one is better?

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 17, 2011, 06:24:57 PM
Come on...  This mod has project honeypot and the bad behavior engine.  It does more.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: frytec on October 18, 2011, 10:57:36 AM
how it does more?

HTTP:BL uses ProjectHoneyPot too..

so they use the same data base, what do you mean "BadBehavior does more"?

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on October 18, 2011, 11:21:39 AM
This mod does BOTH the bad behavior addition PLUS the HttpBL addition.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 19, 2011, 04:31:48 AM
See the first post for more info on the "bad behavior addition".
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: ctec67 on October 19, 2011, 01:46:42 PM
Hello,

OK most of you will probably laugh at this one.. but
I am at the end of my nerves.. where will I see/find
the admin section for Bad Behavior?

I follow instructions for installation, did not give me
any error messages, but now have no admin options
in my admin section :(

Sincerely
Carola
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on October 19, 2011, 01:55:30 PM
Admin > Configuration
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: ctec67 on October 19, 2011, 02:20:46 PM
Guess that means it did not install :(

As I don't have that option in my admin (see picture)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 19, 2011, 05:41:39 PM
You have to manually copy theme files or do a manual install for a custom theme.

for SMF 2.0 Try:
      copying "BadBehavior_Admin.template.php" to the "$themedir"
      copying "BadBehavior.english.php" to the "$languagedir"
      copying "badbehavior_bbc.gif" to the "$imagesdir/bbc"
      copying "badbehavior.css" to the "$themedir/css"

Otherwise you will need to do a manual install.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: ctec67 on October 19, 2011, 06:18:33 PM
I use 2.0.1

Copying files did not work.. so looks like
I will have to do a manual install.. and
that will just have to wait for now.. but
many thanks Butchs for your reply :)

Sincerely
Carola
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 21, 2011, 07:41:55 PM
New version.  Some minor fixes and an attempt to fix the SMF 1.1.x DB errors.

New 2.1.15 core... New in this release (since 2.1.13):


Remember to back-up any custom "whitelist.ini" files you may have created...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: ^SITS^ on October 23, 2011, 11:20:36 AM
i installed Bad Behavior on my forum.  When I look at the files that it installed via ftp versus the files that I unpacked on my own computer, they are significantly different.  Can I use ftp to copy all the files up to the Bad Behavior Mod folder?  I do have a couple of custom themes that need to be dealt with manually, but the files that I need to do that with, did not get uploaded to my server when I did the install through the package manager.

Should I uninstall the mod before uploading the files, if that is what I am supposed to do?  If I do uninstall the mod, will it show up via the installed packages, if I just upload the files manually?

It is also asking me for an alpha key that I can't find.  I did receive a key from honey pot but it is all numbers.  Can someone tell me where this alpha key can be found?

Thanks in advance.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 23, 2011, 04:49:57 PM
No.  There is a set of files for SMF 1.1.x and a different set of files for SMF 2.0.x.  The mod installs the correct files automatically.  Look at package manager for the correct files for your version of SMF.

Project honeypot Access Keys (http://www.projecthoneypot.org/httpbl_api.php) are 12-alpha characters (no numbers).   If you see this "You must enter a valid Project Honey Pot http:BL Key, which can only be exactly 12 alphabetic characters. (no numbers or symbols) Leave the field blank to disable this function" then you need to correct the "http:BL Access Key" in the admin panel.

Request an access key here (http://www.projecthoneypot.org/httpbl_configure.php).

edit 10/24- added link to access key
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Malaky on October 29, 2011, 03:50:31 AM
One of my user got denied by BadBehavior posting in a topic he has previously posted in fine because of this reason: "POST more than two days after GET".
What does that mean?

He tried deleting cookies/emptying cache but it didn't work.
He can post in other topics fine.

I'm running SMF 2 et BadBehavior 1.5.3

Thank for any help or pointers!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 29, 2011, 08:46:25 AM
Bad Behavior was developed for a content manager.  One of its features is to check for suspicious activity via BB's javascript/ cookie to test post and get in a form.

"POST more than two days after GET" means that the request dates and times in a form entry do not match. This could indicate the use of a proxy which corrupts the HTTP headers of the request, causing Bad Behavior to trigger.

As far as I know both post and get are not used in SMF unless your site is connected to some sort of offsite Form.

Possible solutions:
1.  If you are using offsite forms in your site enable that feature in your admin panel.
2.  Ask him to try to enable cookies or Javascript and see if it goes away.
3.  He may have a bad proxy.
4.  He may have a trojan on his computer.
5.  Someone may have created a post on your site that links to an offsite form.  Maybe a click scam or an information collector.  Do you know which thread it is?  If so can you you go to phpmyadmin, copy the data and attach it as a text file here?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: ^SITS^ on October 29, 2011, 11:24:05 AM
Thanks butchs. :) Got the key and the mod is running just fine on my forum now.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 12, 2011, 07:41:52 AM
You are welcome.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: booch_21 on November 26, 2011, 10:30:32 AM
I have an odd occurrence that is my fault for not paying attention.  The last mod I installed was the latest upgrade to this mod.  Since then, I cannot install or uninstall any mods.  If my feeble memory is jogged enough,I seem to recall something at the end of installation that said that some files attributes were changed at the end and to tick a box to revert them back to ?.  But, as I looked up to see that and tick the box, the screen went away too fast and went back to the package manager.

I hope I am thinking of the right mod, but can anyone tell me what the message said and how I can get the files back to their former attributes?  Thanks for helping!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 26, 2011, 10:41:14 AM
You mean this from the readme?

During installation of SMF 2.0x and or at a later date, SMF may ask to "Restore File Permissions" for "banned.inc.php".  Do not make any changes!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: booch_21 on November 26, 2011, 10:46:34 AM
Something also involved a checkbox at the end.  I may have the wrong mod.  Something is funky since I cannot install or uninstall anything right now.  I haven't changed anything in quite some time. 
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 26, 2011, 10:54:57 AM
To prevent issues this mod disables it's self when uninstalled.  You have to enable it via the check box before it is active again.  If you never enabled it then your issue most likely lies in something you did or elsewhere.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: booch_21 on November 26, 2011, 11:02:57 AM
Well, I assumed it was active and when I tried to go into the Bad Behavior section to look, I got a white screen, the same as I get when trying to install or uninstall a mod.  Curious.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 26, 2011, 11:14:24 AM
Maybe you did a double installation of a mod?  If you remember what mod you were last playing with you can try to uninstall it twice via package manager.  The first time takes a click.  To do it the second time you will have to copy the original mods zip file to the "Packages" directory via ftp before going back to package manager.  If it was installed twice it will show up on the list.

Though I am giving you a possible path forward, support for the above type of error is out of the scope of this thread.  I am sure this topic has been covered in detail elsewhere in this site.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: booch_21 on November 26, 2011, 11:22:08 AM
The last mod installed was Bad_Behavior_1.5.6.zip on 10/31/11.  There is only one copy of it.  I cannot get into the settings area of this mod to see that it is active or inactive.  I now recall that I had an issue with it when I installed it but was taken away and never returned to the issue.  That is why I am here now.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 26, 2011, 11:44:20 AM
I need details to exactly what you did.  It is impossible for me to read your mind through my computer and guess your version of SMF, theme, and or anything else you have done.

The mod has been installed on thousands of forums without issue.  So my first guess is you made an error by accidently performing a double installation of the mod (read the instructions in the last post), which is human not mod error since this can be done with any mod

Now if you performed a double installation and do not have access to package manager you will have to manually uninstall the mod.

Or have a custom theme that requires manual installation or un-installation of the mod.  As stated way back the mod support is for the default theme only.  I do not have the time to create code for every custom theme.

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 26, 2011, 05:53:45 PM
If you have a custom theme maybe you need to copy the language files over to the theme???
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 28, 2011, 08:01:30 PM
Been probing the internet to see if my SMF mod is doing any good.  I found several SMF sites:


I am sure there are many more.  These high numbers are telling me I need to add a DB count reset in the next version...

I extend my thanks to all who use this mod!  I am happy to see my work has given such results!
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: postpar on November 29, 2011, 10:00:45 AM
This mod LOOKS great and shoudl be the answer to my Cloudflare issues as well as spam, but -- I wasn't able to install it automatically onto SMF 2, and when I tried manual installation all worked well except I could not run install_db.php. When I try, I get "Admin priveleges required." but I have NO idea how to set them up ... any help?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 29, 2011, 04:43:07 PM
It works well with Cloudflare.

You can download my unofficial Cloudflare mod here (http://www.simplemachines.org/community/index.php?topic=391926.msg2726085#msg2726085).

Try the attached install_db file.  I will delete the attachment in 1 day.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 18, 2011, 08:32:27 PM
New version.  Added more security due to bots probing for vulnerabilities.  Thank you MissileShooter for pointing out some errors in the SMF log...
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: JPAnderson on December 19, 2011, 11:14:45 AM
I am having some trouble with this mod. I have installed and configured Bad Behavior, but it is showing "Project Honeypot Offline"

I am fairly certain that this is not a matter of the Project Honeypot site being offline, because I have another site running httpBL that shows a good connection.  I have included my list of installed mods, to see if there may be some compatibility issues. 

I am using v1.5.7, have double check my API key, script installation, linking, and keyword, but I continue to get the error.



Any ideas?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 19, 2011, 11:35:41 AM
The Project HoneyPot test offered at the Project HoneyPot site (as used in many other mods) always shows it to be online.  This is not true!  The test this mod performs is unique and is extremely accurate.  I went through great pains to insure accuracy.

At this moment "Project Honeypot Offline" is true.  I tested it at my site.  The web page may be up but the service is not proving test results.  Probably updating the database...  Give them a few hours and they will most likely be beck in service.

The beauty of Bad Behavior is that it still protects your site when Project HoneyPot is down through it's own tests.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: JPAnderson on December 19, 2011, 11:54:57 AM
The Project HoneyPot test offered at the Project HoneyPot site (as used in many other mods) always shows it to be online.  This is not true!  The test this mod performs is unique and is extremely accurate.  I went through great pains to insure accuracy.

Fascinating! Kudos for that! It's somewhat disappointing that they use an inaccurate method to test the availability of their services. butchs for president?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: nadrojcote on December 20, 2011, 11:04:56 AM
Every time I try to install this mod my file permissions change on my home dir, causing my to get error 500 on all my sites not just this one. I know it is something to do with my host, but is there anything I could suggest they change to allow me to install this? I guess I could also install it manually.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 20, 2011, 09:02:26 PM
You could always go back to cpanel's file manager and change the permissions manually. 

I have to do the same for my web site because when I install mods the permissions end up as 666 so I manually change them to something more secure.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Tibian on December 21, 2011, 05:58:55 AM
So I installed the mod, I had to create a temp folder to get past some chmod settings, but that was easy.

Apparently I either missed a step or I am just missing something. But I don't see the mod under any drop down menus. Where is it located in the administration?  :'(
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 21, 2011, 08:13:31 AM
Under admin/ Configuration.  Maybe the mod's language files are not in the language directory?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Tibian on December 21, 2011, 06:48:19 PM
Under admin/ Configuration.  Maybe the mod's language files are not in the language directory?


I thought of that so I manually uploaded the files to my language directory. Didn't fix. Uninstalled and installed the package again, and I get this error.

Code: [Select]
Fatal error: require_once() [function.require]: Failed opening required '/home/kotsadmin/thekots.com/Sources/bad-behavior/bad-behavior/functions.inc.php' (include_path='.:/usr/local/lib/php:/usr/local/php5/lib/pear') in /home/kotsadmin/thekots.com/Sources/bad-behavior/bad-behavior/core.inc.php on line 11
Looked in the path, found out that functions.inc.php was not uploaded. I uploaded it, website is functional, but I am curious now if it installed correctly because the sources in the .zip has a TON of files, whereas in my FTP there are only five.

--Update: So everything seems to be working as far as the settings/honeypot goes. I have yet to do the fake/pseudo testing recommended but I will try doing that when I get enough time. The pure culprit of my error was that the sources directory didn't seem to upload properly. I don't know if this was because of having to create a packages/temp folder that kept deleting itself or what... but so far everything seems to be fine.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 22, 2011, 10:15:36 AM
Since tests are performed on a need to know basis and if you do not have all the files a bad guy could get through.  I recommend to unzip the mod on my home computer and look at the changes in "package-info.xml".  depending on your version of SMF there are specific files that go into specific places.  Verify each file to insure they are all in the correct location.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on December 30, 2011, 12:28:18 PM
quick question, I Run 2 forums, I have this installed in both, and it works great in both.

But one forum shows the display just above the load time for how many bad ips ive got within 7 days

the other does not, the code it there in the default, and in the custom theme files  , just above the load time code like its supposed to be   .. there is no reason it shouldnt be there, AND i have it selected in the admin to show it.

but its not showing... the mods working fine except for that....   

its not showing in the default and custom theme

Im running SMF 2.0.2 for both forums, the working forum is using the Darkmodern theme  the non working is using the Blue moonlight theme....
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 30, 2011, 01:18:00 PM
Maybe the following is not in index.template.php of the non-working theme:

Code: [Select]
if ($modSettings['badbehavior_display_stats']) {
if (!function_exists('bb2_insert_stats')) {
global $sourcedir;
require_once($sourcedir . '/bad-behavior/BadBehavior-SMF.php'); }

  bb2_insert_stats();
}

You should also find in index.template.php:
Code: [Select]
// Bad Behavior Start
if (function_exists('bb2_insert_head')) {
  bb2_insert_head();
}
// Bad Behavior End

The mod may not load properly without the above.  You may want to review the code for that part of the installation.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on December 30, 2011, 01:23:25 PM
both of those codes are exactly where they need to be in both the default, and blue moon themes index templates



Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 30, 2011, 02:49:50 PM
Please post the index.template.php for the blue theme.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: crazeedriver2005 on December 30, 2011, 03:27:05 PM
Hello. I've installed BB on my forum, installed a honeypot correctly, and put in my http:BL key. I keep getting the error saying that I must enter a valid Honey Pot Link Word URL or leave the field blank...and the field is blank. I've tried uninstalling/reinstalling the mod but it did not resolve this. How do you fix this? Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on December 30, 2011, 04:00:16 PM
I had that problem to, when you go to honey pot get the quicklink, look in the quick link HTML on that page, along with the reoccuring honeypot link , you we see a word multipul times, for me it was like " longpoke " thats the Link word, so in the big honey pot area, you only need to add the quick link URL, not all that html they provide for you, then the link word is the random word reoccuring

here is an example

go to the honey pot site, click manage quick link

copy just your quick link into the Big BB link box  you dont need to copy all the code, only the url
Code: [Select]
http://aatf.us/conditionalgrowing.php?rss=0793
then look to the embed code on the manage quick link page

Code: [Select]
<a href="http://aatf.us/conditionalgrowing.php?rss=0793"><!-- grany --></a> <a href="http://aatf.us/conditionalgrowing.php?rss=0793"><img src="grany.gif" height="1" width="1" border="0"></a>
<a href="http://aatf.us/conditionalgrowing.php?rss=0793" style="display: none;">grany</a> <div style="display: none;"><a href="http://aatf.us/conditionalgrowing.php?rss=0793">grany</a></div> <a href="http://aatf.us/conditionalgrowing.php?rss=0793"></a> <!-- <a href="http://aatf.us/conditionalgrowing.php?rss=0793">grany
</a> --> <div style="position: absolute; top: -250px; left: -250px;"><a href="http://aatf.us/conditionalgrowing.php?rss=0793">grany</a></div> <a href="http://aatf.us/conditionalgrowing.php?rss=0793"><span style="display: none;">grany</span></a> <a href="http://aatf.us/conditionalgrowing.php?rss=0793"><div style="height: 0px; width: 0px;"></div></a>


notice the word " Grany " keeps poping up in the code, thats your Link word   
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on December 30, 2011, 04:05:02 PM
Please post the index.template.php for the blue theme.



here you go  , thanks!!!!!! 
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 31, 2011, 03:28:25 AM
Please post the index.template.php for the blue theme.

here you go  , thanks!!!!!! 

Your problem is another mod is causing an error.  If I remove  ". get2by2host_copyright()"  the page loads correctly.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on December 31, 2011, 08:48:18 AM
You know what when I installed that mod, I read the thread about it, and alot of people were complaining about that copyright being slammed at the bottom of the index template.

its for a menu buttons mod, and the complainers said the sneaky way they slid that in was bad

thanks, I love your mod   ive blocked 40 attempts in 4 days. and only 2 comment spammers got through!



I have on final question. if and when you make upgrades, do I clean uninstall the prev version, or do you give instructions on a update without a full  uninstall, I want to always keep this mod up to date


and finally, THANK YOU, none of the mod creators I ask questions to on this site reply..... like ever....   your the first one to give me 1 on 1 help, THANK YOU sooooo much!   and thats why your mod is awesome!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on December 31, 2011, 08:59:05 AM
Please post the index.template.php for the blue theme.

here you go  , thanks!!!!!! 

Your problem is another mod is causing an error.  If I remove  ". get2by2host_copyright()"  the page loads correctly.


I tried removing that line in both index templates ( default and theme )...  and still nothing
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 31, 2011, 12:05:58 PM
I have my cache turned off.  It worked for me...  Did you include the dot?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on December 31, 2011, 12:21:03 PM
i zapped the dot with the code... whats weird is the forum that does have this working has the same "get2" code for that mod as well and works great

non working  www.paranormalpi.org    working  www.deggi5.com   

also could it be that there is noting in the permitted and not permitted logs yet?   on the site that its not working the logs are empty... ( its a fairly new site, the spammers havent found yet ) and the site it works on, gets bombed lol 51 denied attempts in the last 7 days


lemme give it a few days till I get at least 1 spammy in the denied log and see if that triggers the report to show
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on January 04, 2012, 05:30:31 PM
thats what it was, the display doesn't show up untill it has blocked at least 1 bad bot.....


GREAT MOD, its stopped my spam by 90%   177 bad  blocks in 7 days !
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on January 04, 2012, 07:20:20 PM
Mike as the 2by2hosts folks are not popular I would suggest you look elsewhere for a similar mod.

Look their name up using search.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 04, 2012, 07:28:30 PM
thats what it was, the display doesn't show up untill it has blocked at least 1 bad bot.....


GREAT MOD, its stopped my spam by 90%   177 bad  blocks in 7 days !

Thank you for providing an update.  Most people stop posting when their problem is resolved.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on January 04, 2012, 07:30:31 PM
butchs my apologies for the hijack.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on January 05, 2012, 03:37:13 PM
thats what it was, the display doesn't show up untill it has blocked at least 1 bad bot.....


GREAT MOD, its stopped my spam by 90%   177 bad  blocks in 7 days !

Thank you for providing an update.  Most people stop posting when their problem is resolved.


I love this mod, anything I can do to help because look  --->   " Bad Behavior has blocked 767 access attempts in the last 7 days  "     As you can see you have helped me VERY MUCH! lol     Cheers, and happy new year!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: pols1337 on January 10, 2012, 04:47:43 PM
Hi butchs,

I currently have Bad Behavior showing up twice at the bottom of my forum.  (Why this happened?  My forum, which already included Bad Behavior, wasn't enabling me to post due to some conflict with a mod, so I reinstalled 2.0.2 and ran an upgrade, then reinstalled Bad Behavior).  Anyways, I'm guessing that modification is working but it just looks bad with two lines of text ... see attachment.

Is there some file to fix? 

Thanks,
pols1337


 
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 10, 2012, 06:19:34 PM
It has something to do with your index.template.php file.  Please attach a copy.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on January 10, 2012, 06:43:17 PM
basically, the problem is that he reinstalled smf without UNinstalling the mod first....   and he's using a custom theme.

So, what that means is: when he reinstalled smf, he removed all traces of the mod from the core smf files, including the default/curve theme... but did not remove the mod code from any custom themes.
He then went and reinstalled the mod, and checked the boxes for "install into my custom themes", even though it was already installed into the custom themes....

So, every theme file edit that exists in the custom theme will be duplicated. The only VISIBLE one is the footer, but I guarantee that the additions higher in the index.template.php file were also duplicated.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: pols1337 on January 10, 2012, 06:53:53 PM
Please see attached for index.template.php.

Not sure which one you need so I'm attaching all three: Astonished (custom theme), Core, and Default.



Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 11, 2012, 04:52:39 AM
basically, the problem is that he reinstalled smf without UNinstalling the mod first....   and he's using a custom theme.

So, what that means is: when he reinstalled smf, he removed all traces of the mod from the core smf files, including the default/curve theme... but did not remove the mod code from any custom themes.
He then went and reinstalled the mod, and checked the boxes for "install into my custom themes", even though it was already installed into the custom themes....

So, every theme file edit that exists in the custom theme will be duplicated. The only VISIBLE one is the footer, but I guarantee that the additions higher in the index.template.php file were also duplicated.

That is what happened.  See the attached fix.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: pols1337 on January 11, 2012, 11:13:32 AM
So just to confirm, there are no changes that need to be made to the Core and Default index.template.php? 
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 11, 2012, 06:22:19 PM
Does it work?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: pols1337 on January 11, 2012, 06:55:57 PM
Yup it looks good.  Just wanted to confirm though.   :D
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on January 11, 2012, 07:16:12 PM
I used to get 3 spam bots a day, I havent got one since I installed this mod

THIS REALLY WORKS!!!!

From my site
"   Bad Behavior has blocked 2612 access attempts in the last 7 days. "


THANK YOU! 
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Crip on January 13, 2012, 09:46:06 AM
Hi,
Is the BB_Language.zip required for this .Mod??
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 13, 2012, 08:23:20 PM
Hi,
Is the BB_Language.zip required for this .Mod??

No.  It is an aid for would-be translators.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: frytec on January 17, 2012, 12:06:17 PM
how can i allow an specific server access my smf using badbehavior?

its my own server for my other website, wich have to ping my smf forum wich uses badbehavior mod.

im getting error 403

Quote
Bad Behavior - Event Details
ID:    4264
IP:    200.98.197.4
whl0056.whservidor.com
DATE:    2012-01-17 14:00:07
METHOD:    GET
URI:    /
PROTOCOL:    HTTP/1.0
HEADERS:    GET / HTTP/1.0 Host: www.detetiveweb.com.br User-Agent: Mozilla/5.0 (compatible; U; Linux i686; en-US) LinkDr/0.6.4 http://linkdr.net/ X-Forwarded-For: 200.98.197.4
AGENT:    Mozilla%2F5.0%20%28compatible%3B%20U%3B%20Linux%20i686%3B%20en-US%29%20LinkDr%2F0.6.4%20http%3A%2F%2Flinkdr.net%2F
ENTITY:    
KEY:    17566707
DENIED REASON:    Required header 'Accept' missing
EXPLANATION:    An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.
ERROR:    403
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: SuperBrian91 on January 17, 2012, 03:38:57 PM
Hi,

I had this mod installed on my forum for ages and it was working perfect, but I uninstalled it a few minutes ago to reinstall it because I was getting a lot of spam members but when I reinstalled it I keep getting the following message on the top of my forum and all the fonts are huge and the forum doesn't look right.

// Bad Behavior Start $txt['permissionname_badbehavior_goodgroup'] = 'Bad Behavior Whitelist Group'; $txt['permissionhelp_badbehavior_goodgroup'] = 'This option will make a member group exempt from all Bad Behavior tests.'; // Bad Behavior End

Anyone know what might be causing this? My site is now on maintenance mode at the moment. If anyone could help me as soon as possible because I am getting a lot of message from members asking what wrong.

Thanks.

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on January 17, 2012, 03:48:28 PM
 look in your modifications.english.php


the text got added after the closing ?> somehow...   move the ?> to be the last thing in the file
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: SuperBrian91 on January 17, 2012, 03:52:33 PM
look in your modifications.english.php


the text got added after the closing ?> somehow...   move the ?> to be the last thing in the file
Thank you very much Kindred you are a life saver.  :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 17, 2012, 05:47:46 PM
how can i allow an specific server access my smf using badbehavior?

its my own server for my other website, wich have to ping my smf forum wich uses badbehavior mod.

im getting error 403

The instructions to whitelist ip's is here (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023).
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Augster on January 18, 2012, 06:57:09 PM
Maybe I'm just idiot (a lot of my friends think so!), but I can't figure out how to get to the Bad Behavior Admin section  :-[

Just installed it (after seeking assistance when it wouldn't install, which I ended up having to create a "temp" folder in the Packages directory) and by all appearances, the install was a success.  But no where can I find a link to gain access to the Bad Behavior Admin section!

And there's nothing listed under Admin->Administration Center->Modification Settings->Miscellaneous.

Help?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 18, 2012, 07:20:29 PM
Make sure the "BadBehavior.english.php" or other appropriate language file is installed in the language directory of your theme..
 8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Augster on January 19, 2012, 01:00:38 AM
Yes, it is there in the "default" theme (not in core, but there is only one language file in there "Settings.english.php").

Now what?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 19, 2012, 04:52:32 AM
I have no idea if you are or are not using the default theme.  I assume you are using core.  If you are not using default then copy the "BadBehavior.english.php"  to the theme language folder you are using.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Augster on January 19, 2012, 09:37:01 AM
I am using the "default" theme.

Where should the Bad Behavior Admin page normally be found/accessed?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 19, 2012, 06:52:06 PM
Admin/ Configuration/ Bad Behavior
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Augster on January 20, 2012, 02:32:04 PM
Bump.

Okay, I forgot the "secret squirrel" handshake to get me access to the "secret admin section"  ;D

Is it really that hard to describe "go to this link, click on that button, select that option.... and voila!"?  It would really help me self troubleshoot to get an idea of the steps to invoke the Admin panel...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 20, 2012, 07:31:31 PM
Click on Admin menu, then click on the Configuration menu then click on the Bad Behavior menu.

Support for the basic use of SMF is NOT part of this thread.  If that is what you need then go here (http://www.simplemachines.org/community/index.php?board=147.0).
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Augster on January 21, 2012, 11:38:19 AM
Hey now, don't get all jumpy and nanny on me!

1) Your response did not show up after refreshing the thread over two days, but now suddenly I see a response before my bump.  I gave it plenty of time allowing for the fact that we are all busy and can't respond immediately to every question that arises.  Still scratching my head why I didn't see any responses before...

2) Trying to find the right forum for support for your mod or any mod is absolutely not specified anywhere!  Even on the download page here for your mod.  I tried searching for several days in between my attempts to self-troubleshoot.  So please, cut people some slack as there is no "standardized" method or FAQ on where to go for help.  And I'm certainly no a n00b on forums (though for SMF, yes).  Not only that, but this thread is apparently in regards to the BAD BEHAVIOR MOD, so how is anyone supposed to know that the issue I'm experiencing may potentially NOT specific to Bad Behavior but to SQL?  Seriously.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on January 21, 2012, 05:18:49 PM
every mod distributed on our mod site has a support thread linked from the mod's download page....
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Celia N. Foster on January 26, 2012, 05:29:19 PM
What specifically do I need to do to make this error go away?:  Fatal error: require_once() [function.require]: Failed opening required '/hermes/bosweb26b/b647/ipg.judithbarsicom/forum/Sources/bad-behavior/BadBehavior-SMF.php' (include_path='.:/usr/local/lib/php-5.2.17/lib/php') in /hermes/bosweb26b/b647/ipg.judithbarsicom/forum/Themes/pink-art/index.template.php on line 368
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 26, 2012, 08:02:30 PM
I am guessing here since I do not know what version SMF you have.  But here goes nothing:

1.  The path to "$sourcedir" is incorrect in "Settings.php".
2.  The correct version of "BadBehavior-SMF.php" is not located in your "/Sources/bad-behavior/" folder.  Check out "package-info.xml" for the proper location.
 O:)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Celia N. Foster on January 26, 2012, 08:15:12 PM
I have the latest, 2.0.2
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 27, 2012, 04:53:01 AM
Then I guessed correctly.  The second line in your "BadBehavior-SMF.php" file should not read "BadBehavior-SMF.php  - for SMF 1.1.x -  PHP template for Bad Behavior mod".  If so copy the other file (in the root zip folder) to your directory.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 04, 2012, 01:59:01 PM
New version 1.5.8 with updated 2.2.1 core, changes are:

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Bancherd on February 04, 2012, 10:13:20 PM
Updated my live forum without any problems, Thanks.  :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: wolfetundra on February 08, 2012, 12:54:56 AM
I just noticed I'm throwing these errors ....

 Type of error: Undefined
Undefined index: badbehavior_about_title
File: /Sources/Admin.php
Line: 216
 
 Type of error: Undefined
Undefined index: badbehavior_report_denied_title
File: /Sources/Admin.php
Line: 215
 
 Type of error: Undefined
Undefined index: badbehavior_report_permit_title
File: /Sources/Admin.php
Line: 214
 
 Type of error: Undefined
Undefined index: badbehavior_report_all_title
File: /Sources/Admin.php
Line: 213
 
 Type of error: Undefined
Undefined index: badbehavior_settings_title
File: /Sources/Admin.php
Line: 212
 
 Type of error: Undefined
Undefined index: badbehavior
File: /Sources/Admin.php
Line: 205
 
 Type of error: Undefined
Undefined index: badbehavior_about_title
File: /Sources/Admin.php
Line: 216
 
 Type of error: Undefined
Undefined index: badbehavior_report_denied_title
File: /Sources/Admin.php
Line: 215
 
 Type of error: Undefined
Undefined index: badbehavior_report_permit_title
File: /Sources/Admin.php
Line: 214
 
 Type of error: Undefined
Undefined index: badbehavior_report_all_title
File: /Sources/Admin.php
Line: 213
 
 Type of error: Undefined
Undefined index: badbehavior_settings_title
File: /Sources/Admin.php
Line: 212
 
 Type of error: Undefined
Undefined index: badbehavior
File: /Sources/Admin.php
Line: 205
 
 Type of error: Undefined
Undefined index: badbehavior_report_all_title
File: /Sources/Admin.php
Line: 213
 
 Type of error: Undefined
Undefined index: badbehavior_settings_title
File: /Sources/Admin.php
Line: 212
 
 Type of error: Undefined
Undefined index: badbehavior
File: /Sources/Admin.php
Line: 205
 
 Type of error: Undefined
Undefined index: badbehavior_report_all_title
File: /Sources/Admin.php
Line: 213
 
 Type of error: Undefined
Undefined index: badbehavior_settings_title
File: /Sources/Admin.php
Line: 212

 Type of error: Undefined
Undefined index: badbehavior
File: /Sources/Admin.php
Line: 205
 
 Type of error: Undefined
Undefined index: badbehavior_report_all_title
File: /Sources/Admin.php
Line: 213
 
 Type of error: Undefined
Undefined index: badbehavior_settings_title
File: /Sources/Admin.php
Line: 212

 Type of error: Undefined
Undefined index: badbehavior
File: /Sources/Admin.php
Line: 205
 
 Type of error: Undefined
Undefined index: badbehavior_about_title
File: /Sources/Admin.php
Line: 216

 Type of error: Undefined
Undefined index: badbehavior_report_denied_title
File: /Sources/Admin.php
Line: 215

 Type of error: Undefined
Undefined index: badbehavior_report_permit_title
File: /Sources/Admin.php
Line: 214

 Type of error: Undefined
Undefined index: badbehavior_report_all_title
File: /Sources/Admin.php
Line: 213

 Type of error: Undefined
Undefined index: badbehavior_settings_title
File: /Sources/Admin.php
Line: 212

 Type of error: Undefined
Undefined index: badbehavior
File: /Sources/Admin.php
Line: 205

 Type of error: Undefined
Undefined index: badbehavior_about_title
File: /Sources/Admin.php
Line: 216

 Type of error: Undefined
Undefined index: badbehavior_report_denied_title
File: /Sources/Admin.php
Line: 215

 Type of error: Undefined
Undefined index: badbehavior_report_permit_title
File: /Sources/Admin.php
Line: 214

All the errors are originating from the follow code;
Code: [Select]
// Bad Behavior Start
'badbehavior' => array(
'label' => $txt['badbehavior'],
'file' => 'BadBehavior-Admin.php',
'function' => 'badbehavior_admin_init',
'custom_url' => $scripturl . '?action=admin;area=badbehavior;sa=settings',
'permission' => array('admin_forum'),
'icon' => 'modifications.gif',
'subsections' => array(
'badbehavior_settings' => array($txt['badbehavior_settings_title']),
'report_all' => array($txt['badbehavior_report_all_title']),
'report_permit' => array($txt['badbehavior_report_permit_title']),
'report_denied' => array($txt['badbehavior_report_denied_title']),
'badbehavior_about' => array($txt['badbehavior_about_title']),
),
),
// Bad Behavior End
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 08, 2012, 04:53:44 AM
I guess you have a custom SMF 2.0.x theme and manually installed the mod? 

Check your index.php file and make sure the action array is defined:

Code: [Select]
// Bad Behavior Start
'badbehavior' => array('BadBehavior-SMF.php', 'badbehavior'),
// Bad Behavior End]
  :o
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on February 08, 2012, 08:58:49 AM
what that usually means is that a manual installation neglected to add the text strings to modifications.english.php (replace with your language instead of english)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: wolfetundra on February 08, 2012, 04:26:42 PM
I verified the correct coding is placed within the index.php and within modifications.english.php in both templates (default and custom). I'm still throwing the codes.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 08, 2012, 07:44:48 PM
For this mod, the language information for the admin menus are stored in the "/languages/BadBehavior.english.php" (or another language) file of the theme directory and the help text is installed from "modification_language.xml".
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: wolfetundra on February 08, 2012, 09:32:01 PM
Seeing how, for some reason, that made absolutely no sense to me ...
Can you please explain how to correct the errors? I followed the install instructions and even verified twice that the codings were present and correct.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 09, 2012, 05:05:20 AM
If you want to get a good explanation you will need to put some effort in explaining your problem.  Instead of copying and pasting a long post with no details you could have provided basic informaiton like your SMF version and what you did.  I work long hours and only have a few minutes per day to provide this free support.  So far I guessed that you have SMF 2.0, you have a custom theme and you did not properly install the mod in the custom theme.  By the way I have stated many times that I provide support for the default theme not custom themes.  The above is the reason why.

Kindred said that this issue occurs when the text strings for the admin screen are missing.  He assumed that they are in modifications.english.php but for this mod they are in in other files.  You need to complete your manual installation and copy the language, css and all other files to the correct directories as per "package-info.xml" then make the changes in php as per "modification_language.xml".

There are on-line resources that read and provide a list of changes that need to be made for modifications.  I am sorry but I do not have a link.

Time is up, gotta go to work.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on February 09, 2012, 08:51:39 AM
actually, the smf mod site has a mod parser for manual installations built in to the mod download page
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Xarcell on February 09, 2012, 12:10:36 PM
I have install bad behavior. I have checked to enable it. I enter my http:BL Access Key(copied & pasted). However, it says "Project Honey Pot is offline!".

I don't know if this has anything to do with project Honeypot going down for a few days and my access key no longer works, or what. Any ideas wht it's not working?

At honeypot, it says access key is working.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 09, 2012, 07:48:58 PM
I have install bad behavior. I have checked to enable it. I enter my http:BL Access Key(copied & pasted). However, it says "Project Honey Pot is offline!".

It is common for the service to go up and down.  When it is up you will get
"2b021b1f" keys when a bad guy visits your site.  When it is down Bad behavior code protects you.  No matter what the results of the test are, the mod will try (when the cache expires) to access the project honey pot service.

As for the project honeypot web site, they are two different things.  The website can still be up while the database is being adjusted.

Unlike all other tests the mod does something no other project honeypot application does to insure that the test is accurate.  It took me some time for me to create the test but it has proven reliable. 
 :D
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Xarcell on February 09, 2012, 09:15:11 PM
I have install bad behavior. I have checked to enable it. I enter my http:BL Access Key(copied & pasted). However, it says "Project Honey Pot is offline!".

It is common for the service to go up and down.  When it is up you will get
"2b021b1f" keys when a bad guy visits your site.  When it is down Bad behavior code protects you.  No matter what the results of the test are, the mod will try (when the cache expires) to access the project honey pot service.

As for the project honeypot web site, they are two different things.  The website can still be up while the database is being adjusted.

Unlike all other tests the mod does something no other project honeypot application does to insure that the test is accurate.  It took me some time for me to create the test but it has proven reliable. 
 :D

Yeah your right. It seems the service is up & down at times. Currently working...

Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Powerbob on February 10, 2012, 12:39:13 AM
Installed this today on my 2.0.2 and it went smooth as silk, no problems at all.

Thanks  8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 11, 2012, 04:04:32 PM
You are welcome.
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: natzy24 on February 13, 2012, 08:23:29 AM
Hey maybe you can help, or at least tell me if I've missed something. I just installed the Bad Behaviour Mod however I now have this on the top of the screen:

Quote
// Bad Behavior Start $txt['permissionname_badbehavior_goodgroup'] = 'Bad Behavior Whitelist Group'; $txt['permissionhelp_badbehavior_goodgroup'] = 'This option will make a member group exempt from all Bad Behavior tests.'; // Bad Behavior End

site is: http://dragonagerpg.amazeart.net/index.php?action=forum
Any help?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on February 13, 2012, 09:25:38 AM
your installation was done incorrectly and added the txt strings AFTER the closing ?> in the language file.

Find the edited language file and move the ?> from where ever it is int he file to the very end...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: GlitchPC on February 22, 2012, 01:20:47 AM
Hello, butchs...

I currently use the following mods to stop spammers:
Is there any particular reason for me to include your mod as additional protection?  Is there any known conflicts with your mod and the two I have already mentioned?

Thanks, in advance, for any info...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: CDM on February 22, 2012, 02:04:38 AM
I am not incredibly tech-savvy, so I am having trouble figuring out how to run the test.

Quote
To test:
To insure that Bad Behavior is functioning correctly you can add the sting "Bad Behavior Test" to the User Agent (UA) of a HTTP request from someone who is not in the whitelist and is not the administrator.

    * Windows use FireFox with the [nofollow]"Modify Headers"[/nofollow] add-on.
    * Macintosh, [nofollow]"enable the Develop menu"[/nofollow] in Safari.


If you look at the page source (just below the title) you will see the speed of this mod at work:  <!-- Bad Behavior 2.2.1 run time: 3.025 ms -->

So, I should get the add-on with firefox? Then do the test? And what is a sting? Where is the user agent? What is an http request? Where do I find the page source and title? 

I apologize if these are silly questions but I need help. Thank you in advance!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: CDM on February 22, 2012, 02:31:30 AM
If I have data in the entries logs, does that mean it is working properly? I do have some data now, finally, and it seems to be working, altho it has let a couple spammers thru.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 22, 2012, 05:00:39 AM
Hello, butchs...

I currently use the following mods to stop spammers:
  • httpBL
  • Stop Spammer

No conflicts.  BB does what httpBL does but adds BB protection when projecthoneypot is down.  Plus this mod is routinely updated for SMF.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 22, 2012, 05:01:40 AM
If I have data in the entries logs, does that mean it is working properly? I do have some data now, finally, and it seems to be working, altho it has let a couple spammers thru.

Yes it is working.

Sign up for projecthoneypot (http://www.projecthoneypot.org) and enter the "http:BL Access Key" in the admin page of the mod to block more spammmers.  Click "?" for help.

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: GlitchPC on February 22, 2012, 10:56:04 AM
Hello, butchs...

I currently use the following mods to stop spammers:
  • httpBL
  • Stop Spammer

No conflicts.  BB does what httpBL does but adds BB protection when projecthoneypot is down.  Plus this mod is routinely updated for SMF.


Thanks for the quick reply...

I have it installed, configured...and, apparently, enabled.  Yet, I get the error that Project HoneyPot is offline.  The httpBL mod I have states that the connection to HoneyPot is perfect.  I don't use Firefox...and don't want to end up blocking myself.

Any help?

Edit...

It seems to be working, now.  Logs are showing entries.  However, I do have an additional question...regarding the following statement...
Quote
In SMF you can whitelist member groups only.  Unlike httpBL, this mod will use the last known ip address of a whitelisted member and not block them if they are not logged in and their ip address has not changed.

What happens for Opera Turbo users?  Turbo creates different IPs quite a bit.  Will a member get denied access simply because they use Opera with Turbo enabled?  If so...how does one go about rectifying this issue...since they will have a different IP every time they log into the forum?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: CDM on February 22, 2012, 02:04:24 PM

Yes it is working.

Sign up for projecthoneypot (http://www.projecthoneypot.org) and enter the "http:BL Access Key" in the admin page of the mod to block more spammmers.  Click "?" for help.

Thanks so much!! FAB mod!! ;D :laugh:
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 22, 2012, 07:38:49 PM
Thanks for the quick reply...

I have it installed, configured...and, apparently, enabled.  Yet, I get the error that Project HoneyPot is offline.  The httpBL mod I have states that the connection to HoneyPot is perfect.  I don't use Firefox...and don't want to end up blocking myself.

Only BB 4 SMF provides an accurate status of Project Honeypot.  httpBLmod uses the test that many other mods use from the Project Honeypot site that incorrectly states the connection is perfect when it is not.  Notice that it does not block anything when BB says the connection is down?

Quote
In SMF you can whitelist member groups only.  Unlike httpBL, this mod will use the last known ip address of a whitelisted member and not block them if they are not logged in and their ip address has not changed.

What are you talking about?  That is not how the whitelist works.  Look at the link (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023) I provided.

Bottom line all new non-admin ip addresses not in the whitelist will be checked.  All non-admin users logged in beyond the cache limit, not in the whitelist, will be checked.

I have it installed, configured...and, apparently, enabled.  Yet, I get the error that Project HoneyPot is offline.  The httpBL mod I have states that the connection to HoneyPot is perfect.  I don't use Firefox...and don't want to end up blocking myself.

Any help?

Again you are not getting an error.  Project Honeypot is down often.

The mod does not block admins!  Furthermore, you can not block yourself if Project Honeypot is down.  When it is is down the BB tests takes over and they will not block you unless you are a spammer.  But if you like to act like a spammer the mod offers a whitelist.  Read this link (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023) for info on how to add your ip address range to the whitelist.

I don't use Firefox...and don't want to end up blocking myself.

What happens for Opera Turbo users?  Turbo creates different IPs quite a bit.  Will a member get denied access simply because they use Opera with Turbo enabled?  If so...how does one go about rectifying this issue...since they will have a different IP every time they log into the forum?

I do not see that as an issue with this mod.  The Project Honeypot portion checks the ip vs the spammer database and the Bad Behavior portion analyzes the delivery method as well as the software the spammer is using not the ip address.
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: GlitchPC on February 23, 2012, 12:20:16 AM
I, apparently, misunderstood what I read in your link.  Thanks for the clarification and a great mod.  It's doing its thing...and I couldn't be happier.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: stevehow on February 25, 2012, 03:28:53 AM
Is it possible to install the Bad Behaviour mod without the "suspicious" post button in the reply . Having tested the mod successfully, the comment from my other admins is that we'd prefer not to have that functionality.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: NanoSector on February 25, 2012, 05:28:37 AM
Very nice mod! Seems to block the majority of spammers from my forum :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 25, 2012, 07:49:26 AM
Is it possible to install the Bad Behaviour mod without the "suspicious" post button in the reply . Having tested the mod successfully, the comment from my other admins is that we'd prefer not to have that functionality.

Unzip the package.

Edit "install_db.php" as follows:
delete:
Code: [Select]
if (function_exists('add_integration_function')) {
$badbehavior_integraton_hooks = array(
'integrate_bbc_codes' => 'badbehavior_suspicious_hide',
'integrate_bbc_buttons' => 'badbehavior_suspicious_button',
'integrate_pre_include' => '$boarddir/Sources/Subs_badbehavior_bbc.php',
);

foreach ($badbehavior_integraton_hooks as $badbehavior_hook => $badbehavior_integraton_function)
add_integration_function($badbehavior_hook, $badbehavior_integraton_function, TRUE);

Unset($badbehavior_integraton_hooks);
Unset($badbehavior_hook, $badbehavior_integraton_function);
}

Edit "uninstall_db.php" and delete:
Code: [Select]
if (function_exists('add_integration_function')) {
$badbehavior_integraton_hooks = array(
'integrate_bbc_codes' => 'badbehavior_suspicious_hide',
'integrate_bbc_buttons' => 'badbehavior_suspicious_button',
'integrate_pre_include' => '$boarddir/Sources/Subs_badbehavior_bbc.php',
);

foreach ($badbehavior_integraton_hooks as $badbehavior_hook => $badbehavior_integraton_function)
remove_integration_function($badbehavior_hook, $badbehavior_integraton_function);

Unset($badbehavior_integraton_hooks);
Unset($badbehavior_hook, $badbehavior_integraton_function);

//  Delete BBC code
if (!empty($modSettings['disabledBBC'])) {

$BB_uninstall_content = '';

if (strpos($modSettings['disabledBBC'], ',') !== false) {
$BB_uninstall_temp = array();
$BB_uninstall_temp = explode(',', strtolower($modSettings['disabledBBC']));

if (in_array('suspicious', $BB_uninstall_temp)) {
foreach ($BB_uninstall_temp as $key => $value)  {
$pos = strpos(strtolower($value), 'suspicious');
if ($pos !== false) {
} else {
$BB_uninstall_content .= $value . ',';
}
}
unset($value);
$BB_uninstall_content = substr($BB_uninstall_content, 0, -1);
}
} else {
if ($modSettings['disabledBBC'] !== 'suspicious')
$BB_content = $modSettings['disabledBBC'];
}
$smcFunc['db_insert']('replace',
$db_prefix . 'settings',
array('variable' => 'string', 'value' => 'string',
),
array(
array('disabledBBC', $BB_uninstall_content),
),
array('variable')
);
}
unset($BB_uninstall_temp);
}

Save.  Re-zip and install.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 25, 2012, 07:50:29 AM
I, apparently, misunderstood what I read in your link.  Thanks for the clarification and a great mod.  It's doing its thing...and I couldn't be happier.

Very nice mod! Seems to block the majority of spammers from my forum :)

Thank you.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: stevehow on February 25, 2012, 08:02:10 AM
Re omit 'suspicious button' thanks for you prompt reply. Butchs
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on February 25, 2012, 08:31:22 AM
remove the BBC button code from subs-editor.php

or just don't give people permission for the button
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: GlitchPC on March 04, 2012, 08:49:23 PM
I just downloaded and installed this mod:  http://custom.simplemachines.org/mods/index.php?mod=1650

Now...I've already requested help in that support thread for the errors I'm getting...a total of three.  One of those errors refers to this mod, Bad Behavior.

Here it is...

http://glitchpc.net/index.php?action=admin;area=quiz;xxxxxxxxxxx=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2: Invalid argument supplied for foreach()File: /xxx/xxx/xxxxx/xxxxxxxx/xxxxxxxx/Themes/default/languages/BadBehavior_bbc.english.php (main sub template - eval?)
Line: 1740

Funny thing...there is no line 1740 in that particular file.

Any suggestions?

Thanks, in advance...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on March 04, 2012, 09:36:24 PM
I just downloaded and installed this mod:  http://custom.simplemachines.org/mods/index.php?mod=1650

Now...I've already requested help in that support thread for the errors I'm getting...a total of three.  One of those errors refers to this mod, Bad Behavior.

Here it is...

http://glitchpc.net/index.php?action=admin;area=quiz;xxxxxxxxxxx=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2: Invalid argument supplied for foreach()File: /xxx/xxx/xxxxx/xxxxxxxx/xxxxxxxx/Themes/default/languages/BadBehavior_bbc.english.php (main sub template - eval?)
Line: 1740

Funny thing...there is no line 1740 in that particular file.

Any suggestions?

Thanks, in advance...

Have you disabled your template eval?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: GlitchPC on March 04, 2012, 09:54:46 PM
Have you disabled your template eval?

In Server Settings?  No...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on March 04, 2012, 09:57:46 PM
Have you disabled your template eval?

In Server Settings?  No...

Empty your error log then disable the template eval.

Have a look at what the error log says then.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: GlitchPC on March 04, 2012, 10:01:07 PM
Have you disabled your template eval?

In Server Settings?  No...

Empty your error log then disable the template eval.

Have a look at what the error log says then.

Okay...the error for the Bad Behavior file has gone away.  Was that all I needed to do?

If so...thank you for your help.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on March 04, 2012, 10:02:48 PM
Keep an eye on the error log and see if it returns.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: GlitchPC on March 04, 2012, 10:03:22 PM
Will do...and, again...thank you.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on March 04, 2012, 10:04:36 PM
Anytime.

 ;)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: GlitchPC on March 04, 2012, 10:39:01 PM
Not sure if it matters, now...but...like I said, the reference to Bad Behavior is gone...it now reads:

xxxx://glitchpc.net/index.php?action=admin;area=quiz;xxxxxxxxxxx=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2: Invalid argument supplied for foreach()File: /xxx/xxx/xxxxx/xxxxxxxx/xxxxxxxx/Themes/default/SMFQuizAdmin.template.php
Line: 1740
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on March 04, 2012, 10:41:03 PM
Not sure if it matters, now...but...like I said, the reference to Bad Behavior is gone...it now reads:

xxxx://glitchpc.net/index.php?action=admin;area=quiz;xxxxxxxxxxx=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2: Invalid argument supplied for foreach()File: /xxx/xxx/xxxxx/xxxxxxxx/xxxxxxxx/Themes/default/SMFQuizAdmin.template.php
Line: 1740

That will be a question for the SMF Quiz mods topic I believe.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: GlitchPC on March 04, 2012, 10:45:09 PM
You got it!  Kudos!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on March 08, 2012, 08:25:15 AM
Can someone help a confused old man here.

How do I get the bad behaviour image to show on the forum?

 :-[

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on March 08, 2012, 10:16:50 AM
which bad behavior image? The "hide from suspicious" BBC image?

You will have to place the BBC image in the BBC directory for each theme
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on March 11, 2012, 09:15:44 PM
New version.  As usual, thanks for your support, Bad Behavior is continuously updated to protect SMF 1.1.x and 2.x from the latest threats!
 8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: GlitchPC on March 12, 2012, 02:19:11 AM
butchs...

Thanks for the new release...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: sildenafil on March 12, 2012, 05:55:14 AM
I've had some reports of some of my members getting trapped in this. I'm using the http:bl feature and some of their ips match what's in the database but the members are also logged in and as such have the bad behaviour whitelist group permission. Why are they getting checked if they have this permission?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on March 12, 2012, 06:36:06 PM
Please upgrade to the latest version?

There are two ways to whitelist a member.

One is to assign them a new special membergroup that has "Bad Behavior Whitelist Group" enabled in admin/Permissions/General Permissions.  The downside with this method is that it uses the ip addresses stored in SMF.  This means that if their address changes they can fail.

The second, more difficult and, more fail proof method is to edit the BB "whitelist.ini" file.  Here you can add their hosts ip range in CIDR format to the file.  Click the link for help (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023).
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on March 15, 2012, 07:31:26 PM
butchs...

Thanks for the new release...

You are welcome.  :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Bancherd on March 17, 2012, 01:55:07 AM
Thanks for the update, installed and working perfectly on my two live forums.  :D
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on March 18, 2012, 04:22:56 AM
That is good news.  Thanks. 
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on March 27, 2012, 06:47:49 PM
Hide enclosed from Suspicious Visitors requests

1. Please detail what it does, it kind of popped up when I installed and was not expecting it.
2. Please make it optional in the admin options.
3. PLEASE PLEASE PLEASE change the icon, not only does it stand out, it has offended a visually impaired member of my forum. (it looks like a blind man with a cane to me, not sure if that is what it is supposed to be)

Other than that I am glad to see the functions of http:bl maintained in another better mod... So far it is working great.

FYI I Tried running with "HelpLimit honeypot on forum " off I noted that in the top left of my SMF 2 forum that a link is visible when viewed in IE... It looks a bit ugly..

Not sure what the effectiveness difference is with  HelpLimit honeypot on forum on or off.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on March 27, 2012, 06:52:35 PM
Lazybones

admin> Forum > Posts and topics > BB Code

Untick Suspicious
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on March 27, 2012, 06:59:40 PM
Lazybones

admin> Forum > Posts and topics > BB Code

Untick Suspicious

Perfect thanks, I expected it to be a mod option.

However my other two comments stand... I didn't see that feature listed with the mod or in the change notes, and the icon still may be offensive in this context to some.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on March 27, 2012, 07:18:50 PM
So get a different icon?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on March 27, 2012, 07:57:56 PM
If you make or find a better icon please share it.  O:)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on March 27, 2012, 08:00:08 PM
So get a different icon?

Hidding it is working fine for now, a member of my forum may be working on an alternative.

What criteria is suspicious, not blocked but maybe malicious?


Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on March 27, 2012, 08:07:51 PM
Yes.

Quote from: Lazybones
1. Please detail what it does, it kind of popped up when I installed and was not expecting it.

It prohibits visitors who enter the "Permitted entries log" from seeing the content enclosed in the BBC code.  These visitors are non members who are suspicious and are not blocked by the mod.

This code was created for posting phone numbers, email addresses and etc...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on March 28, 2012, 11:26:48 AM
My Permitted entries log already contains 20+ entries from Africa and Russia, I think I saw a post a while back where you where interested in what was appearing in the permitted list or should I just keep an eye on them, one of the at least appears to be trying to view the registration page.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on March 28, 2012, 06:00:33 PM
Thank you.  That is good information.  You do not have to try to track them.  I just wanted to see their origins.

 8)

A little more info.  The permitted entries log not only includes Bad Behavior suspicious entries but it includes those deemed suspicious by Project Honeypot.
 :P
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on March 28, 2012, 06:07:08 PM
Thank you.  That is good information.  You do not have to try to track them.  I just wanted to see their origins.

 8)

A little more info.  The permitted entries log not only includes Bad Behavior suspicious entries but it includes those deemed suspicious by Project Honeypot.
 :P

Would be nice to have the PERMITTED REASON or EXPLANATION field indicate why they are suspicious... IE they where in Project Honeypot but had a low score... MOD http:BL has a little more detail in this respect. It also makes a case for using the suspicious tag....
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on March 29, 2012, 07:03:37 AM
I prefer programming for functionality over glitter.  First off the way MOD http:BL does it is by having two threat levels.  One threat level to ban visitors and the other to show that they are possible threats.  My mod does NOT do that.

This mod uses the Project Honeypot's determination as explained in the Http:BL API Specification (http://www.projecthoneypot.org/httpbl_api.php).

Quote
To use Project Honeypot a host need simply perform a DSN lookup of a web visitor's IP address. Project Honeypot's DNS system will return a value which indicates the status of the visitor. Visitors may be identified as search engines, suspicious, harvesters, comment spammers, or a combination thereof. The response to the DNS query, as outlined below, indicates what type of visitor is accessing your page...


Value   Meaning
0   Search Engine (0)
1   Suspicious (1)
2   Harvester (2)
3   Suspicious & Harvester (1+2)
4   Comment Spammer (4)
5   Suspicious & Comment Spammer (1+4)
6   Harvester & Comment Spammer (2+4)
7   Suspicious & Harvester & Comment Spammer (1+2+4)
>7   [Reserved for Future Use]

So if the DSN lookup at Project Honeypot returns a 1 the visitor (other conditions may apply) is sent to the permitted entries log.

The code was hard enough to do so I left adding details for a future version.  Right now I am working on a new challenge page...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on March 29, 2012, 10:06:37 AM
So for consistsntcy shouldn't the explanation field say http:bl Suspicious?
Or if the entire Permitted tab is Suspicious why not label it as such?

Just an observation from an end user / admin point of view there is little or no association between the suspicious state and the permit log in the UI.

FYI this isn't a complaint just an observation.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on March 29, 2012, 11:57:16 AM
Odd permitted entries that may make for a signature:

Quote
METHOD:    POST
URI:    /index.php?PHPSESSID=7d93629a0466105b9a2ebbadb53d4e78&action=login2
PROTOCOL:    HTTP/1.0
HEADERS:    POST /index.php?PHPSESSID=7d93629a0466105b9a2ebbadb53d4e78&action=login2 HTTP/1.0 Accept: */* User-Agent: Mozilla/0.6 Beta (Windows) Referer: http://forums.mydomain.com/myhoneypot.php Host: forums.mydomain.com Pragma: no-cache Cookie: PHPSESSID=7d93629a0466105b9a2ebbadb53d4e78; bb2_screener_=1333009273+120.43.7.164 Connection: close
AGENT:    Mozilla%2F0.6%20Beta%20%28Windows%29
ENTITY:    user: ogilssvizl passwrd: 77SWvv99CBff cookielength: -1 submit: Login hash_passwrd:

1. The referrer is actually my honeypot page which doesn't have any links on it....
2. Very fake looking user agent.
3. account doesn't exist in the forum and looks like a random mess of characters
4. no forum members from the IP country of origin.

Quote
IP:    187.5.96.141
187-5-96-141.gnale1010.ipd.brasiltelecom.net.br
DATE:    2012-03-28 7:10:24 PM
METHOD:    POST
URI:    /index.php?PHPSESSID=b2ca8fc36d1eafdc735e1c650621b0ce&action=login2
PROTOCOL:    HTTP/1.0
HEADERS:    POST /index.php?PHPSESSID=b2ca8fc36d1eafdc735e1c650621b0ce&action=login2 HTTP/1.0 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; America Online Browser 1.1; rev1.2; Windows NT 5.1; SV1; .NET CLR 1.1.4322) Referer: http://forums.mydomain.com/myhoneypotpage.php Host: forums.mydomain.com Pragma: no-cache Cookie: PHPSESSID=b2ca8fc36d1eafdc735e1c650621b0ce; bb2_screener_=1332983408+187.5.96.141 Via: 1.0 PROXY Connection: close
AGENT:    Mozilla%2F4.0%20%28compatible%3B%20MSIE%206.0%3B%20America%20Online%20Browser%201.1%3B%20rev1.2%3B%20Windows%20NT%205.1%3B%20SV1%3B%20.NET%20CLR%201.1.4322%29
ENTITY:    user: CraigsList Course passwrd: zediogo200994 cookielength: -1 submit: Login hash_passwrd:
KEY:    00000000

1. The referrer is actually my honeypot page which doesn't have any links on it....
2. Very fake looking user agent.
3. account doesn't exist in the forum
4. no forum members from the IP country of origin.

Since the honeypot page is actually in the Bad Behavior config, I wonder if a rule could not be made to block anyone who uses it as a referrer page...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on March 29, 2012, 08:39:50 PM
So for consistency shouldn't the explanation field say http:bl Suspicious?
Or if the entire Permitted tab is Suspicious why not label it as such?

That is not 100% correct.  True it shows them after going through the test if and only if the Project Honeypot service is online.  However, Bad Behavior is on line 100% of the time and contributes to the "Permitted Visitors Log"

This is a Bad Behavior mod and the core author created a log for wordpress called "Show Permitted"  around the same time I created the "Permitted Visitors Log".  Both logs include the Bad Behavior permitted entries (there are way too many reasons you can get here so I will not try to explain) but ONLY the SMF version includes Project Honeypot Suspicious visitors in the same log (hence the different name).

The SMF version is the FIRST and at the time of this writing the ONLY modification has a "Permitted Visitors Log" that includes both Project Honeypot Suspicious visitors and Bad Behavior Permitted Entries that disallow the "Permitted Visitors Log" IP addresses from seeing your forums content via member controlled BBC code.

Trust me, being the first to do anything is not easy...  It is much easier to copy...  So be gentile!
 8)


user: ogilssvizl passwrd: 77SWvv99CBff cookielength: -1 submit: Login hash_passwrd

A blatant password cracking attempt if I ever saw one...  If they continue after a week try my other mod...

Odd permitted entries that may make for a signature:...

Since the honeypot page is actually in the Bad Behavior config, I wonder if a rule could not be made to block anyone who uses it as a referrer page...

The bad Behavior waring page has at least 12 spam trap variations (another first).  If enabled these traps or a portion thereof are on every page.

If that link is in the Bad Behavior "Honeypot Link" and you have a link word then that means the mod caught them in the spam trap, they escaped because they were not previously caught by Project Honeypot or Project Honeypot was down.  Rest assure, this sort of activity will gain them a reputation with Project Honeypot database and they will pay the price and be blocked by all!

So I thank you for catching another spammer!
 8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on March 30, 2012, 11:02:22 AM
If you make or find a better icon please share it.  O:)

Attached is what we have replaced the icon with at the moment... Everyone in my forum seems to like it better... The artist has declared it free for use.


Edit: originally attached the wrong version, the version attached correctly aligns with the buttons.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Anpu on April 20, 2012, 05:15:05 AM
Hi, is there a limitation for using this mod? Like daily limit or something?
Yesterday mod was amazingly awesome protecting forum, but today is showing "Project Honey Pot is offline!". I checked the script I uploaded (checked permissions too), link, key and status on HoneyPot and all seem ok. Am I missing something?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on April 20, 2012, 06:44:13 AM
No limit.  The honeypot just goes on and off for maintenance.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on April 20, 2012, 11:36:55 AM
No limit.  The honeypot just goes on and off for maintenance.

This is one of the reasons I like Bad Behavior WITH httpBL vs just the mod httpBL... Bad Behaviour still tends to do a good job when the honeypot is down.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: jaisi on April 26, 2012, 03:49:40 PM
i have just install this mod but still showing Project Honey Pot is offline.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on April 26, 2012, 06:26:30 PM
i have just install this mod but still showing Project Honey Pot is offline.

The honeypot just goes on and off for maintenance
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: jaisi on April 27, 2012, 02:14:50 PM
now showing online thanks for your support .
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Rust on May 02, 2012, 06:01:02 PM
I've just installed this mod.  Are the "Project Honey Pot HTTP Blacklist" settings required or optional?  I don't have a HP API setup yet, so am just wondering if it is OK to leave them blank until I do.

Thank you. :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: tumbleweed on May 02, 2012, 06:13:20 PM
You can get a honey pot for free
http://www.projecthoneypot.org/
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 03, 2012, 06:48:48 AM
I've just installed this mod.  Are the "Project Honey Pot HTTP Blacklist" settings required or optional?  I don't have a HP API setup yet, so am just wondering if it is OK to leave them blank until I do.

Thank you. :)

no problem.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Rust on May 03, 2012, 09:39:48 AM
Thank you both. :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: floridaflatlander on May 12, 2012, 11:11:57 AM
When someone clicks reply on my forum, they get an unlinked icon symbol in ie and in fire fox the words for the alt text "Hide Enclosed From Suspicious Visitors" are displayed.(this is in the icons above the reply text box)

According to the properties of the icon (http://www.mysite.com/forum/Themes/theme/images/bbc/badbehavior_bbc.gif) there should be a gif named badbehavior_bbc.gif in my images/bbc folder and there is not. There are other img files but not this one.

I unpacked 1.5.9 on my computer and I don't see this file.

How can I get this to work, thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on May 12, 2012, 03:28:03 PM
When someone clicks reply on my forum, they get an unlinked icon symbol in ie and in fire fox the words for the alt text "Hide Enclosed From Suspicious Visitors" are displayed.(this is in the icons above the reply text box)

According to the properties of the icon (http://www.mysite.com/forum/Themes/theme/images/bbc/badbehavior_bbc.gif) there should be a gif named badbehavior_bbc.gif in my images/bbc folder and there is not. There are other img files but not this one.

I unpacked 1.5.9 on my computer and I don't see this file.

How can I get this to work, thanks.

Have a look at the default theme. If the image is there then copy the theme to the images folder of the theme you are using.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: floridaflatlander on May 12, 2012, 04:23:54 PM
Have a look at the default theme. If the image is there then copy the theme to the images folder of the theme you are using.

There was an image there and I copied the image to the theme I'm using and it works

Thanks
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 12, 2012, 06:30:31 PM
If you do not like the mods image a few posts back is an alternative image.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: shubha on May 22, 2012, 11:19:38 AM
Previous this works. But i have stop for two days.

Yesterday i have change the Dns to cloudflare.

And today i have enable again , bad behavior.

But it shows "Project Honey Pot" is offline.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: floridaflatlander on May 22, 2012, 11:26:10 AM
Wait a bit and see whats if it changes, I did this last week and it changed to hpot is online.

My bb shows honey pot off line now and it's been that way all morning but when I look at honeypot on my forum it says it's on, up-to-date and the connection is perfect.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: shubha on May 22, 2012, 12:30:42 PM
I have enable the reverse proxy due to using the cloudflare, but in reverse proxy address below statement confuse me.....

For instance, when using CloudFlare, it is impossible to provide a list of IP addresses, so you would set the HTTP header to CloudFlare's provided CF-Connecting-IP header instead. so you would set the HTTP header to CloudFlare's provided CF-Connecting-IP header instead.

How?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Rust on May 22, 2012, 01:00:03 PM
Hello.  I have the mod installed on a 2.0.2 board.  All the required fields look to be fine.*  My HoneyPot account is all set up, but I keep seeing in red "Project Honey Pot is offline!"  Its been like this for weeks.

Any ideas on what I should try next?

*The only one I am not sure on is "Honeypot Link word".  Is this just a random word of my choosing or something else? 

Thanks for any help. :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: floridaflatlander on May 22, 2012, 01:09:41 PM
*The only one I am not sure on is "Honeypot Link word".  Is this just a random word of my choosing or something else? 

It's the word that is used in your link to your honeypot file(http://www.forum/honeypot-file.php) like this

<a href="http://www.forum.com/honeypot-file.php" >honeypot link word</a>
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Rust on May 22, 2012, 01:11:48 PM
Thanks for the information.  I am using a "QuickLink".  Changing that setting to the php file name seemed to fix it.  Thanks. :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 22, 2012, 08:32:19 PM
My bb shows honey pot off line now and it's been that way all morning but when I look at honeypot on my forum it says it's on, up-to-date and the connection is perfect.

How are you looking?  The mod never stops trying to check ip addresses on Project Honeypot.  Yet no one reports a visitor being flagged by Project Honeypot when the mod indicates it is offline (plus or minus the buffer time)...
 :P

For instance, when using CloudFlare, it is impossible to provide a list of IP addresses, so you would set the HTTP header to CloudFlare's provided CF-Connecting-IP header instead. so you would set the HTTP header to CloudFlare's provided CF-Connecting-IP header instead.

Do not forget to go  to "Cloudflare Settings" and select "Cache Purge" when you make any change to your site.
 8)

It's the word that is used in your link to your honeypot file(http://www.forum/honeypot-file.php) like this

<a href="http://www.forum.com/honeypot-file.php" >honeypot link word</a>

The mod will accept http://www.forum.com/honeypot-file.php as the Honeypot Link and honeypot link word as the Honeypot Link word.  The mod then generates several snazzy random traps...    :laugh:
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: shubha on May 23, 2012, 12:18:53 AM
What is the purpose of "Honeypot link word".

And the option "Select Purge" is just energing. How many times i have to do that.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 23, 2012, 06:41:07 AM
The word attracts the spammer to click on it.

Select Purge once.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: NanoSector on May 23, 2012, 07:47:21 AM
I don't know if this has been reported before but the mod sometimes adds a few weird characters into the top of the page which acts as a link, like "&#x0020" at my site. This can get quite annoying as the header constantly jumps.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on May 23, 2012, 12:14:03 PM
hmmm....    really?  I haven't ever seen that behavior.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: NanoSector on May 23, 2012, 12:24:29 PM
hmmm....    really?  I haven't ever seen that behavior.
It at first didn't really look obvious to me either. Dr. Deejay reported the behavior on my site, and I found that when browsing my site on one of my school's computers.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 23, 2012, 08:16:52 PM
Yea it has been discussed before but, many posts ago...  Those characters are from some of the nineteen (19) random honeypot traps the mod generates.  Some of them are not used elsewhere.  The number of honeypot traps on your forum can be reduced by selecting "Limit honeypot on forum".  Then only honeypot traps that do NOT leave special characters will be used in your forum.  The honeypot traps used when a visitor is blocked is not reduced.
 8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on May 23, 2012, 08:22:14 PM
Butchs is there anywhere where the whitelists are explained as to what they do etc?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 23, 2012, 08:56:52 PM
Well...  That depends on your methods.  With this mod you have several choices:

1.  whitelist.ini  (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023#msg3149023)- A text file you have to edit.  I am working on moving this to a admin setting.
2.  PayPal  (http://www.simplemachines.org/community/index.php?topic=375980.msg3152326;topicseen#msg3152326)- Configuring for whitelist.
3.  OpenID (http://www.simplemachines.org/community/index.php?topic=375980.msg3152400;topicseen#msg3152400) - Configuring for whitelist.
4.  The SMF way -  Use the the "Bad Behavior Whitelist Group" check box in "Manage Permissions/General Permissions".  As long as the member is logged in they are whitelisted.
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: shubha on May 24, 2012, 02:19:32 AM
This Cloudflare Ip is denied-
173.245.56.235

Due to use the reverse proxy ,it happens.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 24, 2012, 06:48:56 AM
If you use cloudflare you MUST check "Enable Reverse Proxy ", enter "Cf-Connecting-Ip" in "IP call to Reverse Proxy " and leave "Reverse Proxy Addresses " blank.


EDIT  Here is a helpful post (http://www.simplemachines.org/community/index.php?topic=477097.msg3337149#msg3337149) on how to use this mod with Cloudflare.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: shubha on May 27, 2012, 03:57:28 AM
Bad behavior block this Ip
206.80.114.186

How to allow ,this .

And cloudflare says"No catched version is avaliable".
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 27, 2012, 07:13:12 AM
If you insist, enter the ip in your whitelist.ini (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023#msg3149023) file (Sources/bad-behavior/bad-behavior/whitelist.ini).
 8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 27, 2012, 07:28:00 PM
Or you can wait for version 1.5.10 which will have the whitelist in the admin panel.  Scheduled to release sometime next week?  Egads...  lots of changes...   I must have 8 hours in this version...
 :o
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: MovedGoalPosts on May 28, 2012, 07:04:47 AM
It looks like Bad-Behaviour has an update to deal with the EU cookie law.  I see the current version of this mod places a cookie "bb2_screener_".  Is this SMF updated to include the bad behaviour update please?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 28, 2012, 07:46:08 AM
Well the core author believes that Bad Behavior is exempt (http://bad-behavior.ioerror.us/2012/05/03/bad-behavior-2-2-4/) from the EU Cookie law.  So only paranoid users need to apply the change.

A little more specific, the SMF version is in testing at SMF Helper (http://community.smfhelper.info/index.php?topic=5410.msg51673;topicseen#msg51673) as we speak.  That version includes the cookie selection, admin whitelist and etc...  Although most of the time the difference between the beta and the release in my software is cosmetic, sometimes a bug is found.  So it is better to wait for the official release.
 :P
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: MovedGoalPosts on May 28, 2012, 08:02:27 AM
Thanks,   The whole cookie law stuff is a mess and until someone gets hauled over the coals we won't really know.  I'll await the update with interest, although I agree that as bad behaviour provides essential security for my site the cookie it requires should be essential and so should be exempt.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: shubha on May 28, 2012, 08:39:44 AM
Do not remove the old version while add the new version.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 29, 2012, 09:22:54 PM
New version!!!   This one made me work... Changes are as follows:
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on May 30, 2012, 12:09:48 AM
hrm........


Ok, naughty me... I uninstalled and reinstalled without backing up first.
but now, the entire system is just blank.
wierd...

I had to manually remove the older mod and then it went blank.
So I manually installed the new version, but it's still blank.
argh!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 30, 2012, 04:34:06 AM
I just deleted the new items from both the 2.0x & 1.1.X test server DB'S, downloaded the package and reinstalled the mod.  I can not get the blank screen.  Then I double checked the language file changes with my php debugger and I see nothing wrong with the utf8 changes (lacking as they are)...  The blank screen usually is a php error.  Hard to tell without seeing it.  Maybe something was not properly installed or uninstalled?  Did you try entering through the screen just in case it was cache?  Did you reset your browser/ forum cache?  Perplexed...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: MovedGoalPosts on May 30, 2012, 05:40:13 AM
Thanks for the update.  Should the bad behaviour image now be added automatically to the templates, or do we need to edit that manually?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on May 30, 2012, 07:40:01 AM
Yeah..l it's weird...   I don't know what I did to cause it... So I don't know how to fix it either. The only thing I did was uninstall 1.5.9.   How bizarre. I left it and slept... But I have to fix it today. Ugh
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 30, 2012, 09:45:15 AM
If it happens again, can zip all the files that were edited by the mod and send them to me?

Thanks for the update.  Should the bad behaviour image now be added automatically to the templates, or do we need to edit that manually?

yes
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: MovedGoalPosts on May 30, 2012, 10:37:03 AM
Ah sorry a misunderstanding.  I thought the image change was to do with display for (http://www.bad-behavior.ioerror.us/images/bad-behavior-80x15.png).  I assume that if this is to be used we need to edit a template?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 30, 2012, 10:52:09 AM
Yes, you will ned to edit the template.
 :o
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: shubha on May 30, 2012, 11:32:05 AM
User-Agent claimed to be Googlebot, claim appears to be false.

222.186.24.59

This is wrong or right. Confuse.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 30, 2012, 11:40:30 AM
222.186.24.59 Beijing Beijing China CHINANET jiangsu province network.  Not google.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: shubha on May 30, 2012, 11:44:32 AM
User Agent as seen on Project Honey Pot
Quote
User-Agent: Mozilla/5.0+(compatible;+googlebot/2.1;++http://www.google.com/bot.html)
And in my bad behavior -event details.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 30, 2012, 11:53:57 AM
The ip is not in the core authors list  If you want details you can search this thread or ask the core author (http://bad-behavior.ioerror.us/).
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: shubha on May 30, 2012, 12:06:45 PM
User Agent Mozilla 5.0 are not allow or by default what permission they have.Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on May 30, 2012, 12:10:59 PM
I use firefox all the time.

Have you checked the ip?

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: shubha on May 30, 2012, 12:19:27 PM
I have seen most of the ip addrss are block of mozilla 5.0

Ex-
http://www.projecthoneypot.org/ip_222.186.24.59

As see in whitelist.ini also, user agent 4.0  is having the permission.Not clarify with 5.0
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on May 30, 2012, 12:20:52 PM
Can you give an example of ips?


In pm only.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on May 30, 2012, 02:31:38 PM
Well, g-bloody-damn-it...    I found the problem.

some extra characters got pasted into index.php when I was doing the manual edits...   which caused the whole bloody site to choke. I looked at that code at least 10 times and missed it until just now.


Thanks for the offer to help, butchs...   as expected, no problem with the mod, only with my fat-fingered coding.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 30, 2012, 04:15:53 PM
User Agent Mozilla 5.0 are not allow or by default what permission they have.Thanks.

There is no test to block "Mozilla 5.0".  If that UA is blocked it is blocked for other reasons.

When a UA is blocked it is given a "technical support key".  Then they can use the key to fix the problem yourself by following the link to the Bad Behavior core address for access or contacting the admin with the key and the admin can discuss the key with the core author.

My question to you is why no one is giving you key information?  Sounds like spammers to me...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: pols1337 on May 31, 2012, 10:28:10 PM
Hi,

I upgraded my forum to 2.0.2 and apparently it wanted me to reinstall all of my packages, which I did.  Unfortunately, I think it doubled my Bad Behavior.  See screenshot. 

Please help -- I have no idea how to get rid of this double instance of Bad Beahvior. 

Joel
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on May 31, 2012, 10:30:59 PM
Using notepad ##

You would have to check your themes indexteplate file for the doubled code.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: pols1337 on May 31, 2012, 10:36:44 PM
Is [index.template.php] the only file that I need to fix?  I found the doubled instance of Bad Behavior.  Thanks
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on May 31, 2012, 10:37:50 PM
Is [index.template.php] the only file that I need to fix?  I found the doubled instance of Bad Behavior.  Thanks

How many themes do you use?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: pols1337 on May 31, 2012, 10:43:48 PM
I only applied it to my Core Theme and Astonished theme.  I fixed the [index.template.php] for Astonished.  I couldn't find a redundant instance of Bad Behavior in my Core's index.template.php, but I've attached it here in case you can take a look at it for me. 
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on May 31, 2012, 10:46:22 PM
You actually use Core?

If the text wasn't double then it won't be there.

 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: pols1337 on May 31, 2012, 10:49:44 PM
@Old Fossil

No, ha ha, I don't use Core but I always install package to Core because I figure it's necessary for the mod to be in the primary core theme.  Nobody really explains this stuff, so I kind of just make things up for myself, lol. 
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on May 31, 2012, 10:51:46 PM
Phew.

If ya don't use a theme and it has a file edit fail don't worry about it.

However ALL edits on the default theme are necesary.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on June 01, 2012, 03:35:31 AM
Click this link (http://www.simplemachines.org/community/index.php?topic=375980.msg3216535;topicseen#msg3216535) for instructions on how to un-do  a double installation..
 O:)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on June 03, 2012, 04:39:11 PM
Has anyone noticed the bad behaviour link now points to a go daddy page?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Rust on June 04, 2012, 10:12:36 AM
If the user is on the Tor network, does this mod detect that, in and of itself, as "bad behavior"?  I'm just wondering.  Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: MovedGoalPosts on June 04, 2012, 12:02:41 PM
Has anyone noticed the bad behaviour link now points to a go daddy page?

Yep I wonder if there is a problem somewhere.  The number of blockages has dropped significantly on my forum in the last few days since installing the latest mod update.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on June 04, 2012, 12:03:58 PM
Has anyone noticed the bad behaviour link now points to a go daddy page?

Yep I wonder if there is a problem somewhere.  The number of blockages has dropped significantly on my forum in the last few days since installing the latest mod update.

No change on mine.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on June 04, 2012, 12:49:55 PM
Yep I wonder if there is a problem somewhere.  The number of blockages has dropped significantly on my forum in the last few days since installing the latest mod update.

Totally unrelated, the status of the Bad Behavior site has nothing to do with blockages.  It uses the Project Honeypot website and php files on your computer.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on June 04, 2012, 05:33:10 PM
If the user is on the Tor network, does this mod detect that, in and of itself, as "bad behavior"?  I'm just wondering.  Thanks.

No.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on June 04, 2012, 07:36:59 PM
there is another mod which prevents all access from tor nodes. I have it installed on 40konline.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: floridaflatlander on June 06, 2012, 08:00:02 AM
I've notice for about an half week, week now that I can't get to http://www.bad-behavior.ioerror.us on the bad behavior link at the bottom of my page, am I doing something wrong?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TrickyRicky on June 06, 2012, 04:11:16 PM
I have the same problem http://www.bad-behavior.ioerror.us and site is loading slow the image is missing its a linked image how do i find it

???
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on June 06, 2012, 07:16:10 PM
I do not know.  Remove the image and your site will be normal.  The mod still works.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TrickyRicky on June 06, 2012, 08:24:54 PM
if i could find the image code i would

its not an image in the mod its linked image

the mod still works but that linked image needs removed of fixed

(http://thumbnails77.imagebam.com/19457/8e3523194567491.jpg)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on June 06, 2012, 08:30:40 PM
The image code will be found in your themes index template file.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TrickyRicky on June 06, 2012, 08:38:27 PM
Iv been looking for it all night cant find the code

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on June 06, 2012, 08:39:40 PM
Reading the mods first post may help.

http://www.simplemachines.org/community/index.php?topic=375980.580
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TrickyRicky on June 06, 2012, 08:47:59 PM
How does that help i aint double installed

edit: like i say its strange its just this last week its gone like the other guy was saying



Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on June 06, 2012, 08:49:08 PM
That is the image code which I believe you wanted to remove.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TrickyRicky on June 06, 2012, 08:56:25 PM
nah no luck

its on the portal page not the forum page forum is fine but portal real slow because its waiting for that image

http://www.bad-behavior.ioerror.us/images/bad-behavior-80x15.png

^^^^^ thats the Image code
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on June 06, 2012, 09:09:39 PM
nah no luck

its on the portal page not the forum page forum is fine but portal real slow because its waiting for that image

http://www.bad-behavior.ioerror.us/images/bad-behavior-80x15.png

^^^^^ thats the Image code

Er Isn't that what I said?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TrickyRicky on June 06, 2012, 09:12:47 PM
yup sorry its late for me you said that

but i cant remove it because well who knows where it is iv been trying to find it but nope
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on June 07, 2012, 07:06:07 AM
Try putting the attached on your web site and updating the link.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TrickyRicky on June 07, 2012, 08:26:21 AM
if i could find the link i would

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: floridaflatlander on June 07, 2012, 08:49:31 AM
if i could find the link i would

I agree or am I confussed?

I thought that the URL link (www.bad-behavior.ioerror.us) was a credit/heads up/advertisement on where the mod Bad Behavior came from. And would be used in one of two ways

advertisement
Quote
<p><a href="http://www.bad-behavior.ioerror.us/">
<img src="http://www.MYSITE.com/images/bad-behavior-80x15.png"
alt="Bad Behavior" height="15" width="80" /></a></p>

or advertisement and use image to help bad behavior count useage
Quote
<p><a href="http://www.bad-behavior.ioerror.us/">
<img src="http://www.bad-behavior.ioerror.us/images/bad-behavior-80x15.png"
alt="Bad Behavior" height="15" width="80" /></a></p>
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on June 07, 2012, 09:33:52 AM
hmmm, hmmm and double hmmm....

WHERE is that image supposed to be appearing for you?  Because I just looked through my code and the ONLY reference that I found to that URL was in /Sources/bad-behavior/BadBehavior-SMF.php
and that adds the link at the bottom of the index page

Code: [Select]
         echo '<p><a href="http://www.bad-behavior.ioerror.us/">Bad Behavior</a> has blocked <strong>'.$blocked.'</strong> access attempts in the last '.$timelimit.' days.</p>';

I can not find any reference at all to the image...





separate question for butchs...
the new update...
did you only change bad-behavior files or did you change the codes that get inserting into SMF files?
(in other words, could I do a "dirty" upgrade by just over-writing the bad-behavior files with the new versions?)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: floridaflatlander on June 07, 2012, 10:00:03 AM
I just wanted a link to give credit for bad behavior and as I said I couldn't get www.bad-behavior.ioerror.us to work .... so I settled for

<p><a href="http://custom.simplemachines.org/mods/index.php?mod=2502">
<img src="../images/site-images/bad-behavior-80x15.png"
alt="Bad Behavior" height="15" width="80" /></a></p>
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TrickyRicky on June 07, 2012, 10:38:50 AM
hmmm, hmmm and double hmmm....

WHERE is that image supposed to be appearing for you?  Because I just looked through my code and the ONLY reference that I found to that URL was in /Sources/bad-behavior/BadBehavior-SMF.php
and that adds the link at the bottom of the index page

Code: [Select]
         echo '<p><a href="http://www.bad-behavior.ioerror.us/">Bad Behavior</a> has blocked <strong>'.$blocked.'</strong> access attempts in the last '.$timelimit.' days.</p>';

when you right click on the missing image you get http://www.bad-behavior.ioerror.us/images/bad-behavior-80x15.png and hmmmm yep im lost with it to cant find it iv looked for two days now

i will add a link back as post above but need to remove the old one first..
I can not find any reference at all to the image...





separate question for butchs...
the new update...
did you only change bad-behavior files or did you change the codes that get inserting into SMF files?
(in other words, could I do a "dirty" upgrade by just over-writing the bad-behavior files with the new versions?)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on June 07, 2012, 12:02:18 PM
trickyricky...


umm....  I think you had a quote failure.

However, reading your post, I reiterate -- I FIND NO REFERENCE TO THAT IMAGE.
you did not answer my question.
WHERE is that image supposed to be appearing for you?
I don't see any missing image...   I don't see any not missing image... I don't see any call for that image, at all.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TrickyRicky on June 07, 2012, 12:39:53 PM
Sorry its on the portal home page at the bottom

when i installed the mod thats where it showed up then about a week ago it went missing and portal home loads real slow

epic quote fail sorry about that

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: floridaflatlander on June 07, 2012, 01:03:22 PM
when i installed the mod thats where it showed up then about a week ago it went missing and portal home loads real slow

It loads slow because the link to http://www.bad-behavior.ioerror.us/ doesn't work and the browser is trying to download an image from a site that is not up.

You can down load the image above and put it in your image file and keep the link to bad-behavior.ioerror.us if you want.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on June 07, 2012, 01:14:38 PM
to both floridaflatlander and trickyricky...

once again... I am confused.
I looked through the badbehavior code and I can find no reference to this image at all.
either as an image or as a link.

The only reference that is even similar was the link text that I indicated above...

TrickyRicky, can you give me a link to your site to see the missing image?
because the only template file that would be affected is "index.template.php" and this image was not added to mine (and I use a portal as well)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: floridaflatlander on June 07, 2012, 01:25:45 PM
If you go to http://custom.simplemachines.org/mods/index.php?mod=2502 and schroll down a little you see a section that says

Quote
Bad Behavior / Bad Behaviour icons for your front page:
Show everyone that you have taken the care to protect your forum from spammery:

<p><a href="http://www.bad-behavior.ioerror.us/">
<img src="http://www.bad-behavior.ioerror.us/images/bad-behavior-80x15.png"
alt="Bad Behavior" height="15" width="80" /></a></p>>

Please copy the above master image to your site and adjust only the image link.  Let the bad bots come to Bad Behavior.

I put this on my index.template.php footer section, anyone could see it, signed in or not. I didn't have the image in my file(as it is now) which is where I started noticing the slow down load on the image.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on June 07, 2012, 01:56:44 PM
ok...   so, in other words, that icon and link are not actually part of the mod itself. those are things that you manually added on your own sites, based on the comment in the mod description.......

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: floridaflatlander on June 07, 2012, 01:58:49 PM
ok...   so, in other words, that icon and link are not actually part of the mod itself. those are things that you manually added on your own sites, based on the comment in the mod description.......

yes
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TrickyRicky on June 07, 2012, 04:32:21 PM
Yes thanks guys i found it an admin that was banned from my site added it iv found it hidden in a block that had no title

i thank you guys for all your help

gawd i should have looked harder lol but issue solved
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Etcher on June 07, 2012, 11:21:41 PM
How effective is this mod and does it slow down load times?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on June 07, 2012, 11:25:22 PM
How effective is this mod and does it slow down load times?

This effective

Quote
Bad Behavior has blocked 124 access attempts in the last 7 days.

andf no.

 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Etcher on June 07, 2012, 11:30:48 PM
Interesting. Have you run into any problems with your users being blocked?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on June 07, 2012, 11:33:40 PM
Interesting. Have you run into any problems with your users being blocked?

Only the ones whom eat....

(http://i258.photobucket.com/albums/hh258/2plus1_bucket/Spam.jpg)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Etcher on June 07, 2012, 11:39:20 PM
But.. but I love eating spam ;(
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on June 08, 2012, 08:54:18 PM
Yum...  I am the only one in my house who loves it for breakfast.  Thank goodness they now offer it in single pack servings.  Perfect to brown to golden perfection for breakfast!
 O:)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Etcher on June 08, 2012, 08:56:27 PM
Yum...  I am the only one in my house who loves it for breakfast.  Thank goodness they now offer it in single pack servings.  Perfect to brown to golden perfection for breakfast!
 O:)
Amen to that. They are especially good when mixed with eggs.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on June 13, 2012, 09:10:39 PM
The Bad Behavior core site was down for a week due to a HD failure and is now back up.  Click here (http://bad-behavior.ioerror.us/2012/06/13/disaster-recovery-update/) for an explanation.
 8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on June 19, 2012, 12:10:22 PM
Any idea when the latest version of the Bad Behavior mod will be available for download again? Is Bad_Behavior_1.5.10 the latest, safe version to use? I was going to install it on my version 1.16 forum but hesitated when I saw that Bad Behavior isn't available for download apparently? Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on June 19, 2012, 02:27:18 PM
Never mind. I just read the other thread on your website. Jeez. I have 1.5.9 installed. Guess I will stay with that version for now. Hope this gets worked out.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on July 08, 2012, 08:18:59 PM
Good to see the mods back where it should be.

 ;D
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on July 08, 2012, 08:49:10 PM
I do my utmost to strive for perfection...  my standards are held to the highest level.  So when there was a claim that my mod was unsafe, I immediately pulled the mod.  Tested the heck out of it...  Revised some code...  Then asked for a peer review by SMF.  The mod passed the review so it is back.
 :-X
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on July 08, 2012, 08:50:53 PM
Quote
I do my utmost to strive for perfection...  my standards are held to the highest level.

As should all mod authors.

 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Sudhakar Arjunan on July 12, 2012, 02:40:58 AM
I is really a premium link spam killer which i enjoy after installing the mod.

Love it.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on August 30, 2012, 07:14:01 PM
Something changed this morning in Bad Behavior. I'm using SMF 1.1.16. I have hundreds of pages of errors for various Google bots and Bing Bots. All the IP addresses are in ranges assigned to Google and Microsoft. I had Bad Behavior 1.5.9 installed but I upgraded to 1.5.11 this afternoon to see if that would make a difference though I haven't changed anything else in some time. Bad Behavior is still blocking a large number, possibly all since I haven't seen any get through yet, of search engine bot requests?

Most of the errors are this one (or the msnbot one KEY:   e4de0453): KEY:   f1182195
DENIED REASON:   User-Agent claimed to be Googlebot, claim appears to be false.
EXPLANATION:   An invalid request was received. You claimed to be a major search engine, but you do not appear to actually be a major search engine.

IP:   131.253.41.246
DATE:   2012-08-23 19:03:50
METHOD:   GET
URI:   /vid/Jordan+Jansen/
PROTOCOL:   HTTP/1.1
HEADERS:   GET /vid/Jordan+Jansen/ HTTP/1.1 Accept: text/html, text/plain, text/text, text/javascript, text/x-javascript, text/js, text/x-js, text/jscript, text/ecmascript, text/xml, xml/xml, image/*, audio/*, video/*, application/* Accept-Encoding: gzip, deflate Connection: Close From: msnbot(at)microsoft.com Host: w w w.greatlakesbass.com User-Agent: msnbot-media/1.1 (+http://search.msn.com/msnbot.htm)
AGENT:   msnbot-media%2F1.1%20%28%2Bhttp%3A%2F%2Fsearch.msn.com%2Fmsnbot.htm%29
ENTITY:   
KEY:   e4de0453
DENIED REASON:   User-Agent claimed to be msnbot, claim appears to be false
EXPLANATION:   An invalid request was received. You claimed to be a major search engine, but you do not appear to actually be a major search engine.

Tons of rejected IP 157.55. and 157.56., 131.253.39-.41, 131.256.46-.47 and some 66.249.73 (see below where Bad Behavior says a Mediapartners-Googlebot is on the blacklist too?). User-Agent: Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) AGENT:   Mozilla%2F5.0%20%28compatible%3B%20bingbot%2F2.0%3B%20%2Bhttp%3A%2F%2Fwww.bing.com%2Fbingbot.htm%29 being blocked?

IP:   66.249.73.137
crawl-66-249-73-137.googlebot.com
DATE:   2012-08-30 17:46:46
METHOD:   GET
URI:   /
PROTOCOL:   HTTP/1.1
HEADERS:   GET / HTTP/1.1 Accept: */* Accept-Encoding: gzip,deflate Connection: Keep-alive From: googlebot(at)googlebot.com Host: w w w.greatlakesbass.com User-Agent: Mozilla (compatible; Mediapartners-Googlebot/2.1;(+http://www.google.com/bot.html)
AGENT:   Mozilla%20%28compatible%3B%20Mediapartners-Googlebot%2F2.1%3B%28%2Bhttp%3A%2F%2Fwww.google.com%2Fbot.html%29
ENTITY:   
KEY:   17f4e8c8
DENIED REASON:   User-Agent was found on blacklist

Also a bunch of errors like the one below from non-bot IP addresses around the world that do not say they are Googlebot, but are being rejected with the same code. They just appear to be referred from search:
IP:   50.140.***.***
c-50-140-***-***.hsd1.in.comcast.net
DATE:   2012-08-30 17:47:15
METHOD:   GET
URI:   /forum/index.php?topic=3597.0
PROTOCOL:   HTTP/1.1
HEADERS:   GET /forum/index.php?topic=3597.0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate Host: w w w.greatlakesbass.com Referer: http://w w w.google.com/search User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/536.8 (KHTML, like Gecko; Google Web Preview) Chrome/19.0.1084.36 Safari/536.8 X-Forwarded-For: 50.140.***.***
AGENT:   Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%29%20AppleWebKit%2F536.8%20%28KHTML%2C%20like%20Gecko%3B%20Google%20Web%20Preview%29%20Chrome%2F19.0.1084.36%20Safari%2F536.8
ENTITY:   
KEY:   f1182195
DENIED REASON:   User-Agent claimed to be Googlebot, claim appears to be false.
EXPLANATION:   An invalid request was received. You claimed to be a major search engine, but you do not appear to actually be a major search engine.
ERROR:   403

It also appears that a bunch more than normal bad registration attempts and requests like this - //index.php?option=com_user&view=reset&layout=confirm - that are usually blocked are being permitted now. I'm going through my server looking for changes I didn't make and not finding anything so far. I added some spaces in a few spots to not create links.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on August 30, 2012, 07:36:48 PM
Not sure if I should or shouldn't have posted all the stuff above. I did find that the 1 Google IP Bad Behavior block as blacklisted was listed in CBL 9 days ago claiming to be infected with Zeus.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 31, 2012, 07:20:22 AM
Just because they are in your log it does not make them errors.

The first ip "131.253.41.246" clearly does not belong to MSN. 

For the google webpreview bots try leaving "Engine DNS" unchecked.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on September 01, 2012, 04:47:06 AM
I think I've always had Search Engine DNS unchecked. It was unchecked when I upgraded from 1.5.9 to 1.5.11. Looking through my records to see if I made a note of that or not. I'm still going through the ~800 pages of Bad Behavior rejected requests and the ~800 pages of forum errors that go with them to figure out what could have happened. Almost all my Google, Yahoo and Bing search engine traffic went from response 200 (including the entire 131.253.38-47 Microsoft range) to 403 on ~8/30/2012. Also those Google and Bing Preview user agents started getting rejected. I usually have ~110 pages of Bad Behavior rejections per week, not 800 pages in 1 1/2 days.

I usually have 12 to 18 pages of my old "Database Error: No database selected
File: /home/djkimmel/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74" per day (never did get that issue figured out) not ~800 pages in one day! Something changed. Since I'm seeing a mix of good RDNS and bad RDNS, and IP addresses in the Bad Behavior search engine file and IP addresses not in the Bad Behavior search engine file all rejected along with the preview user agents starting the morning of 8/30/2012 I have not figured out any pattern yet. Especially considering the 131.253.41 (and .40) that you think don't belong to MSN were all going through Bad Behavior from 8/1/2012 until 8/29/2012 without a problem?

I'm also seeing my normal smattering of these type that Bad Behavior normally did a really good job of rejecting starting about the same time - 202.57.0.19   2012-08-31 21:25:57   /?option=com_myblog&Itemid=12&task=../../../../../../../../../../../../..//proc/self/environ%0000   all ending up in PERMITTED #00000000 instead. I've only had 4 of them during this time but they were all permitted. I normally did not see that in the past.

Not seeing any file changes on my server I didn't make. Not seeing any unauthorized FTP or even a root connection by anyone other than me during this time (including none from my host). I added the search engine IP ranges I wanted to the Bad Behavior whitelist to get them to stop getting 403. I wish I could figure out why almost all the search engine traffic started getting rejected by Bad Behavior all of sudden? Just can't see a pattern. Of course I barely know how Bad Behavior works.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on September 01, 2012, 08:43:25 AM
Probably because it's not real search engine traffic...  You seem to have made it onto some spammer or hacker list.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 01, 2012, 12:17:47 PM
I usually have 12 to 18 pages of my old "Database Error: No database selected
File: /home/djkimmel/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74" per day (never did get that issue figured out) not ~800 pages in one day! Something changed.

I reviewed the mod and as far as I know there was no change there.  This could be an error in your settings or a bot.  The mod uses $db_prefix.  I am interested in eliminating this error. Start by looking at your "Settings.php" in your root directory and insure that $db_prefix is correctly defined.  You may want to try repair settings.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 01, 2012, 12:58:24 PM
Probably because it's not real search engine traffic...  You seem to have made it onto some spammer or hacker list.

I subscribe myself  to that list.  ;)

Now I must admit there was an error in older versions of Bad Behavior for SMF performed a reverse DNS test wether or not "Search Engine DNS" was checked.  This was a bug fix after the Core Author bashed me about it's existence.  The latest version of BB for SMF obeys the check mark.

If you wish to return to the way the last version worked check "Search Engine DNS".

I have been watching "google web preview" with "Search Engine DNS" checked.  So far, I found only one way to duplicate the visit on my site.   I forced it by logging in the google web-masters site and previewed my own site.  Attachment1 is the result.

Note attachement1 has only one X-Forwarded_for address.

Lets look more closely at some who failed.  See attachment2.

Notice Cf-Connecting-Ip: 209.85.224.99 "far right of x-forwarded-for".  This is actually the last ip in a proxy list:  X-Forwarded-For: 68.35.128.190,209.85.224.99.

There are two Ip addresses are from the list.  This is a ip spoof attempt where the first address is the client.  The first address has a project honey-pot threat rating of 17 (http://www.projecthoneypot.org/ip_68.35.128.190).  More important it is not a google address.

Bad Behavior only tests the proxy address on the far right of the "X-Forwarded-For" list.  Anyone in this list can have access to your site.

Lets look at attachmnet3.  Cf-Connecting-Ip: 74.125.178.86 "far right".  This is actually the last ip in a proxy list:  X-Forwarded-For: 108.50.185.118,74.125.178.86

This is a ip spoof attempt where the first address is the client.    108.50.185.118 is from the UNKNON REALM of the internet.

After some research I was able to go to google web-masters and duplicated the error.  Google did not report the error in their log.  I validated and tried to preview my site and to get error in attachement4.

The first "censored" address in the X-Forwarded-For is mine.  The second is google.  The mod blocked it because, when it performed the reverse DNS it found my address/ host, NOT Google.  The preview image was blocked.

It only happens when I visit the home page of web-master tools where my domain names are listed.

Google reports no 403 errors.  I have full ability to use the tools as I wish.

I can neither confirm nor deny without a shadow of a doubt that the "google web preview" visits are bad guys.  I believe they are after reading djkimmel's posts.

The detriment I see when the "Search Engine DNS" feature works correctly on a non-Ubuntu Server run site is that you can block yourself from google web-masters preview.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on September 01, 2012, 05:49:39 PM
I usually have 12 to 18 pages of my old "Database Error: No database selected
File: /home/djkimmel/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74" per day (never did get that issue figured out) not ~800 pages in one day! Something changed.

I reviewed the mod and as far as I know there was no change there.  This could be an error in your settings or a bot.  The mod uses $db_prefix.  I am interested in eliminating this error. Start by looking at your "Settings.php" in your root directory and insure that $db_prefix is correctly defined.  You may want to try repair settings.


I will try repair settings after I look in my Settings.php file. Thank you. I use a 'hand-customized' version of the 1.1.16 default theme that may very well be the cause which is one reason I have not continued to bug you about the 'No database selected' errors. They could very well be entirely my fault by doing something to the theme index.template.php that my lack of in-depth knowledge and time to figure it out is solely the cause. I use SSI in other parts of my website and I believe I may have made a couple 'minor' edits to the SSI.php file some time ago (not sure - my memory is beyond terrible and I don't always keep meticulous notes).

I don't want you to think I believe it is your fault or that I'm not appreciative of your Mod. It has helped me a ton. A TON! I'm also extra paranoid about hackers right now because a number of my clients and friends have recently been hacked and I was hacked back in March overnight before I caught and started to fix it. So I'm more sleep deprived than normal searching logs, file changes and databases for any sign of trouble. So far, sleep is the only thing I have lost. So much to learn. Not enough time. Thanks for offering to help with these errors.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on September 01, 2012, 06:34:13 PM
Well, thank you for going above and beyond in your reply! I do appreciate it. I will look more closely at some of the log information to see if I can spot any information that helps me figure out what changed that day. I do figure the more spam and attempts at bad stuff I get, the more popular I must be!  ;D Might not be the best way to look at it.

I was told by someone else online who seems to know a lot more than me that the 131.253.40-41 IP's are all Microsoft media search bots too. Arin says they are Microsoft-owned? They could be something bad but they follow the same exact patterns and behavior that the 131.253.46-47 IP's have when searching media on my site. I may get a Bing Webmaster account to see if I get a clue from their about why some of the 131.253 addresses have proper RDNS and some don't. It was the combination of them all getting 200 responses from 8/1/2012 through 8/29/2012 and then suddenly starting to get 403 responses along with the good RDNS 131.253.46-47 range AND known Google AND Yahoo that really threw me.

I now see after looking closer that some IP addresses claiming to be Yahoo that look good to me were getting rejected as not Yahoo Slurp! by SMF Bad Behavior before 8/30/2012. Since so many of them hit other parts of my website that does not come under SMF BB I just saw the numerous 200 responses. I see a 403 back on 7/31/2012 for IP 98.137.72.251 - - [31/Jul/2012:22:01:38 -0500] "GET /forum/index.php?topic=2630.0 HTTP/1.1" 403 690 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; http://help.yahoo.com/help/us/ysearch/slurp)". That IP appears to me to legitimately be from Yahoo and in the BB search engine range of 98.136.0.0/14 but maybe my logs don't capture enough information?

I will look closer at more of the Googlebot and Yahoo Slurp! user agent traffic later today.

I'd estimate 85% of the rejects are bingbot/MSNbot-media with a good mix of the IP addresses with proper RDNS and in the Bad Behavior search engine ranges and those with bad RDNS/not in the BB search engine ranges. I will look closer at more of those with your extremely helpful additional information. This is definitely not my area of expertise. I may have to ask my host if there is additional log information my setup does not capture that might explain some of the rejects that seem legitimate?

I enacted some of the SMF forum performance improvement suggestions back, I think, in June (move avatars, etc). I know I changed some host look up stuff then. I may have unchecked the Bad Behavior Search Engine DNS option at that time, if I ever had it checked, to save on resources. I'd prefer not to use it anyway for that reason. I want to be indexed well but I have better performance for visitors ranked higher. I did not know hardly anything when I first installed SMF back in December 2005 about PHP and all this stuff. I do need to redo some things for sure I know.

I did go through last night and confirm all the SMF BB files and edits are updated and correct on my domain. Thanks for the help.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 02, 2012, 10:24:29 AM
...I was told by someone else online who seems to know a lot more than me that the 131.253.40-41 IP's are all Microsoft media search bots too. Arin says they are Microsoft-owned?...

The ip list of addresses that are blocked by Bad Behavior are maintained by the Core Author (http://bad-behavior.ioerror.us/).  I do mess with the list.

He just released a new version and the addresses you list are included in BB 2.2.9 which was released this morning.  Until I get a chance to update the mod please open "searchengine.inc.php" and make the following changes:

Search:
Code: [Select]
(match_cidr($package['ip'], array("207.46.0.0/16", "65.52.0.0/14", "207.68.128.0/18", "207.68.192.0/20", "64.4.0.0/18", "157.54.0.0/15", "157.60.0.0/16", "157.56.0.0/14")) === FALSE)
Replace with:
Code: [Select]
(match_cidr($package['ip'], array("207.46.0.0/16", "65.52.0.0/14", "207.68.128.0/18", "207.68.192.0/20", "64.4.0.0/18", "157.54.0.0/15", "157.60.0.0/16", "157.56.0.0/14", "131.253.21.0/24", "131.253.22.0/23", "131.253.24.0/21", "131.253.32.0/20")) === FALSE)
If you see other ip addresses like the above please report them to the Core Author.  I do not maintain the list.  According to the core website:
To report an issue with Bad Behavior, send email to bad . bots at ioerror dot us.

I see a 403 back on 7/31/2012 for IP 98.137.72.251 - - [31/Jul/2012:22:01:38 -0500] "GET /forum/index.php?topic=2630.0 HTTP/1.1" 403 690 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; http://help.yahoo.com/help/us/ysearch/slurp)". That IP appears to me to legitimately be from Yahoo and in the BB search engine range of 98.136.0.0/14 but maybe my logs don't capture enough information?

As I explained in my last post "98.137.72.251" due to the recent bug fix that ip should be ok with the latest version of BB for SMF with "Search Engine DNS" unchecked. BB will not notice if it was spoofed...

The search engine match CIDR range test is strictly maintained by the core author.  So if you see a problem with the latest version for SMF with "Search Engine DNS" unchecked, then please report it to the Core Author.   According to the core website:
To report an issue with Bad Behavior, send email to bad . bots at ioerror dot us.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 02, 2012, 04:14:31 PM
New version.  Upgraded to 2.2.9.

Known Changes:
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on September 03, 2012, 02:13:29 AM
Great! I understand things a lot better now. I had wanted to ask about clarification about who to ask which questions. I should have seen that already. Sorry. You've set me right on that. Thank you. I will upgrade tomorrow. Went fishing today instead of looking at any more files and logs. Thanks updating your mod to include the new BB with new scanning patterns. It does appear in my logs that some hackers have updated their methods recently which added to my personal confusion.

I don't use the Search Engine DNS checked option but I'm curious to see if he changed his Yahoo round trip check from crawl.yahoo.net to what they appear to use now - yst.yahoo.net. Not a big deal for me either way though it will add a little to my understanding of how your mod and his core works.

Thank you so much for keeping this most helpful mod going and updated. I want to remove some of the IP addresses I recently whitelisted and let your mod and BB handle things.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on September 03, 2012, 02:52:26 AM
New version.  Upgraded to 2.2.9.
  • Corrected error where the malicious activity address variable was incorrect in the core 2.2.9 release (SMF ONLY).

So basically, your SMF Bad Behavior 2.2.9 core = his 2.2.10, correct? Thanks for fixing that.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 03, 2012, 09:22:30 AM
So basically, your SMF Bad Behavior 2.2.9 core = his 2.2.10, correct? Thanks for fixing that.

Yes, I am used to fixing bugs in BB core. The core's reverse proxy still does not work where the SMF version does.  This is why I test the code throughly before releasing it.

I don't use the Search Engine DNS checked option but I'm curious to see if he changed his Yahoo round trip check from crawl.yahoo.net to what they appear to use now - yst.yahoo.net. Not a big deal for me either way though it will add a little to my understanding of how your mod and his core works.

Everything listed under SMF only options is my code.  The integration with SMF, including the changes to make it compatible is my code.  As far as I can tell I am the first to migrate the whitelist to a forum DB, google safe honeyposts, cache and a BBC where suspicious visitors can not view portions of posts and etc..

The reverse DNS is my area.  I looked into it and here is what I found:

I do not catch all the changes so please let me know.  I am sure I will eventually miss something.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on September 03, 2012, 06:15:24 PM
More helpful information. Fishing yesterday was a lot easier than figuring out all this stuff and deciding what to do about it. Not sure I like 'unofficial' bots? Seems like the search engines would be aware of the hacker challenges and make our lives easier by being cleaner and more clear on their IP ranges, user agents and RDNS.

Guess I will have to put some thought this week into image scraping and which bots I like and don't like (Baidu and Yandex went bye bye for me a while ago - ignoring my robots.txt and not my market, plus they hang out with more bad characters). Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 03, 2012, 08:32:17 PM
Thank you...  So much for a relaxing programming weekend...  Time to go back to the drudgery of my real job to pay the bills...  Check out SMFHelper (http://www.smfhelper.info/) for some cool additions to BB.  ;)

Another option:  Some say that if a bot obeys "robots.txt " it is a good bot.  If the bot ignores "robots.txt " it is a bad bot.  This is the basis for my Forum Firewall "Robots.txt Validation".   Though not a newbie toy, when implemented correctly, it stops them cold!
 :o
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on September 04, 2012, 01:12:17 AM
I signed up on SMFHelper. I've been reading on there a number of times but never signed up apparently.

I've also been looking at your Forum Firewall mod. I have no idea why I could not get Baidu to follow my robots.txt but I made changes for a couple months, waiting 5 days or so between each change. I even sent an email and filled out their form. No response. They just kept pounding away at a ridiculous rate so I blocked them. Considering all the other 'spiders' out there hitting my site and the less than savory traffic they seem to send me, I will need a better method than I have now of trying robots.txt, waiting a few days, looking at logs and then firewalling the ones who keep coming in plus all the 'spiders' who completely ignore robots.txt.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on September 04, 2012, 02:52:11 AM
I usually have 12 to 18 pages of my old "Database Error: No database selected
File: /home/djkimmel/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74" per day (never did get that issue figured out) not ~800 pages in one day! Something changed.

I reviewed the mod and as far as I know there was no change there.  This could be an error in your settings or a bot.  The mod uses $db_prefix.  I am interested in eliminating this error. Start by looking at your "Settings.php" in your root directory and insure that $db_prefix is correctly defined.  You may want to try repair settings.


I do use a different $db_prefix than the SMF default but it is set correctly. I ran repair settings again. The only thing missing was a setting for queryless url's. When I first installed SMF it said I couldn't use them. I didn't want to turn them on later. I will look at some previews I found online about how the bad behavior page looks to those who get it on my site using my customized theme. I changed some paths too since I have the default files in Themes/default and just images and the bare necessities in my custom theme folder.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on September 04, 2012, 06:09:24 PM
I did sign up on smfhelper.info but I'm unable to post or send a private message. I just keep getting the "The following error or errors occurred while posting this message:
The message body was left empty.
" message though I've logged in and logged out, cleared browsing data, tried different browsers. I can read stuff and look for additional information and additions anyway.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 05, 2012, 08:51:49 PM
Well...  I do not know what to do since this is outside my mod.  But I gave Bigguy your message.  He thinks he fixed it.  If not please PM Bigguy here.
 O:)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on September 06, 2012, 05:58:46 PM
That was all I could hope for. I could have sent him a PM on here I guess but I try to avoid that since many are PM-adverse (for good reasons often, I'm sure). I will check it out. Thanks. SMF Bad Behavior 1.5.12 is working great on my forum. Hackers will have to try a little harder.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: tMicky on September 07, 2012, 04:51:26 PM
For some reason, this Firewall Mod and the Bad Behavior Mod - have an issue with:
./Themes/Glacier/index.template.php - for both mods, I got Test Failed.

I haven't had issues with other mods and this Theme.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on September 07, 2012, 05:52:08 PM
glacier themes suck...  **NO** mods will install correctly into them.

So, as has been said several thousand times... you will have to manually edit those files.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: tMicky on September 07, 2012, 06:17:03 PM
glacier themes suck...  **NO** mods will install correctly into them.

So, as has been said several thousand times... you will have to manually edit those files.
thanks
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: tMicky on September 07, 2012, 06:44:40 PM
(Find)
Code: [Select]
// Show the load time?
(Add Before)

Code: [Select]
if ($modSettings['badbehavior_display_stats']) {
if (!function_exists('bb2_insert_stats')) {
global $sourcedir;
require_once($sourcedir . '/bad-behavior/BadBehavior-SMF.php'); }

  bb2_insert_stats();
}

However, I can't find the // Show the load time? code in index.php. I have searched each word, but it's not there. The test failed said - Add Before    ./Themes/Glacier/index.template.php    Test failed
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 07, 2012, 09:02:53 PM
I can not help you with individual themes.  Supporting them will simply take way too much time...  :-[

Good news though...  Here is a link to a mod parser:  SMFHelper (http://community.smfhelpers.com/parser.php)
 :-*
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: djkimmel on September 07, 2012, 09:06:37 PM
Find were it should be in the default or core SMF theme and then find the corresponding place in the Glacier theme. If you can. That is what I would do.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: domscatterbrain on September 09, 2012, 07:07:17 PM
Can i whitelisted an ip range with this mod?
This mod is awesome, but since i installed this mod many of my forum member complained that they receive 403 error.
For a while, i put an announcement to mail me their IPs in our forum facebook group so i can put them into Bad Behavior's whitelist.
And there is another problem, most of my member's IP are dynamic so the best thing i can think is whitelisting a certain IP range from their ISP.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 09, 2012, 08:15:01 PM
WHITELIST MEMBERS HELP

Yes.  First off I recommend that you whitelist you ALL your regular members.

In SMF you can whitelist member groups only.  Unlike other security mods, this mod will use the last known ip address of a whitelisted member and not block them if they are logged in or not logged in and their ip address has not changed.  I highly recommend this procedure for all FORUMS!  Here is the procedure:

There is am image of the permission location on the mod (http://custom.simplemachines.org/mods/index.php?mod=2502) page.

If they are among the RARE users who logout every time and when they return their IP address changed follow this procedure AS A LAST RESORT:

The above is not required for static addresses and 99.9% of users.  I have over 250 members and only one (1) member who services a hospital with crazy security.  He is my only member who requires a CIDR whitelist.
 :D
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Omebolle on September 10, 2012, 04:59:34 AM
Sorry to budge in, but I have a question

Some time ago I installed Bad Behavior on my forum running on SMF 2.0 RC5.

Stopped all the spam I wanted to get rid of, great!!!. But now all of a sudden I get messages of blocked spam which are in fact legal and admitted posts on the forum. In one case a long time member, the other one a new member.

I'm not really an expert on this, anyone got an idea?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 10, 2012, 06:58:21 AM
First off, if you have not done so whitelist your members as explained in the first half of my last post.

Second I have no idea what the problem is without more details.  I know there was some anti-hacking stuff added to the core...  Please provide the Event details by clicking on the visitor in the denied entries log.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Omebolle on September 10, 2012, 08:34:19 AM
Thanks, did the whitelist change, let's see what happens.

Here are the event logs for the two members, they CAN post on the forum though

The new member and I see something about blackberry??
Code: [Select]
ID: 65
IP: 74.82.64.160
74-82-64-160.rdns.blackberry.net
DATE: 2012-09-09 22:34:11
METHOD: GET
URI: /test/index.php?topic=246.new;topicseen
PROTOCOL: HTTP/1.1
HEADERS: GET /test/index.php?topic=246.new;topicseen HTTP/1.1 Host: dutchy.info User-Agent: Mozilla/5.0 (BlackBerry; U; BlackBerry 9810; en-US) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.0.0.583 Mobile Safari/534.11+ Accept: text/html,application/xhtml+xml,application/xml,*/*;q=0.5 Referer: Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip,deflate Cookie: PHPSESSID=8o13i7ah30vlif9krpsu39ncc0 X-Wap-Profile: "http://www.blackberry.net/go/mobile/profiles/uaprof/9810_umts/7.0.0.rdf" Cache-Control: max-age=0 Connection: close
AGENT: Mozilla%2F5.0%20%28BlackBerry%3B%20U%3B%20BlackBerry%209810%3B%20en-US%29%20AppleWebKit%2F534.11%2B%20%28KHTML%2C%20like%20Gecko%29%20Version%2F7.0.0.583%20Mobile%20Safari%2F534.11%2B
ENTITY:
KEY: 69920ee5
DENIED REASON: Header 'Referer' present but blank
EXPLANATION: An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.
ERROR: 400

This is the Old member
Code: [Select]
: 54
IP: 195.241.190.199
195-241-190-199.ip.telfort.nl
DATE: 2012-09-03 11:57:43
METHOD: GET
URI: /test/index.php?action=dlattach;topic=193.0;attach=3951;image
PROTOCOL: HTTP/1.1
HEADERS: GET /test/index.php?action=dlattach;topic=193.0;attach=3951;image HTTP/1.1 Host: dutchy.info Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1 Accept-Encoding: gzip,deflate,sdch Accept-Language: nl-NL,nl;q=0.8,en-US;q=0.6,en;q=0.4 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bb2_screener_=1346666252+195.241.190.199; SMFCookie759=a%3A4%3A%7Bi%3A0%3Bs%3A2%3A%2223%22%3Bi%3A1%3Bs%3A40%3A%222d6d2405e2962083fea946cd1d37923b91d05c76%22%3Bi%3A2%3Bi%3A1532780001%3Bi%3A3%3Bi%3A0%3B%7D; PHPSESSID=evqolvstcos57dhufm313k8220
AGENT: Mozilla%2F5.0%20%28Windows%20NT%206.0%29%20AppleWebKit%2F537.1%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F21.0.1180.83%20Safari%2F537.1
ENTITY:
KEY: 17566707
DENIED REASON: Required header 'Accept' missing
EXPLANATION: An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.
ERROR: 403
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on September 10, 2012, 11:08:43 AM
please learn to use code tags.....
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Omebolle on September 10, 2012, 01:29:07 PM
  ??? done  ;D
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 10, 2012, 06:36:03 PM
Here are the event logs for the two members, they CAN post on the forum though
...

Sure you hae the mod Enabled?  The first check in the settings...

Thanks, did the whitelist change, let's see what happens....

The new member and I see something about blackberry??
...

Yea, thats common.

They should be ok.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Omebolle on September 11, 2012, 05:47:22 AM
Yes, the mod is enabled long time ago, cought some nasty spammers too.

As long as the members can post there shouldn't be a problem. Consider question solved. Thanks
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 11, 2012, 07:52:15 PM
That is good to hear.   8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: domscatterbrain on September 13, 2012, 06:26:44 PM
Ah yes, thank you for your explanation. Sorry for expressed my gratitude this late, because i never thought that you responded immediately.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on September 18, 2012, 07:06:47 AM
A late, you-re welcome... 
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on October 20, 2012, 03:04:45 AM
I have two fairly different users on my forum that both trigger a "POST more than two days after GET" error about once or twice a month...

Looking at the earlier thread we have tried to eliminate the possibilities of proxies etc, javascript settings and malware.

Any ideas?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 20, 2012, 08:23:12 PM
Are you using the latest mod and SMF version?
Did you add all your members to the whitelist as mentioned above?
What is the technical support key they saw?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on October 21, 2012, 04:46:12 PM
Are you using the latest mod and SMF version?
Did you add all your members to the whitelist as mentioned above?
What is the technical support key they saw?

The white list options are:
IP
- can't because they use dynamic IPs (IE a short term fix)
URL
- This happens when posting, don't want to remove protection from the post url
agent
- I think they both use chrome but it updates so often I am not sure I want to drop in a white list for all users.

What would be really nice is a forum account based white-list, IE I could white list specific authenticated forum accounts... Then I just need to worry if that users account specifically gets exploited.

I don't have the more recent ones but one of the support keys was ae03-139a-b40c-8ddc.

It has been a few days now since the most recent report so my logs have rolled over and I can't look back for more detail. ( this plugin works VERY well BTW).
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 21, 2012, 07:00:34 PM
What would be really nice is a forum account based white-list, IE I could white list specific authenticated forum accounts...

There are more white-list options than that, have been with this mod for a long time, look here for forum account based white-list (http://www.simplemachines.org/community/index.php?topic=375980.msg3403306#msg3403306).   :(

b40c8ddc is from the screener for cookie/JavaScript.  The test should be disabled by checking "EU cookie handling".   This is a mute point if they are logged in members and you use the SMF white-listing feature mentioned above...  8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on October 21, 2012, 07:27:56 PM
What would be really nice is a forum account based white-list, IE I could white list specific authenticated forum accounts...

There are more white-list options than that, have been with this mod for a long time, look here for forum account based white-list (http://www.simplemachines.org/community/index.php?topic=375980.msg3403306#msg3403306).   :(

b40c8ddc is from the screener for cookie/JavaScript.  The test should be disabled by checking "EU cookie handling".   This is a mute point if they are logged in members and you use the SMF white-listing feature mentioned above...  8)

Thanks, I missed that post even after you suggested looking at the post above..

Also unless I am missing something I didn't see that documented on the MOD page. I generally expect all mod settings to be with a mods menu unless the mod explicitly states it modifies something else in its description.

Maybe a little bit of text in the mods primary white list section that states " More white-list options can be found in the forum group permissions screen?

Same kind of goes for the BB code button it adds... I think having a little description for these in the mod page or maybe the about section IN the mod might lead some admins to find these VERY useful features.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 21, 2012, 07:37:59 PM
Well...  you have me there.

I did make some tutorials for the most difficult stuff that can be found by searching my mods for bold HELP.  There is a bold HELP for the BB code button in this thread...

I will look at adding links to the tutorials in the mod page when I get more time after winter sets in.
 O:)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on October 21, 2012, 07:44:17 PM
Well...  you have me there.

I did make some tutorials for the most difficult stuff that can be found by searching my mods for bold HELP.

I will look at adding links to the tutorials in the mod page when I get more time after winter sets in.
 O:)

Well searching for the word HELP isn't really the natural thing to do. Searching for Bad Behavior white-list in the community section brings up all sorts of non-related threads.

I would suggest some cut and past work on some of your more detailed posts and stuff them in an FAQ section on the mod download page....

Again, I love this mod. Keep up the good work.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 21, 2012, 07:45:58 PM
I an not going to argue against your point since I have been repeating much of the helps...  Will look at it after the snow sets in...   ::)

EDIT:  Here is the BB Code (http://www.simplemachines.org/community/index.php?topic=375980.msg3122889;topicseen#msg3122889) HELP.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on October 21, 2012, 07:46:45 PM

Well searching for the word HELP isn't really the natural thing to do. Searching for Bad Behavior white-list in the community section brings up all sorts of non-related threads.

Again, I love this mod. Keep up the good work.

Why not use the This topic part of the search?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Lazybones on October 21, 2012, 07:56:08 PM

Why not use the This topic part of the search?

My suggestion is more geared to helping those that have not already found this thread.

You make a good point, once you know that the information might be in this specific thread searching just it makes sense. However even doing that for "whitelist" now returns the help post as the 7th result since we have been discussing it (probably 8th hit now after this reply).
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: MovedGoalPosts on October 24, 2012, 06:17:04 PM
I see Bad Behaviour's website shows it's current version is at 2.2.11, yet this mod's latest version is still based on 2.2.09.  Is there any update for SMF please?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 25, 2012, 07:03:24 AM
I am tired of fixing the core code.  The core author thinks he is gods gift to programming but has a proven reputation for releasing code that has not been properly tested.  Because of that I usually wait a week or two for him to clean any bugs before upgrading the mod.  This way I do not have to deal with his arrogance.

After Sunday morning I will start working on and testing the update.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: MovedGoalPosts on October 25, 2012, 01:01:07 PM
OK thanks :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 28, 2012, 07:12:06 PM
New version.  Changes

The following changes have been made:


 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: huan on November 24, 2012, 04:01:02 AM
i installed these together with forum firewall may i know what the recommend setting ?
oh the entry log denied and permitted ,does it mean denied =user was blocked ,permitted=was allowed
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 25, 2012, 10:32:46 AM
Yes, denied =user was blocked , permitted=was allowed "suspicious".  All data enclosed in Bad Behavior BBC "suspicious" tags will not be visible to the visitor in the permitted list.

MOD INSTALLATION HELP

Adjust all settings before you enable the mod.

Check all the options that are "Recommended" in "Bad Behavior Admin/ SETTINGS".

Register your site at ProjectHoneyPot (http://www.projecthoneypot.org/faq.php#b).
Get the access key at ProjectHoneyPot (http://www.projecthoneypot.org/faq.php#g).
Add an OPTIONAL honey pot (http://www.projecthoneypot.org/manage_honey_pots.php) script for your site.
Copy the OPTIONAL honey pot script to your site (the same location as the SMF folder).
Activate the OPTIONAL honey pot (http://www.projecthoneypot.org/manage_honey_pots.php) script and confirm it is active.

Copy over the HoneyPot information in the "Bad Behavior Admin/ SETTINGS/ Project Honey Pot HTTP Blacklist" area:

If you use CloudFlare:  Enter "Cf-Connecting-Ip" in "IP call to Reverse Proxy" and check "Enable Reverse Proxy".

Whitelist all your regular members.  Read "WHITELIST MEMBERS HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3403306#msg3403306)" for details.

OPTIONAL:  Enter your personal admin IP address or CIDR range "Bad Behavior Admin/ SETTINGS/ Whitelist/ IP Address".  For more iinformation read "WHITELIST HELP" (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023).

Then "Enable Bad Behavior".

Click the help icons (http://www.simplemachines.org/community/Themes/default/images/helptopics.gif) in the mod and information at the core bad-behavior (http://bad-behavior.ioerror.us/support/configuration/) site for additional help.


For some advanced tutorials see:
O:)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 25, 2012, 02:45:01 PM
...Also unless I am missing something I didn't see that documented on the MOD page. I generally expect all mod settings to be with a mods menu unless the mod explicitly states it modifies something else in its description....

Requested information added to the first (http://www.simplemachines.org/community/index.php?topic=375980.0) post of this thread.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: stylusss on November 28, 2012, 08:55:03 AM
Could you tell me how to remove the entries? They are really piling up in a single day. :-\
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: stylusss on November 28, 2012, 07:48:36 PM
Can someone also help me correct this error:

Code: [Select]
Database Error: Incorrect table name ''
File: /home/biologyf/public_html/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74

I'm using 1.x
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 28, 2012, 09:43:56 PM
Could you tell me how to remove the entries? They are really piling up in a single day. :-\

I stopped upgrading SMF 1.x since the announcement.  Though it works fine on the test servers.

Upgrade to SMF 2.0.x go to "ALL ENTRIES LOG" and click on "REMOVE ALL".  Or with SMF 1.x manually edit PhpMyAdmin.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 28, 2012, 09:47:47 PM
Can someone also help me correct this error:

Code: [Select]
Database Error: Incorrect table name ''
File: /home/biologyf/public_html/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74

I'm using 1.x

Sounds like you need to run repair settings (http://download.simplemachines.org/index.php?thanks;filename=repair_settings.php).  See SMF 1.x support area for how to use it...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: stylusss on November 29, 2012, 06:54:47 PM
Could you tell me how to remove the entries? They are really piling up in a single day. :-\

I stopped upgrading SMF 1.x since the announcement.  Though it works fine on the test servers.

Upgrade to SMF 2.0.x go to "ALL ENTRIES LOG" and click on "REMOVE ALL".  Or with SMF 1.x manually edit PhpMyAdmin.

That option is also found in SMF 1.x, thank you!

Can someone also help me correct this error:

Code: [Select]
Database Error: Incorrect table name ''
File: /home/biologyf/public_html/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74

I'm using 1.x

Sounds like you need to run repair settings (http://download.simplemachines.org/index.php?thanks;filename=repair_settings.php).  See SMF 1.x support area for how to use it...


Repair settings eh. That's pretty weird, never had to do that before, server has remained the same. Is there any other way of rewriting that part of the code?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 29, 2012, 07:59:52 PM
That option is also found in SMF 1.x, thank you!

Oh, I forgot!    :o

Repair settings eh. That's pretty weird, never had to do that before, server has remained the same. Is there any other way of rewriting that part of the code?

The SMF 1.1.x version has had no code changes to that part of the code in years.  Many other 1.1.x users have no problems.  The only issue I can think of is an error in your settings.php file.

There is no shame in running repair settings.  I have done it at least five times over the years.

Some times after an upgrade it does not help.  Then I look at the installer settings.php file and manually edit mine to include all the lines of code.
 8)

EDIT:  Looking at the code, another possibility is that data may be incorrect is the phpMyAdmin "db_prefix"settings.  The variable "badbehavior_log_table" should have a value in the format of your current "db_prefix" followed by "log_badbehavior".  If it is not, then calls like on line 14 of Banned.inc.php will produce your error.

This variable is set during the fist installation of the mod.  Once installed it is never changed.  So if it did not read the settings.php correctly during initial install or you changed your db prefix at one time or another it will produce the error.

One option will be to manually delete just the "badbehavior_log_table" variable then uninstall, followed by a reinstall of the mod in the hope the mod does the work for you.

 :(
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: stylusss on November 29, 2012, 09:47:15 PM
Thanks for the detailed response. I installed the mod manually by parsing the code, though most of it was done for me already, that is, very few edits to main core files. The mod still works perfectly, but it produces many errors in the error log when it is enabled, so I have temporarily disabled my error logs so that it continues to fight the spam battle. Will let you know what transpires.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 30, 2012, 07:14:37 AM
The easy fix will be to edit "badbehavior_log_table" in phpMyAdmin as described above.

If you prefer to edit code, assuming Settings.php is correct, you can always try the following...

Search for in "BadBehavior-SMF.php":
Code: [Select]
global $badbehavior_settings, $modSettings;

$badbehavior_settings['enable_badbehavior'] = $modSettings['enable_badbehavior'];
$badbehavior_settings['log_table'] = $modSettings['badbehavior_log_table'];

Replace with:
Code: [Select]
global $badbehavior_settings, $modSettings, $db_prefix;

$badbehavior_settings['enable_badbehavior'] = $modSettings['enable_badbehavior'];
$badbehavior_settings['log_table'] = $db_prefix . 'log_badbehavior';

Then the DB modsetting should be ignored.  Humm...  Maybe I will delete it in future versions.  8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: stylusss on November 30, 2012, 04:41:16 PM
The easy fix will be to edit "badbehavior_log_table" in phpMyAdmin as described above.

If you prefer to edit code, assuming Settings.php is correct, you can always try the following...

Search for in "BadBehavior-SMF.php":
Code: [Select]
global $badbehavior_settings, $modSettings;

$badbehavior_settings['enable_badbehavior'] = $modSettings['enable_badbehavior'];
$badbehavior_settings['log_table'] = $modSettings['badbehavior_log_table'];

Replace with:
Code: [Select]
global $badbehavior_settings, $modSettings, $db_prefix;

$badbehavior_settings['enable_badbehavior'] = $modSettings['enable_badbehavior'];
$badbehavior_settings['log_table'] = $db_prefix . 'log_badbehavior';

Then the DB modsetting should be ignored.  Humm...  Maybe I will delete it in future versions.  8)

Thank you, I have changed to the code to your suggestion. If update you if things go wrong!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 30, 2012, 06:15:37 PM
Please let me know if they go right too so I can add it to a future update.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: stylusss on November 30, 2012, 08:38:39 PM
Please let me know if they go right too so I can add it to a future update.

No more lousy errors coming from bad-behaviour thanks :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 09, 2012, 05:07:09 PM
New version.

BB for SMF changes

BB core changes:
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: stylusss on December 09, 2012, 06:02:46 PM
How do we go about installing these new changes? I parse all my mods, rather than go through the auto parser. Could you let us know what to edit new?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 09, 2012, 06:33:02 PM
I know you have a custom THEME.  So with a custom theme edit for version 1.1.13, all you need to do is replace the following files:


I hope I got it all..
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: stylusss on December 09, 2012, 06:58:15 PM
Just to understand this better, no changes were made to the template or SMF core source files right? If that's the case, I will simply overwrite all the mod files with the new ones in the package.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 10, 2012, 06:57:10 AM
Yes.  Just make sure you pick the correct ones for your version of SMF.  Look at package manager for what goes where.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: stylusss on December 10, 2012, 01:05:54 PM
Yes.  Just make sure you pick the correct ones for your version of SMF.  Look at package manager for what goes where.

Thanks Butchs
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 13, 2012, 04:10:07 PM
New core version.   Changes as follows:

Requests from the Baidu search engine now go through screening similar to Google and other major search engines. This will help to prevent illegitimate access from clients which falsely claim to be the Baidu search engine. A logic error which prevented these checks from ever running has been fixed.

No changes were made to installation scripts.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: bladesb on December 15, 2012, 09:10:37 PM
Trying to install this mod, I get an error that it cannot install to my theme. My forum members just voted to use this theme so I am kinda married to it.

It's called "Green Bean". http://custom.simplemachines.org/themes/index.php?lemma=2348 (http://custom.simplemachines.org/themes/index.php?lemma=2348)

I'm running SMF 2.0.2

The error I get says "Test Failed" and this occurred for two different "add before" instances. (I have no idea what that means.)

I am not proficient enough to manually install the mod. I put my level of proficiency at "knows just enough to get in serious trouble".  :o

I do follow directions well, but most tech support assumes a level of understanding of certain applications, abbreviations and jargon with which I am not familiar.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on December 15, 2012, 10:14:54 PM
http://wiki.simplemachines.org/smf/Error_in_mod_installation
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 22, 2012, 10:05:51 AM
You will need to do a manual installation with a custom theme.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: S_M_F_is_Cool on January 07, 2013, 05:20:57 PM
Hi Guys,
I was using SMF2.02 and all was going good Bad Behavior was doing its job and cutting SPAM to a managable level, I upgraded to SMF 2.03 and now Bad Behavoir isn't working anymore, it is installed fine accoring to the packet manager, I even managed to upgrade to the latest version (1.5.15) without issue but the configuration for it seems to be missing, it does not seem to be working (I am experienceing a slow painfull death at the hands of the SPAMMERs, I kid you not!!!!). Is everyone else having the same problem or is it just me. where should I look to figure out what is wrong if it is just me?
Thanks heaps in advance.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 07, 2013, 06:15:18 PM
Uninstalling the mod disables the mod.  You have to re-enable the mod.  Click Enable Bad Behavior in the admin page.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Iron Bug on January 07, 2013, 06:38:46 PM
I've got a question considering the mod. Is it possible to make an exclusion for certain user?
The problem is on my forum quite many users use dynamic IP pools and may access the forum from range of IPs that were also used by spammers and blacklisted. Is it possible to bypass the check not only for IPs but for certain list of registered users? Or is it principally possible to implement this as a feature?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 07, 2013, 08:43:15 PM
Yes yes and yes...  See FAQ's in 1st post in this thread.

1. You can assign that member to a member group and white list the group. 
2. All assigned member groups will be white listed as long as the members are logged in or their ip does not change.  The latter is per SMF.  SMF saves the last used ip address.
3. You can white list an ip range, url and url...

It's all in the FAQ's... ;)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Iron Bug on January 07, 2013, 09:53:36 PM
Sorry, I didn't notice the FAQs. But I still have a question: are the IPs for whitelisted users checked together with their usernames or they're just common whitelisted IPs for anyone that connects to the forum?
I got the worst case when many users use wide dynamic ranges (phone connection), the addresses always change and there're many bots using that ranges as well. And I'm afraid that I will have to write some special IP checking extension for my own needs.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: S_M_F_is_Cool on January 07, 2013, 10:09:35 PM
Uninstalling the mod disables the mod.  You have to re-enable the mod.  Click Enable Bad Behavior in the admin page.

Can't find that??????
 Admin>Config has only Miscellaneous and Akismet Span Blocking in it

is it supposed to be there or elsewhere????

Sorry if I am being stupid.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on January 08, 2013, 12:02:13 AM
Separate issue... But why did you uninstall the mod when you upgraded to 2.0.3? The upgrade from 2.0.x to 2.0.y  installs as a patch/package... And does not require you to touch any mods.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: S_M_F_is_Cool on January 08, 2013, 12:49:29 AM
Separate issue... But why did you uninstall the mod when you upgraded to 2.0.3? The upgrade from 2.0.x to 2.0.y  installs as a patch/package... And does not require you to touch any mods.
I only uninstalled it when it stopped working when I went from 2.0.2 to 2.0.3.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on January 08, 2013, 01:50:59 AM
there should have been no stop....   I installed the 2.0.3 patch with no failure on 4 forums (all with the bad behavior mod installed)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: S_M_F_is_Cool on January 08, 2013, 04:14:19 AM
there should have been no stop....   I installed the 2.0.3 patch with no failure on 4 forums (all with the bad behavior mod installed)
I wish it hadn't trust me as the SPAM I get is not much fun!

e.g.

The following topics are awaiting approval:
------------------------------------------------------
50x ugg boots outlet
perhaps some viagra etc

I am sure you get the idea. Grrrrrr
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 08, 2013, 07:21:13 AM
Uninstalling the mod disables the mod.  You have to re-enable the mod.  Click Enable Bad Behavior in the admin page.

Can't find that??????
 Admin>Config has only Miscellaneous and Akismet Span Blocking in it

is it supposed to be there or elsewhere????

Sorry if I am being stupid.

Admin/ Configuration/ Bad Behavior

If it is not there something went wrong with the reinstall.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 08, 2013, 07:24:31 AM
Sorry, I didn't notice the FAQs. But I still have a question: are the IPs for whitelisted users checked together with their usernames or they're just common whitelisted IPs for anyone that connects to the forum?
I got the worst case when many users use wide dynamic ranges (phone connection), the addresses always change and there're many bots using that ranges as well. And I'm afraid that I will have to write some special IP checking extension for my own needs.

Assign your member groups to the whitelist and they will be ok as long as they log in.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: S_M_F_is_Cool on January 09, 2013, 03:51:48 PM
Admin/ Configuration/ Bad Behavior
That is not there.

If it is not there something went wrong with the reinstall.
Maybe, but I think it went wrong when I upgraded the forum from 2.0.2 to 2.0.3, everting else went fine but bad behaviour seems to have got broken, uninstalling 1.5.13 and reinstalling 1.5.15 seems to have made no difference :-(
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: S_M_F_is_Cool on January 09, 2013, 04:16:44 PM
Maybe, but I think it went wrong when I upgraded the forum from 2.0.2 to 2.0.3, everting else went fine but bad behaviour seems to have got broken, uninstalling 1.5.13 and reinstalling 1.5.15 seems to have made no difference :-(

Just tried changing the theme in case that caused the problem, uploaded the theme directory from the SMF install to my sever renamed Themes to Themes_mod and the one that comes in the SMF install Themes and that made no difference so I don't think it has anything to do with it either :-(
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 09, 2013, 09:32:27 PM
I am going to have to agree with Kindred here.   :'(  You just gave yourself more work since you have a custom theme.

If you have a custom theme you need to do a manual installation if you can select the theme for an auto installation.  I am no expert at this stuff so I can offer little help except:  Go to the mod page and under "Manual Install Instructions for SMF" select your version of SMF.  Then  follow the instructions.
 :-\
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: awolexpat on January 10, 2013, 10:03:02 PM
Hi there,
I have had BB installed on my forum for some time now and it does a good job. However I have been plagued with one error in my log almost from day one, as follows:
Quote
http://www.awolonline.net/forum/index.php?action=register
28: Array to string conversion
File: /home3/awolonl1/public_html/forum/Sources/BadBehavior-mysql.php
Line: 220

I have over 100 of these errors currently from 27th December to date, and I have just been deleting them but now would really like to get to the bottom of why they are appearing and prevent them.

The bit of code it refers to is this:
Code: [Select]
218: if (!strcasecmp($request_method, "POST")) {
219: foreach ($package['request_entity'] as $h => $v) {
==>220: $request_entity .= bb2_db_escape("$h: $v\n\r");
221: }
222: unset($v);

I have a lot of mods installed (see list below) so it could be a conflict with one of them but I wanted to ask here first before going through the laborious process of trying to find out which one might be causing a problem. I don't understand the code well enough to know what it refers to either. I am using custom themes (Blackhead and Flagrant_alt from Crip, and Clear Sky from zutzu) but I am certain that it all installed properly. I am on SMF 2.0.3 and Bad Behavior 1.5.13.

Mods:
1.   6 Custom buttons / tabs with Sub Menus (4)    0.5     Thursday, 07 July, 2011, 04:42 PM
2.   Ad Managment    3.0.1     Thursday, 07 July, 2011, 05:46 PM
3.   Add And Remove Buttons    0.4     Thursday, 22 September, 2011, 03:12 PM
4.   Aeva Media    1.4w     Thursday, 07 July, 2011, 03:13 PM
5.   AJAX Recent Topics    1.1     Sunday, 11 September, 2011, 03:09 PM
6.   Align text with Smiley    1.2     Thursday, 17 November, 2011, 02:01 PM
7.   Apache Error Handler    1.2     Wednesday, 16 November, 2011, 10:43 PM
8.   Bad Behavior mod    1.5.13     Friday, 30 November, 2012, 11:17 AM
9.   BlogBridger    1.1.4     Monday, 27 February, 2012, 03:22 PM
10.   Board Notices    1.0.2     Friday, 19 October, 2012, 01:11 PM
11.   Bookmarks    2.3     Wednesday, 31 August, 2011, 10:23 PM
12.   Button 1 Menu Extender for 6 custom buttons mod    1.0     Thursday, 22 September, 2011, 02:43 PM
13.   Contact Page    3.0     Wednesday, 07 December, 2011, 01:05 PM
14.   Country Flags    1.1.2     Friday, 16 September, 2011, 10:25 PM
15.   Custom Copyright    1.0.2     Friday, 16 September, 2011, 10:19 PM
16.   Custom Pages and Tabs (2) SMF 2 - RC3    1.1     Saturday, 29 October, 2011, 04:49 PM
17.   Custom_Top_menu    1.4     Monday, 05 December, 2011, 11:53 AM
18.   Default Avatar    2.2     Thursday, 17 November, 2011, 02:15 PM
19.   Downloads System    1.4.1     Sunday, 04 December, 2011, 12:27 PM
20.   Email Template Editor    1.0     Friday, 20 January, 2012, 10:21 AM
21.   FAQ Mod    1.2     Thursday, 28 June, 2012, 10:11 AM
22.   Footer Menu v.1    v.1     Monday, 26 September, 2011, 10:45 PM
23.   Google +1    1.0     Thursday, 17 November, 2011, 02:22 PM
24.   Google Analytics Code    1.4     Monday, 03 October, 2011, 04:50 PM
25.   Ignore Board In New Posts    1.0     Tuesday, 27 September, 2011, 08:54 AM
26.   InLine Attachments    1.11     Thursday, 17 November, 2011, 02:31 PM
27.   JumpToSelectBoard By Smfsimple.com    V1     Friday, 02 September, 2011, 04:58 PM
28.   New Layout for Last Post Info    1.5     Thursday, 17 November, 2011, 03:03 PM
29.   New Manual Look    1.1     Thursday, 07 July, 2011, 04:49 PM
30.   New Topic Button By Smfsimple.com    V1     Thursday, 07 July, 2011, 05:04 PM
31.   Next Post Level    1.3.3     Wednesday, 31 August, 2011, 11:23 PM
32.   PM to New Members    1.2     Saturday, 03 September, 2011, 03:29 PM
33.   Post_Board_Select    1.3     Thursday, 07 July, 2011, 05:05 PM
34.   Prevent Adding Signature Images And Links    2.0     Tuesday, 06 March, 2012, 04:10 PM
35.   Profile Statuses    3.1     Friday, 02 September, 2011, 12:23 PM
36.   Project Snow 1.1    1.1     Tuesday, 22 November, 2011, 10:03 AM
37.   Random News Fader    1.0     Thursday, 07 July, 2011, 04:51 PM
38.   Recent Topics On "Recent Posts" Page    1.2     Friday, 16 September, 2011, 10:17 PM
39.   Recent Topics On Board Index    1.03     Thursday, 07 July, 2011, 04:52 PM
40.   Reply Button in All Posts    1.1     Sunday, 04 September, 2011, 11:09 AM
41.   RSS Feed Icon    1.1     Thursday, 07 July, 2011, 03:09 PM
42.   RSS Feeder    1.1.5     Saturday, 03 December, 2011, 02:14 PM
43.   SA Affiliates    3.3.5.6     Thursday, 07 July, 2011, 10:44 PM
44.   SA Chat    RC1 Rev59     Sunday, 16 September, 2012, 03:17 PM
45.   SA Facebook    2.0 RC3-1 Rev56     Saturday, 17 March, 2012, 03:45 PM
46.   SA Twitter    0.6 REV 30     Monday, 28 May, 2012, 03:20 PM
47.   Separate Replies and Views Column    1.9     Thursday, 07 July, 2011, 09:07 PM
48.   Separated Birthdays from Events    1.1.7     Thursday, 07 July, 2011, 04:57 PM
49.   Signature Option Post    1.1.1     Thursday, 28 June, 2012, 10:32 AM
50.   Simple Twitter    1.2     Thursday, 28 June, 2012, 10:40 AM
51.   SimplePortal    2.3.5     Thursday, 14 June, 2012, 03:32 PM
52.   Sitemap    2.2.0     Sunday, 20 November, 2011, 10:05 PM
53.   Smart Pagination    0.8     Wednesday, 16 November, 2011, 11:22 PM
54.   SMF 1.0.20 / 1.1.12 Update    1.0
55.   SMF 1.0.21 / 1.1.13 Update    1.0
56.   SMF 1.1.14 Update    1.0
57.   SMF 2.0.1 Update    1.0     Thursday, 22 September, 2011, 08:44 AM
58.   SMF 2.0.2 Update    1.0     Tuesday, 27 December, 2011, 11:20 AM
59.   SMF 2.0.3 Update    1.0     Friday, 21 December, 2012, 09:25 AM
60.   Socialize    1.8     Thursday, 17 November, 2011, 01:38 PM
61.   Sortable Packages (and Installed Time)    1.3     Wednesday, 09 November, 2011, 09:51 PM
62.   Stop Spammer    2.3.9     Tuesday, 25 October, 2011, 09:42 PM
63.   SubAccounts Mod    1.0.1     Thursday, 17 November, 2011, 03:20 PM
64.   Tabbed smileys    0.3.99b     Friday, 02 September, 2011, 03:37 PM
65.   Tapatalk SMF 2.0 RC4/RC5/Final Plugin    3.0.2     Sunday, 10 June, 2012, 10:03 PM
66.   Topics Filter    3.2     Wednesday, 28 September, 2011, 02:11 PM
67.   TopicStarter Mod    1.6     Wednesday, 05 October, 2011, 09:13 AM
68.   User Control Panel By Alan S    2.2     Thursday, 22 September, 2011, 09:28 PM
69.   Users Online Today    2.0     Friday, 16 September, 2011, 10:11 PM
70.   VB Style Board Index    1.91     Saturday, 17 September, 2011, 11:57 AM
71.   VigLink    1.3     Wednesday, 05 October, 2011, 09:40 AM
72.   Welcome Topic Mod    2.1     Thursday, 07 July, 2011, 09:11 PM
73.   Word Count Limits    1.3b     Thursday, 18 October, 2012, 11:19 PM

I hope somebody out there can help!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 11, 2013, 07:15:04 AM
Can you up upgrade to Bad Behavior 1.5.15?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: awolexpat on January 13, 2013, 06:04:24 AM
Hi,
OK I have done that and will report back either way - hopefully this will fix it though.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 13, 2013, 09:05:36 AM
If you have issues again try the attached beta file.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: awolexpat on January 15, 2013, 06:26:12 AM
I have just checked again and I have had 17 of the same error since Sunday, so the updated version did not fix it for me. I will now try the beta file you have suggested, thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: awolexpat on January 17, 2013, 10:20:27 AM
Hi again,
The beta file has not fixed the issue either I am afraid - I have had 16 more errors in the log since yesterday.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 17, 2013, 09:03:35 PM
If so the line in the error log changed.  PLease post it.  Then I can look at the next option.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: awolexpat on January 17, 2013, 11:27:13 PM
Hi,
Yes it had and I didn't notice it! here it is:
Quote
http://www.awolonline.net/forum/index.php?action=register2
8: Array to string conversion
File: /home3/awolonl1/public_html/forum/Sources/BadBehavior-mysql.php
Line: 220
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 18, 2013, 07:16:24 AM
That line should not get that error.  Either you did not install the attachment or you need to flush your cache.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: T3CHN0 on January 18, 2013, 11:31:31 AM
This didn't work

Code: [Select]
<p><a href="http://www.bad-behavior.ioerror.us/">
<img src="http://www.yoursite.com/bad-behavior-80x15.png"
alt="Bad Behavior" height="15" width="80" /></a></p>>

So I changed it to


Code: [Select]
<p><a href="http://bad-behavior.ioerror.us/">
<img src="http://webmasters.winnfreenet.com/images/bad-behavior-80x15.png"
alt="Bad Behavior" height="15" width="80" /></a></p>>

And now it works

Just letting you know
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 18, 2013, 08:06:44 PM
FYI- That is not part of the mod.  That is manual install option from the mod page.

You are supposed to copy the image to your site and replace the link in "http://www.yoursite.com/bad-behavior-80x15.png" with the link to the image file your site.

Using someone else's site is a security issue.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: T3CHN0 on January 18, 2013, 10:02:50 PM
FYI- That is not part of the mod.  That is manual install option from the mod page.

You are supposed to copy the image to your site and replace the link in "http://www.yoursite.com/bad-behavior-80x15.png (http://www.yoursite.com/bad-behavior-80x15.png)" with the link to the image file your site.

Using someone else's site is a security issue.

Yeah that's ok & I understand that thanks, I was pointing out this link
<p><a href="http://www.bad-behavior.ioerror.us/"> does not work, but remove the www and then it does work
I don't know why!
But wouldn't you rather add a link for spammers that works.

I was only pointing out the link, it don't really matter. I changed mine but you need not change it at all.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: awolexpat on January 19, 2013, 12:19:06 AM
That line should not get that error.  Either you did not install the attachment or you need to flush your cache.

I can assure you that I did install the attachment. I have now emptied the file cache, which is what I assume you meant by 'flush your cache'? I have also deleted the existing errors from the log and will report back if any more appear.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 19, 2013, 12:36:32 PM
The code that originally caused the error is not on line 220 anymore.  So if you saw an error with the new code the line number will change.  You may have a server permission issue so check to see if the file actually changed.  Then clean your Cloudflare (if you have), Forum and Server cache.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 19, 2013, 12:41:13 PM
But wouldn't you rather add a link for spammers that works.

Thank you.  It will be included in the next release.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: awolexpat on January 21, 2013, 05:57:41 AM
I think it must have been Cloudflare causing the later issue as over 24 hours now and no further evidence of an error of any description. Thank you butchs.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 21, 2013, 07:00:25 AM
Your welcome.

With CloudFlare you need to log in and purge the cache (http://blog.cloudflare.com/introducing-the-cloudflare-cache-purge-featur) whenever you make a change to your site.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Blade_Runner on January 21, 2013, 10:21:01 PM
I am getting the following error. How can I fix it?

-----------------------------------------
http://talkcarmod.com/forum/index.php?action=admin;area=modsettings;sa=googletagged;fdbebdca608=4802294707854f9754919fbf066d9d6c
8: Undefined index: googletagged_together
File: /var/www/vhosts/talkcarmod.com/httpdocs/forum/Themes/default/languages/BadBehavior_bbc.english.php (ShowGoogleTaggedAdmin sub template - eval?)
Line: 205
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on January 21, 2013, 11:55:22 PM
turn off eval first of all...   then you'll have an idea where the real proble is...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Blade_Runner on January 22, 2013, 12:33:58 AM
turn off eval first of all...   then you'll have an idea where the real proble is...

thxs for the advice. once i turn off eval, i get the following error when i clicked on googletagged in admin modification setting.
---------------------------------------
http://talkcarmod.com/forum/index.php?action=admin;area=modsettings;sa=googletagged;fdbebdca608=4802294707854f9754919fbf066d9d6c
8: Undefined index: googletagged_together
File: /var/www/vhosts/talkcarmod.com/httpdocs/forum/Themes/default/GoogleTagged.template.php
Line: 205
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on January 22, 2013, 01:45:59 AM
right... and, as expected from the original error - the problem is not in this mod... it's with whatever mod is called "googletagged". So, your best bet it to bring it up in that mod's support thread. :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Blade_Runner on January 22, 2013, 01:56:03 AM
right... and, as expected from the original error - the problem is not in this mod... it's with whatever mod is called "googletagged". So, your best bet it to bring it up in that mod's support thread. :)

Thank you for your reply. I will bring it up to the correct thread.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: awolexpat on January 23, 2013, 11:00:39 AM
butchs,
I think I spoke too soon - my error had started appearing again, just that I didn't see it.  Exactly the same as before, same line too. To be on the safe side I had reuploaded the replacement file you gave me and then cleared the file cache and the Cloudflare one. The only thing I didn't do was the server cache because I don't have server caching turned on in my SMF. Does anyone have any further suggestions?
To save you looking back in the thread the error is:
Quote
http://www.awolonline.net/forum/index.php?action=register2
8: Array to string conversion
File: /home3/awolonl1/public_html/forum/Sources/BadBehavior-mysql.php
Line: 220

and refers to this bit of code:
Code: [Select]
218: if (!strcasecmp($request_method, "POST")  && (!empty($package['request_entity']))) {
219: foreach ($package['request_entity'] as $h => $v) {
==>220: $request_entity .= $h . ": " .$v . "\n\r";
221: }

I also checked against the replacement file you gave me and this is the code on those lines. I also used a comparison program (DiffMerge) and I can see the changes you have made so I know that the revised file is the one being used.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Jerri Blank on January 23, 2013, 11:04:16 AM
I installed this mod and had some trouble getting it working (non-standard theme, I think), so I have uninstalled it for now.

The problem is that all the pages of my forum have this at the top:

Code: [Select]
$txt['HPlocation'] = 'Project Honey Pot (all regions)';
Can someone tell me how to get rid of that?  Wasn't the uninstall supposed to reverse changes to PHP files?

Thanks!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on January 23, 2013, 11:58:41 AM
try using search? This has been answered dozens of times...

What happened is that you installed a mod which added text strings to your modifications.english.php file AFTER the closing ?> in the php file.
(not this one, mind you, this one does it correctly, so some other mod did the bad thing)

All you have to do is to find the ?> in that file and move it to the very end of the file
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Jerri Blank on January 23, 2013, 05:49:59 PM
Thanks for the info.

By the by, I tried searching the forum AND using a Google site search, using all or part of this stray string as my search term.  No luck either way.  I'm not a noob.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 23, 2013, 08:05:25 PM
I also checked against the replacement file you gave me and this is the code on those lines. I also used a comparison program (DiffMerge) and I can see the changes you have made so I know that the revised file is the one being used.


Since it is unlikely the key is an array the $v must be the array?  This should not happen since the core converts the array into a string.  Could be a new php version bug in the core or a new bot trick?  I have no plans to edit the core unless there is a gun to my head so try this...

Change...
Code: [Select]
$request_entity .= $h . ": " .$v . "\n\r";
To:
Code: [Select]
if (is_array($v)) break;
$request_entity .= $h . ": " .$v . "\n\r";

Then reset your claoudflare cache.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: awolexpat on January 26, 2013, 12:13:12 AM
It's a couple of days now and no reappearance of the error so that seems to have finally fixed it - thank you once again!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Chalky on January 27, 2013, 06:15:59 AM
I have searched the topic but can't find the answer.  I have BB version 1.5.11 installed and want to update to the latest version.  What's the best way to update?  Should I uninstall the previous version first then install the latest version afresh?  I'm nervous because I had to make a lot of manual edits to install this mod in the first place.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: NanoSector on January 27, 2013, 06:54:00 AM
Try uninstalling. If you see a checkbox saying delete data associated, leave it unchecked (should keep the settings). If not, note down any settings or take a screenshot (Evernote and LightShot ftw?).
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 27, 2013, 09:51:34 AM
UPGRADING FROM AN OLDER VERSION HELP

I have searched the topic but can't find the answer.  I have BB version 1.5.11 installed and want to update to the latest version.  What's the best way to update?  Should I uninstall the previous version first then install the latest version afresh?  I'm nervous because I had to make a lot of manual edits to install this mod in the first place.

Try uninstalling. If you see a checkbox saying delete data associated, leave it unchecked (should keep the settings). If not, note down any settings or take a screenshot (Evernote and LightShot ftw?).

That is correct. :)

For versions  1.5.9 and older it is recommended to print the "whitelist.ini" file in the bad "Sources/bad-behavior" folder and transfer the data to the Mod's admin page.  Versions 1.5.10 and newer store the associated data for the settings in the forums database.  The ini files are no longer required.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on January 27, 2013, 10:04:39 AM
Unless core SMF code is further changed (and most of these updated just change the BB code in the BB specific files), what I usually do is just replace the mod specific files in the sources, sources subdirectory and the template files in the themes/default directory
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Chalky on January 27, 2013, 02:37:28 PM
Cool, thanks guys, I'll give it a go  :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: meylodie on February 14, 2013, 06:48:23 PM
Hello,

I am running SMF 2.0.4 and installed Bad Behavior a few days ago. It has prevented 11 attacks in 7 days, according to the stats. I have been browsing the admin entries related to it and while doing that I have been invited to see the latest available version on the Bad behavior main site:
http://bad-behavior.ioerror.us/2012/12/10/bad-behavior-2-2-13

Quote
Bad Behavior 2.2.13 has been released. This is a maintenance release and is recommended for all users.

Quote
Changes
The following changes have been made since 2.2.12:

    Requests from the Baidu search engine now go through screening similar to Google and other major search engines. This will help to prevent illegitimate access from clients which falsely claim to be the Baidu search engine. A logic error which prevented these checks from ever running has been fixed.

The version of the MOD has for number 1.1.15 : wouldn't it be good to get an update for it ?

Thank you,
Mélodie


Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 14, 2013, 07:20:59 PM
If you look at the mod page (http://custom.simplemachines.org/mods/index.php?mod=2502).  You will find that as of  December 13, 2012 Bad Behavior for SMF mod version 1.5.15 includes Bad Behavior core version 2.2.13 plus all that wonderful stuff, and then some, I programmed to make it work on SMF.  You can verify the core version by looking at the ABOUT menu in the Bad Behavior Admin section in your forum.
 :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: meylodie on February 14, 2013, 07:58:08 PM
Oh yes! I feel very bad suddenly...  ???

Thank you very much for your so fast response. :)

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: RustyBarnacle on February 28, 2013, 06:20:05 PM
I have a random white bar appear at the top of my page and another user helped me notice that it usually happens when I have this at the top of my page:

removed.

Do you know why that might be?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on February 28, 2013, 07:32:12 PM
Those are among the 20 different automatic random "Google safe" scattered honeypot spam traps (http://simplemachines.org…index.php?topic=375980.msg3085297;topicseen#msg3085297).  A spam bot will click on them to get a free listing at project honeypot.
 
Select "Limit honeypot on forum" for less dramatic honeypots.

Oh yea, you shouldn't post the link to your honeypot spam trap.  Please edit your last post.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: RustyBarnacle on March 01, 2013, 01:05:42 PM
I think I've got it.  It only happens during case5

case 5:
         return '<a href="'. $modSettings['badbehavior_httpbl_link'] .'">&#020</a>';

So I replaced it with the same code that was under case 6 and I believe the problem has gone away.

This is why it was so random.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on March 02, 2013, 02:42:19 PM
Which browser were you using when you noticed it?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: RustyBarnacle on March 07, 2013, 03:00:45 PM
Firefox

My site is www.tallingroth.ca if you want to take a look but I've got it sorted now.  There were smaller white bars for all the case options that had a height of 1 so I changed all of those to height of 0 as well.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: bigdy on March 26, 2013, 03:38:51 AM
I was using 1.5.13 but then upgraded to 1.5.15. 

After upgrading the plugin setting page is now displaying incorrectly.  All of the help text is above the settings page.... like it's the first thing on the line:

Code: [Select]
// Bad Behavior Start $helptxt['enable_badbehavior'] = 'The badbehavior module examines HTTP requests of visits to your web site, and any suspicious requests are logged for later review. The suspicious visit is shown an error page with instructions on how to view the site without triggering the bad behavior error message.'; $helptxt['badbehavior_verbose'] = 'Enables or disables verbose logging which includes all requests, not just failed ones. This will log ALL activity to your forum, including all permitted valid activity.

Using verbose mode is not recommended as it can significantly slow down your site; it exists to capture data from live spammers which are not being blocked. You probably want to disable verbose, since it will create a HUGE db table in a short amount of time.'; $helptxt['badbehavior_logging'] = 'Normal HTTP request logging.

Only blocked requests and a few suspicious (but permitted) requests are blocked and logged.

Disabling this feature can improve site performance on high traffic sites but may result in additional spam.

There is a "Scheduled Task" that Deletes Old Bad Behavior Log Entries greater than seven(7) days. The Scheduled Task can be adjusted. It is recommended that the old entries are deleted to protect the privacy of your members and Bad Behavior may uses the logs to detect spammers.'; $helptxt['badbehavior_strict'] = 'Strict Checking blocks more spam but may block some people.


In continues on and on until:
Code: [Select]
WARNING: Inappropriate whitelisting WILL expose you to spam, or cause Bad Behavior to stop functioning entirely! DO NOT WHITELIST unless you are 100% CERTAIN that you should.'; $helptxt['badbehavior_useragent'] = 'User agent strings to be whitelisted. Exact match only. (one per line)

Example "Mozilla/4.0 (It\'s me, let me in)"

WARNING: Inappropriate whitelisting WILL expose you to spam, or cause Bad Behavior to stop functioning entirely! DO NOT WHITELIST unless you are 100% CERTAIN that you should.'; // Bad Behavior End

I tried to uninstall the new version and revert back but to no avail. Thoughts / suggestions?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on March 26, 2013, 07:14:24 AM
Installation is incorrect.  Read this link (http://www.simplemachines.org/community/index.php?topic=375980.msg3274097;topicseen#msg3274097).

This is due to another mod not placing ?> in the correct location.  You will need to find it and manually fix it.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: bigdy on March 26, 2013, 06:52:01 PM
Installation is incorrect.  Read this link (http://www.simplemachines.org/community/index.php?topic=375980.msg3274097;topicseen#msg3274097).

This is due to another mod not placing ?> in the correct location.  You will need to find it and manually fix it.

Dang it... I hate when the exact question has already been asked / answered in the thread.  I actually searched google for
Quote
// Bad Behavior Start $helptxt['enable_badbehavior'] = 'The badbehavior module examines HTTP requests of
but it didn't return any results. 

I do thank you for the help. Will be sending a $10.49 donation through in the next day or so.

Exact Steps To Fix (for my install):

Find the language file in use.  I just clicked 'uninstall' and then made note of the modified files in the language section.  The file turned out to be: /Themes/default/languages/Help.english.php

Find the closing  ?> then cut and paste it into the very last line ensuring there are no white spaces before or after.


THANKS AGAIN FOR YOU HELP


Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: winterband on April 02, 2013, 11:56:30 AM
Did nothing on our site to slow down spammers registering.  Removed it.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 02, 2013, 02:40:04 PM
then maybe you didn't actually activate it with a honeypot? It works perfectly for me - several thousand spammers blocked
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on April 12, 2013, 12:27:25 AM
If anyone doubts whether the mod actually works or not.

These are the stats on my forum which at this time is 11 days old.

Quote
Bad Behavior has blocked 436 access attempts in the last 7 days.

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: overscan on April 12, 2013, 07:20:50 AM


Bad Behavior has blocked 12604 access attempts in the last 7 days.


My forum is 8 years old however :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: RustyBarnacle on April 15, 2013, 03:17:13 PM
Mine is 4 months old and I'm usually between 300-600 attempts blocked in last 7 days.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: toastedone on April 18, 2013, 09:57:19 AM
Anybody able to help a newb set this up
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 18, 2013, 10:00:27 AM
it is pretty self explanatory. :)   What are you having problems with?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: toastedone on April 18, 2013, 10:01:12 AM
Ok well I have installed it, do i not need a key?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 18, 2013, 10:03:25 AM
if you want the httpBL/honeypot part activated, yes...   head over to project honeypot and follow their instructions to get an API key
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: toastedone on April 18, 2013, 10:04:32 AM
Other than that I should just install it and enable it?

Should it not show stats in the footer?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 18, 2013, 10:19:50 AM
it shows stats in the footer if you turn on "display stats"
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: toastedone on April 18, 2013, 10:26:29 AM
yep that is turned on but nothing is showing in the footer
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 18, 2013, 10:30:20 AM
did the changes get applied to your custom theme's index.template.php?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: toastedone on April 18, 2013, 10:34:11 AM
How would i know?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 18, 2013, 10:37:29 AM
open the file in a text editor (notepad++ or ConText)
down near the theme_copyright line, there should be code for bad behavior
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: toastedone on April 18, 2013, 10:45:19 AM
No i see no code there
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 18, 2013, 10:47:48 AM
then it looks like it never got applied to your theme template files.... (and without the bad behavior stuff in the header, it won't work right, either)

When you installed, did you
a) get any file errors listed?
b) check the boxes for applying the mod into additional themes?
c) Add a new theme after you installed the mod?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: toastedone on April 18, 2013, 10:51:27 AM
To be honest I do not remember, should I uninstall and reinstall? Also I know this will sound stupid but I am getting a lit if people register and not comment but they add a signature, is this the sort of thing bad behavior combats?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 18, 2013, 10:53:58 AM
bad behvaior attempts to stop them before they register at all.

You can stop the signature stuff by turning on the dney option and turning on post-count-based groups and setting the newbiew membergroup to DENY permissions to add a signature

you can try uninstalling and reinistalling. Just make sure there are no errors in either case
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: toastedone on April 18, 2013, 10:58:39 AM
How does it tell if it is a spammer or a real person at sign up?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 18, 2013, 11:04:15 AM
http://bad-behavior.ioerror.us/about/
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: toastedone on April 18, 2013, 02:27:46 PM
Many thanks for your help, I have sorted this now :D
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on April 18, 2013, 06:30:23 PM
There is a bunch of help stuff on the first post of this thread too.
:)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: toastedone on April 19, 2013, 07:40:42 AM
On my forum I have set up capatcha and questions, email verifiactaion, no signature until a member has posted 10 posts and badbehaviour mod. I am getting so many new registrations a day were they join, do not post and vanish.

Is there any more I can do to prevent this?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: xrunner on April 19, 2013, 07:44:10 AM
On my forum I have set up capatcha and questions, email verifiactaion, no signature until a member has posted 10 posts and badbehaviour mod. I am getting so many new registrations a day were they join, do not post and vanish.

Is there any more I can do to prevent this?

You've done all that and they're still joining and leaving? What's the question you are using?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 19, 2013, 07:48:41 AM
this is not the topic for general spam discussion... unless it has to do with the bad behavior mod please take the questions to general support.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: toastedone on April 19, 2013, 07:50:17 AM
Yes i Have email verification, capatcha, and questions and bad behaviour

the questions are simple

1+8=

7x2=

9-3=
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: toastedone on April 19, 2013, 07:51:32 AM
this is not the topic for general spam discussion... unless it has to do with the bad behavior mod please take the questions to general support.

Apologies
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on May 04, 2013, 12:50:30 PM
New version 1.5.16:

SMF changes:
 1) Reviewed and Updated mysql code.
 2) Honeypot link height issued fixed thanks to RustyBarnacle.
 3) Upgrade to 2.2.14 core.
 4) Updated httpBL search engine list to 2013 standards.

Core Changes:
 1) An additional exploit scanner has been identified and blocked.
 2) A small change has been made to accommodate a change made by Firefox to its User-Agent format, to ensure that Firefox 25 (which doesn’t yet exist) is not improperly blocked.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: chrishicks on June 03, 2013, 08:29:17 AM
I'm hoping someone can point me in the right direction to fix a few issues I'm having. I have 1.1.18 with Cloudflare and was pointed to this after I moved servers and all of a sudden all IPs are now showing as CF IPs. Prior to the server move this only occurred in posts. Who's Online would show the real IP. I never had any mods installed for that purpose so I'm not sure what changed.

I installed this mod and had no errors. I did have to do a manual edit to a theme that is based off of the default so that should have gone OK. It shows as working and I have the blocked access attempts at the bottom of the forum and a connection to Honey Pot. I also have reverse proxy checked and have Cf-Connecting-Ip in the IP call box. Addresses box is left blank. I did a cache purge on CF but don't see a way to do that on 1.1.18 unless I'm just overlooking it(it's been a long time since I messed with it other than posting).

Now my issues are that I keep getting the following error in the logs:

Code: [Select]
Undefined variable: headers
File: /home/rejectsr/public_html/forum/Sources/BadBehavior-mysql.php
Line: 81

and line 81 is:

Code: [Select]
$headers = bb2_db_escape($headers);
The other is that all the IPs are still showing as from CF. Is it just that I need to give it more time for the IPs to start changing or is there something else that needs to be done? I keep getting random new spammer members and can't block them by IP as my entire site is operating on about 4 CF IPs at the moment. When I go to the Bad Behavior settings and view the logs real IPs show up however. Is there a way to actually get these to show on the actual forum?

And for the error in the SMF log, if I enable Bad Behavior the log just fills with that error. I had the mod enabled for one minute and ended up with 6 pages of errors. I have been looking over the coding and have yet to see anything wrong but I'm hoping I just keep overlooking something.

Can someone help me out with this by chance?

Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on June 03, 2013, 09:38:37 AM
why are you using cloudflare in the first place?
(hint: It does not actually provide any additional security for your server and - as you have noted - it causes problems with records.)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: chrishicks on June 03, 2013, 10:18:47 AM
Some bandwidth(on average I will/would save 2GB/month) and load reduction and it did do a decent job of reducing the spammers up until my forum was moved to another server. I would have a few slip by from time to time but since the new server change the it seems like that's not so anymore. It ran great for almost 2 years other than the CF IP showing up in posts which was never a bother since the real IPs were showing up everywhere else. Now CF IPs are everywhere and I can't figure out what has changed to make that happen. I even installed the Cloudflare.zip by Butchs found in another topic but even with that all IPs are still CF. Is it really that bad using Cloudflare these days? Back when I first started using it everyone else that used it seemed to love it. What's changed?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on June 05, 2013, 07:21:39 AM
Unrelated to this mod... I made a mod for cloudflare mod that still works. Its on the CF wiki and
here.
 (http://www.simplemachines.org/community/index.php?topic=391926.msg2726085#msg2726085)  I hope someone else will take over the CF mod.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: chrishicks on June 05, 2013, 09:55:13 AM
Unrelated to this mod... I made a mod for cloudflare mod that still works. Its on the CF wiki and
here.
 (http://www.simplemachines.org/community/index.php?topic=391926.msg2726085#msg2726085)  I hope someone else will take over the CF mod.

I actually installed that and it didn't work for me. Everywhere across my forum looks just like the image below.

http://i.imgur.com/lQnxb2k.png
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on June 05, 2013, 08:09:30 PM
Again this is not related to the Bad Behavior SMF mod and will give visitors the wrong impression. The cloudflare mod is mere copy of manual code provided by cloudflare.  The cloudflare mod only works on the default SMF theme.  Any other theme will require manual installation!  Please see cloudflare wiki on how to make it compatible with your theme via manual installation.

Bad Behavior SMF mod assumes you have cloudflare working properly with SMF before installing the Bad Behavior SMF mod.   O:)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: chrishicks on June 06, 2013, 12:51:19 PM
My current theme is just a css worked over version of the default theme. I'll double check to make sure if there are any edits that may not have taken just to be sure. How about the error I keep encountering when Bad Behavior is turned on?

I keep getting the following error in the logs:

Code: [Select]
Undefined variable: headers
File: /home/rejectsr/public_html/forum/Sources/BadBehavior-mysql.php
Line: 81

and line 81 is:

Code: [Select]
$headers = bb2_db_escape($headers);
If I turn on BB I can get 100's of this same error in minutes.

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on June 06, 2013, 01:52:19 PM

Code: [Select]
$headers = bb2_db_escape($headers);
ooo SMF 1.1.x... 

Try changing it to:
Code: [Select]
$http_headers = bb2_db_escape($http_headers);

My bad.   ???
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: chrishicks on June 07, 2013, 10:01:12 AM
Thanks butchs, that edit fixed it.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: radu81 on June 12, 2013, 08:27:57 AM
Hello and thanks for this great mod.
I installed in my forum and got a lot of attempts blocked. Ichecked those IP and are really spammers. My problem is that even testing from anothe pc with Firefox and the User Agent exension I always see
<!-- Bad Behavior 2.2.14 run time: 0.000 ms -->
Is that normal? Could someone do a test on my site? www.sharkracingclub.it
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on June 12, 2013, 01:28:15 PM
Radu81

Can you give a rough idea of where to look for this?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: radu81 on June 12, 2013, 05:01:54 PM
TESTING:
To insure that Bad Behavior is functioning correctly you can add the sting "Bad Behavior Test" to the User Agent (UA) of a HTTP request from someone who is not in the whitelist and is not the administrator.
  • Windows use FireFox with the [nofollow]"Modify Headers" (https://addons.mozilla.org/en-US/firefox/addon/967)[/nofollow] add-on.
  • Macintosh, [nofollow]"enable the Develop menu" (http://macs.about.com/od/usingyourmac/qt/safaridevelop.htm)[/nofollow] in Safari.

If you look at the page source (just below the title) you will see the speed of this mod at work:  <!-- Bad Behavior 2.x.xx run time: 3.025 ms -->
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: radu81 on June 12, 2013, 06:25:44 PM
It's all working now, I've entered a wrong value in the "Modify headers" addon for Firefox  :-[
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: chrishicks on June 14, 2013, 03:24:59 PM
Out of curiosity what kind of numbers do some of you see in regards to blocks? I'm just about a full 7 days in and so far I've seen almost 6200 blocks. Can this be a fairly normal number? I just want to be sure I'm not blocking more than I should be and checking out 500+ IPs would be insanely time consuming.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on June 14, 2013, 03:31:22 PM
you will get a large number to start with... and then progressively fewer hits as the bots drop you off their "to hit" list
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: radu81 on June 21, 2013, 06:45:45 PM
I'm about 1400-1500 /7days
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on June 21, 2013, 08:10:59 PM
I'm about 1400-1500 /7days

With that many hits I recommend using the "Cache Duration" feature.  Something like 15-45 seconds will help.  This feature will block a multiple bot strike the entire cache time setting with minimal processor effort.

Cache frees processor power for your members.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: radu81 on July 06, 2013, 05:08:23 PM
thank you butchs, I set the time cache to 30
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: live627 on July 31, 2013, 03:09:14 AM
The database value you're trying to insert does not exist: request_method
Function: bb2_insert
File: /home/livecom/public_html/livemods.net/Sources/BadBehavior-mysql.php
Line: 250

This is coming from a script run by crontab.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on July 31, 2013, 07:00:08 PM
The function is in the code for both versions of SMF.  "request_method" is defined in the latest version of the mod.  Check and verify the correct up-to-date latest version mod files are in the correct location as per "package-info.xml".  Be careful to include the default theme files if you have a non-standard theme.
 O:)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: live627 on July 31, 2013, 08:57:50 PM
I am not trying to install it. I've had it working for a year now. No errors. It does its job properly (with the exception of a cron job).
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 01, 2013, 07:30:14 PM
I know.

I went through that version of the code with a fine tooth comb a few mod versions ago and updated that section of the mod.  My guess is that your host upgraded something that is now conflicting with the core author's code or a bot is doing something new...  You can try upgrading the mod software to a version with the latest updates or try complaining to the bad behavior core author.  I tried the latter months ago and he tabled it for a future version.  I am reluctant to update the core authors code any more because he gets an attitude.  Here is the thread:

Quote from: Michael Hampton core author bad Behavior April 30, 2013
Issue #12 has been updated by Michael Hampton.
Target version set to 3.0

Issue #12 has been updated by Michael Hampton.
Tracker changed from Feature to Bug
Status changed from New to In Progress
Priority changed from Normal to Low
I have a pretty good idea what this is. PHP allows form inputs to contain [] brackets thus creating an entity value which is an array when the form is processed. This isn't very often used, though, it seems, as it's the first time I've heard of it being an issue. That said, I have a pretty good idea how to fix the code.

Quote from: butchas January 26, 2013
Bug #12: array to string conversion
Author: butchas
Status: In Progress
Priority: Low
Assignee:
Category:
Target version:
I had one user complain about an "Array to string conversion" errors from a bot when preparing to store the "request_entity" information into the data base. I could not reproduce the error. The code causing the error is from "bb2_insert" in "bad-behavior-mysql.php" is "$request_entity .= bb2_db_escape("$h: $v\n");"

I applied an band-aid to stop the errors by using "if (is_array($v)) break;" to bypass the error before the code in "bb2_insert" . The data stored in $package['request_entity'] from "core.inc.php" is storing the array causing the error. Not sure if this data should be an array.

Please look into the cause of the error.

If you wish to report the error to the core author you should report the error in the Bug Tracker.   If enough people complain then maybe, he will fix the code? :P

If the latest version still gets a error and the Core Author still refuses to fix the code I can try to make a filter.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: radu81 on August 02, 2013, 04:37:54 AM
I'm about 1400-1500 /7days

With that many hits I recommend using the "Cache Duration" feature.  Something like 15-45 seconds will help.  This feature will block a multiple bot strike the entire cache time setting with minimal processor effort.

Cache frees processor power for your members.


Thanks butchs, using the cache set to 30 I'm getting about 900 blocks in the last 7 days
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Jahsun on August 24, 2013, 01:37:45 PM
Thank you very much for your help. All seems well  8)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: agaida on November 05, 2013, 03:16:10 PM
Code: [Select]
Sources/bad-behavior/bad-behavior/blacklist.inc.php:            "Gecko/25",             // revisit this in 500 years
[2013.11.05 20:28] <agaida_> User-Agent: Mozilla/5.0 (Android; Tablet; rv:25.0) Gecko/25.0 Firefox/25.0 Accept:
[2013.11.05 20:28] <agaida_> tirili

The time is now, Firefox Android use this agent - please update BadBehavior with their current code.

their new line is now:
Code: [Select]
              "Gecko/2525",                // revisit this in 500 yearsin currend bad-behavior.2.2.14.zip

Thanks Alf

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Arantor on November 05, 2013, 03:40:42 PM
Funny, all the other FF 25 agents have Gecko/yymmdddd style, e.g. Gecko/20100101 and if you have Gecko/25, it might be suspicious like this mod blocks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: agaida on November 05, 2013, 04:09:05 PM
it blocks - and i have had a few very nice comments about that and a funny time to debuggig this  ;D
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Arantor on November 05, 2013, 04:35:46 PM
OK, so I just did some investigation.

As I said, the desktop browser behaves exactly as I called it, as evidenced by this from a fresh FF 25 install:
Code: [Select]
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0
For some reason, Mozilla have decided that just on mobile, they're going to use a different string as mentioned on https://developer.mozilla.org/en-US/docs/Gecko_user_agent_string_reference#Android

But just for fun, let's say we get Michael Hampton (the author of the original Bad Behaviour module for WordPress) to fix this, and it ends up downstream here, by the time that's done, FF25 will not be the current version anyway...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 05, 2013, 08:40:38 PM
I do not edit the core software unless I have to.  The core author is English and those Englishmen and Yanks do not always see eye to eye.   :o

You can contact the core author Michael Hampton (http://bad-behavior.ioerror.us/support/configuration/).  Good luck.

But alas, the SMF version code that I added to the core is the most feature packed rendition of BB for any platform.  If you want immediate gratification simply go to the "Bad Behavior Admin" and add "Gecko/2525" to "User Agent" under "Whitelist". 

I agree with Arantor on the worthiness of whitelisting the user agent.  :'(
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Arantor on November 05, 2013, 08:56:34 PM
You mean the Michael Hampton who lives in Iowa City, IA as per the domain registration on both homelandstupidity.us and ioerror.us? He is generally quite agreeable if you talk to him, he was more than willing to relicence BB when I asked him about it instead of it being pure GPL.

It's true, though, Englishmen and Americans do not often see eye to eye. The English are resentful of their former colony, if nothing else.

And is it really so bad that you and I agree on something for a change?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 06, 2013, 07:08:42 AM
Did he move or something?  Maybe I should call him when I get back to programming...  Email communication is not always the best.  Now it is not so long distance.

No, it is actually good we agree.  The simplest solution here is to do nothing or simply add it to the whitelist and remove it when the version changes.  The whitelist will give it a free pass before the core does it's thing.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on November 08, 2013, 12:31:35 PM
I have a user who seems to be able to log into my SMF2.0.6  forum, she can send message back and forth to me, but gets the blank white screen when she goes to post, the first time this happened i saw the entry in the denied logs, i grabbed her IP and whitelisted it... now shes still getting the white screen, but its not showing in the logs, i believe she has triied using Tapatalk, her own verizon phone browser, and her home browser, her IP never changes like some dynamic ip's do, no on else on my forum is having this issue

can you help me, if you need further info let me know, it seemed like the first time she got the kick trying to attach a jpeg picture to her post in the forum

i pmed her the log, and when i whitelisted her the log entry disapeared, ill have to wait and hope she stil has my pm with the original logs

EDIT :   here is the logs, i X'ed out some of her IP for security measures posting it here

118    108.34.XXX.XXX
Username: theCatWhoWalksThruWalls 2013-11-07 17:34:22 /deggi5/index.php?action=dlattach;attach=115;type=avatar DENIED
#17566707

thanks =)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 08, 2013, 08:36:25 PM
Code "17566707" is where an invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.

The mod does not give blank screen errors.  It gives error messages, logs each message.  Only does so for the cache duration.

Go to the first post and follow the instructions to test your installation.  If you get the error message then there is nothing wrong with the mod.  Chances are your hosts firewall is causing the blank screen.  She could have an infection or your host could be over zealous.

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on November 09, 2013, 01:40:40 PM
Update.  I went to your site and tested your BB Mod on both a Windows with the latest Firefox and a Machintosh with Safari.  I saw the following error message on both machines:
Quote
Error 403

We're sorry, but we could not fulfill your request for /deggi5/ on this server.

You do not have permission to access this server.

Your technical support key is: bla bla bla...

You can use this key to fix this problem yourself.

If you are unable to fix the problem yourself, please contact the WEBMA5TER and be sure to provide the technical support key shown above.

The mod appears to be working correctly.  I doubt it is my code.  I have learned to check all files for syntax errors before posting an update...

A white screen can also be a syntax error in php code generated by a change or another mod.  Maybe you need to make yourself a test regular user and see if you can duplicate the error by making a new post and etc.  If you duplicate it, you will need to track down the source.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on November 10, 2013, 06:00:00 PM
yeah i kinda figured it was on her end because no one else is getting an error, i use godaddy, who knows, i white listed all the groups, and it still didnt help., what did help weirdly enough was after i ticked the EU browser option thing, all of a sudden no more issues, which is weird because she is in massachusetts USA... who knows lol, it works now, and ive sworn by this mod everytime I use it

by the way, thank you for answering, too many mod guys here dont respond to there own mods, your one of the few stand up people around here

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mikedijital on November 10, 2013, 06:05:08 PM
Also just for your knowledge base because i did see concern it might be mods walking over each other, this is whats installed. but everything seems ok now, but for your notes

1.    SMF 2.0.5 Update    1.0    [ List Files ] [ Delete ]
2.    SMF 1.1.19 / 2.0.6 Update    1.0    [ Uninstall ] [ List Files ] [ Delete ]
3.    Tapatalk SMF 2.0 RC5/Final Plugin    3.9.0    [ Uninstall ] [ List Files ] [ Delete ]
4.    SMFPacks Shoutbox    1.0.4    [ Uninstall ] [ List Files ] [ Delete ]
5.    Set order for sticky topics    0.5    [ Uninstall ] [ List Files ] [ Delete ]
6.    YouTube BBCode    2.6    [ Uninstall ] [ List Files ] [ Delete ]
7.    Bad Behavior mod    1.5.17    [ Uninstall ] [ List Files ] [ Delete ]
8.    SMF Links    3.0.3    [ Uninstall ] [ List Files ] [ Delete ]
9.    Anti Bot: Are You Human/Bot?    3.0
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: aLaaa on December 02, 2013, 09:19:58 AM
Hello, for first thank you for all the hard work with BB.
I've some issues with SSI logins from frontpage, giving out the 403 error (and then preventing the login) when BB is enabled on SMF 2.0+, is there any way to fix it?

I already searched for a fix, but the workaround provided some months ago seems to work only on SMF 1.1

Cheers!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 02, 2013, 08:28:27 PM
I do not know what you are talking about.  This mod does not need a workaround!  It is impossible for me to read your mind.  You are not giving me enough information to determine what your problem is?  You need to be specific if you want help.

The mod generates 403 errors for bad visitors.  Please study the first post in this thread.

After you make changes you need to make sure you erase host, forum and/ or cloudflare cache.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: aLaaa on December 03, 2013, 04:45:59 AM
I do not know what you are talking about.  This mod does not need a workaround!  It is impossible for me to read your mind.  You are not giving me enough information to determine what your problem is?  You need to be specific if you want help.

The mod generates 403 errors for bad visitors.  Please study the first post in this thread.

After you make changes you need to make sure you erase host, forum and/ or cloudflare cache.

Basically my issue is that BB is giving out the 403 error to everyone who tries to login via SSI. Login via SMF works perfectly, just the SSI keeps giving out the 403. I Also tried enabling "Offsite Forms" with no luck. Cache already cleaned.

Forum is located at /forums and SSI used in all the top level pages. If you want to check it live, here is the website link: http://www.rcrncommunity.com/ (SSI is in the top right corner of every page).

Cheers!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 03, 2013, 07:44:44 PM
As with OpenId I would assume you need to enable "Offsite Forms" and "whitelist" the top level SSI page(s).  Do not forget to "whitelist" all your regular members as mentioned in the first post.  Then refresh ALL cache.

I tried to login and register with no issues (please delete user temp with the fake email).   If the above does not work then please PM me a temporary username/ password.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 30, 2014, 07:53:57 PM
New version posted today.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on January 31, 2014, 01:20:31 PM
New version posted today.

Installed on 2.0.7 no problem.

 ;)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Nicholaus on January 31, 2014, 01:42:20 PM
Well made theme.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TheListener on January 31, 2014, 01:43:45 PM
Well made theme.

Theme? Er ya mean mod?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: PhuriousGeorge on January 31, 2014, 02:05:44 PM
Well made theme.

Spam much?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Arantor on January 31, 2014, 02:08:25 PM
That's what we were thinking too. Fortunately, we have big pointed sticks to wield before the big hammers come out ;D
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Shambles on January 31, 2014, 02:15:28 PM
He needs some slack, unless his birthday post (http://www.simplemachines.org/community/index.php?topic=506772.msg3568845#msg3568845) was also spammy ;)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 31, 2014, 08:42:02 PM
Ha ha, thanks.  :)

Most of the work with the latest version besides the core update was the search engine DNS option by me.  This option automatically temporarily whitelists search engines "soft fail" who pass both IP CIDR and the reverse DNS test.  Search engines who do not pass the validation get further testing in the Bad Behavior core.  This years version was more difficult than previous years because search engines have become secretive.

The bots tested are Google, Bing, Yahoo and Baidu.  I do not intend to add others.  All data was checked though I did keep some old CIDR's that were originally in the core code that appeared to be obsolete to stay out of trouble.

The "soft fail" was requested by the core author several versions ago.  This mod can not support a hard fail for reverse DNS due to a issue with an old version of php. 

If you insist on "hard failing" the bots then you will have to edit the search engine inc code manually by commenting out the "soft fail" code and uncommenting the "hard fail" code.  One can use Yahoo's fail for Baidu.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Celia N. Foster on March 14, 2014, 12:39:11 AM
I get the error:


Fatal error: require_once() []: Failed opening required '/hermes/bosweb26b/b647/ipg.judithbarsicom/forum/Sources/bad-behavior/BadBehavior-SMF.php' (include_path='.:/usr/local/lib/php-5.2.17/lib/php') in /hermes/bosweb26b/b647/ipg.judithbarsicom/forum/index.php on line 205


How can this be fixed? Please help. Thanks!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on March 14, 2014, 07:31:44 AM
looks like the mod did not fully install
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Celia N. Foster on March 14, 2014, 05:14:43 PM
What exactly will fix the problem, then?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: margarett on March 14, 2014, 05:19:04 PM
To restore the missing files from the mod package, eg, via FTP ;)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Celia N. Foster on March 14, 2014, 05:22:04 PM
So, do I download the current mod package? Where do I upload the files to?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: margarett on March 14, 2014, 05:27:39 PM
You need to, at least, restore this "Sources/bad-behavior/BadBehavior-SMF.php"
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Celia N. Foster on March 14, 2014, 06:21:13 PM
Now I get the error: Fatal error: require_once() [function.require]: Failed opening required '/hermes/bosweb26b/b647/ipg.judithbarsicom/forum/Sources/bad-behavior/bad-behavior/core.inc.php' (include_path='.:/usr/local/lib/php-5.2.17/lib/php') in /hermes/bosweb26b/b647/ipg.judithbarsicom/forum/Sources/bad-behavior/BadBehavior-SMF.php on line 648
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: margarett on March 14, 2014, 06:50:38 PM
Next one's this: Sources/bad-behavior/bad-behavior/core.inc.php
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on March 14, 2014, 07:17:22 PM
You are going to need ALL of the files, until you do a good, manual uninstall
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Celia N. Foster on March 14, 2014, 09:20:30 PM
Where to I upload all the Bad Behavior package files to manually?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Storman™ on March 15, 2014, 06:44:19 AM
A manual install involves editing existing files as well as uploading some "Bad Behaviour" files. Are you aware of that ?

If so then go here:

http://custom.simplemachines.org/mods/index.php?mod=2502

Where it says "Download this mod" (top right of page) find your SMF version from the dropdown and click on parse. It will then take you to another page that lists the file edits required. At the bottom of the page is a list of where the bad behaviour files need to be uploaded to.

 ;)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Celia N. Foster on March 15, 2014, 02:09:24 PM
Yes, I am aware of that, at least. Okay, here goes nothing.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Celia N. Foster on March 15, 2014, 04:56:51 PM
Got it! Thanks! :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: ColinM9991 on April 28, 2014, 09:08:27 AM
I have installed this on my forum and all works just fine, however; every few refreshes it shows a number 2 on the top left which is hyperlinked to my Honeypot Link, the 2 is added via Unicode

Is it safe to remove the "&#x0032" from the Source Code in "BadBehavior-SMF.php" to stop this from happening?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on April 30, 2014, 10:40:44 AM
The codes are google safe spam traps (http://www.simplemachines.org/community/index.php?topic=375980.msg3499684;topicseen#msg3499684) to catch spammers.  Chances are if you remove just "&#x0032" something else will show up that you will not like.  If you check "Limit honeypot on forum", the mod will stop making spam traps and code will go away.

Or you can try (EDIT):
Search Bad-Behavior-SMF.php for:
Code: [Select]
'<a href="'. $modSettings['badbehavior_httpbl_link'] .'">&#032</a>'
replace with:
Code: [Select]
'<a href="'. $modSettings['badbehavior_httpbl_link'] .'">&#160</a>'
and search:
Code: [Select]
'<a href="'. $modSettings['badbehavior_httpbl_link'] .'">&#x0032</a>'
replace with:
Code: [Select]
'<a href="'. $modSettings['badbehavior_httpbl_link'] .'">&#x00A0</a>'
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: rajeshvv on June 13, 2014, 07:50:01 AM
Installed this mod working like charm when we enabled the cloudflare and reverse proxy settings in mod.. after disabling the clouflare account from my server, I just disabled the reverse proxy settings in the mod... all of sudden its stopped showing IP address for members in forums.

Before its showing IP address, after disabling this reverse proxy IP's showing empty in members (Awaiting approval) page.

Any clue to fix to show IP address?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on June 13, 2014, 09:14:26 PM
Installed this mod working like charm when we enabled the cloudflare and reverse proxy settings in mod..  all of sudden its stopped showing IP address for members in forums.

Any clue to fix to show IP address?

Perhaps you either installed the cloudflare mod or performed a manual cloudflare installation and forgot to uninstall it after you disabled cloudflare.

Disabling revers proxy and deleting Cf-Connecting-Ip in the mod tells the mod to use different header information to obtain the IP address.  The mod does not and I repeat have anything to do with IP addresses shown by SMF outside of the mod's logs.

The mod gets and uses its own IP address.  The mod does not share IP address information with SMF!  The "0.0.0.0" you see for members is caused by something else.

 
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TKG26 on July 06, 2014, 09:21:59 PM
Noon alert....

Wanted to see if i have done things correctly.
I have wordpress site and a smf forum.

I successfully installed bad behavior mod.
-completed honeypot setup
-honeypot script is installed to the root of my public_html
-added some links to some pages per step 4 of honeypot instructions
-honeypot shows honeypot active
-mod settings in smf shows : Bad Behavior has blocked 128 access attempts in the last 7 days.
Project Honey Pot is online.


Was it really that easy?

my forum is located at www.mysite.com/forum i was not sure if i was supposed to install script at /forum but it seems to work at mysite.com

mysite is not my real site :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on July 07, 2014, 09:02:09 AM
Yes.  It is that easy.

It may or may not protect wordpress.  You can test it by adding "Bad Behavior Test" to your user-agent, then directly accessing wordpress.  If you are not blocked then you will need to add Bad Behavior to wordpress or try using SMF's SSI (I think it will work but I am not sure - search this forum for more info).
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on July 07, 2014, 11:31:43 AM
it possibly will not, because, IIRC, wordpress actually has a variable name conflict with SMF...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TKG26 on July 08, 2014, 08:17:26 PM
Wordpress is not an issue for me. I disabled comments.

so far so good, it after 2 days "Bad Behavior has blocked 526 access attempts in the last 7 days."
2
I have dropped from having to manually reject 30 bot registrations a day to 3 and today just 1. And holy cow i managed to get 2 actual members signed up..

Now under manage members i only have: View all members/Search for members/Awaiting Approval.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TKG26 on July 28, 2014, 09:47:09 PM
I am wondering if i have things setup correctly.

Can anyone confirm?

www.rcottawa.com   *****honeypot script is installed here****
www.rcottawa.com/forum
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on July 29, 2014, 07:02:14 PM
You can confirm yourself.  Check out testing under the first post in this thread.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TKG26 on August 10, 2014, 05:55:52 PM
I cannot figure out what am supposed to do with that test.  Any noob instructions for that?

Im still getting loads of bots registering daily.. 20-30 a day. I manually approve all users.

The mod is doing something thats for sure:
Quote
Bad Behavior has blocked 1927 access attempts in the last 7 days.
Project Honey Pot is online.

Could i have some settings set wrong?

Thanks in advance
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on August 10, 2014, 08:15:41 PM
Well,   for one, you need multiple layers to prevent spam registrations.

You really need to add "questions" using the standard SMF 2.0.x questions feature
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TKG26 on August 11, 2014, 10:46:19 AM
I have added questions. Although very easy questions. Ill try new harder questions.

Thanks
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on August 11, 2014, 07:29:52 PM
I tested it and it appears to be working.  Maybe you should up your "Cache Duration to at least 20-45 sec.

I notice that you are running SMF 2.0.2.  You should upgrade to the latest SMF version.  That old SMF version attracts bad elements.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TKG26 on August 12, 2014, 11:55:54 AM
Thank you ill change that time. And possibly do tye update.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TKG26 on August 13, 2014, 11:56:48 PM
Update.
Changed cache time from 20 to 40 seconds
Changed registration questions to be harder. no number related questions

I only had one bot slip through... thats pretty good. Dont mind deleting one a day
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Bigguy on August 14, 2014, 12:22:52 AM
You should really do the update to the latest version of SMF. The older versions of SMF are not reliable security wise.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TKG26 on August 14, 2014, 08:04:02 PM
ill look into it... ill end up on another thread for this one... i took over hosting my site from a friends server moved to my own service.... the auto update doesn't work as the server transfer to not go 100% smoothly. so ill have to manually update wich scares me.. :)
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TKG26 on October 03, 2014, 07:15:23 PM
Update.
Changed cache time from 20 to 40 seconds
Changed registration questions to be harder. no number related questions

I only had one bot slip through... thats pretty good. Dont mind deleting one a day

UPDATE:
Updated to the latest SMF

I may get one bot a week slip through thats it...... I may switch back to "Member Activation". I have been manually approving( Member Approval) members for over a year now..... I get maybe 1 new user a week. so i may go to Member Activation

Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on October 03, 2014, 08:02:15 PM
You can try adjusting the httpBL threat and age level.  See the first page and the Project Honeypot Web page for more info.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: alphacaveman2 on December 18, 2014, 10:38:18 AM
I have the Bad Behavior mod and I'm wondering if I should check the option to "Block Empty User Agents." Does that mean that when someone is hiding their host, ip, etc. that it will block them? Because on my board those are almost always spammers or trolls.

Thanks.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: BB13 on December 20, 2014, 09:27:38 AM
Whats up with the "I said no cheating!" when i use a backup? How do i solve this problem. So it does not do this if i use a backup containing  Bad behavior.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on December 20, 2014, 09:57:03 AM
when you use a backup to do what?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: BB13 on December 20, 2014, 11:14:38 AM
To recreate a earlier state.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: BB13 on December 20, 2014, 11:30:09 AM
When i restore an earlier state via a backup, a white page is all i can see. On the page is written "I said no cheating!"
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 20, 2014, 02:06:18 PM
I have the Bad Behavior mod and I'm wondering if I should check the option to "Block Empty User Agents." Does that mean that when someone is hiding their host, ip, etc. that it will block them? Because on my board those are almost always spammers or trolls.

Thanks.

That option blocks empty browser fields.  ie Firefox.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on December 20, 2014, 02:22:50 PM
When i restore an earlier state via a backup, a white page is all i can see. On the page is written "I said no cheating!"

"I said no cheating!" is generated by the BB Core when it is not properly defined.   This is a security measure.  It means that you are trying to launch the program while missing files or code.  Most likely something not restored from the back-up.  Try uninstalling the mod before the back-up and reinstall it afterwards.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: BB13 on December 23, 2014, 08:47:51 AM
When i restore an earlier state via a backup, a white page is all i can see. On the page is written "I said no cheating!"

"I said no cheating!" is generated by the BB Core when it is not properly defined.   This is a security measure.  It means that you are trying to launch the program while missing files or code.  Most likely something not restored from the back-up.  Try uninstalling the mod before the back-up and reinstall it afterwards.


Thanks for the help!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: mwisebaker on January 08, 2015, 08:44:24 PM
Question - when I go into the Bad Behavior settings it says "Project Honeypot is offline", which corresponds to around the same time I started getting a lot more spam-bots registering to my form. I see that the site http://www.projecthoneypot.org seems to be up and running, so I'm unsure whether my mod is broken or needs to be updated. Any help?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 10, 2015, 10:50:30 AM
It was offline this morning but is online now.  Either they are doing maintenance or your settings need adjustment.  Please see post 1 of this thread for details.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Bob Perry of Web Presence Consulting on January 18, 2015, 07:26:44 PM
Figured it would be quicker to ask for direction about 2.1... could someone point me to where to change the display attributes for the text of this mods stats located in the index footer if a admin has it configured to display? Its not too bad but the actual number is difficult to read because there is not enough contrast of color due to the dark background of SMF footer...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: butchs on January 18, 2015, 07:43:21 PM
I have not upgraded the mod for 2.1 yet.   Maybe in a few months or when 2.1 is officially released for production sites.  I am working on a new 2.0.x version but have been bogged down by other issues.  2.1 is a totally different animal and will require some code to be re-written.  Especially the admin logs.  It is not a copy paste port!

The code is in "index.template.php" via "bb2_insert_stats".
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Bob Perry of Web Presence Consulting on January 18, 2015, 07:53:38 PM
understood... will not mess with it for now... but as a side note to everyone, my install of it on 2.1 "seems" to be functioning well so far...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Auke on February 17, 2015, 02:47:05 PM
I am working on a new 2.0.x version but have been bogged down by other issues.

I get lots of spammers on my forum at the moment, and am thinking about installing the bad behaviour mod. However, my forum is on SMF 2.0.8 while the present bad behaviour mod says 2.0.7. Could I still install the mod or is it safer to wait for the new version?

Thanks!
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: MovedGoalPosts on February 17, 2015, 03:05:20 PM
I'm running the present bad behaviour mod on my current 2.0.9 SMF version, no issues.  But then I've had bad behaviour for a couple of years now so the forum has been upgraded around bad behaviour.

Note that the bad behaviour SMF mod here is perhaps slightly out dated as it is based on v2.2.15 whereas bad behaviour itself is now version 2.2.16.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Auke on February 18, 2015, 11:06:38 PM
Thank you for your reply MovedGoalPosts! From your answer I conclude it may not be 100% safe. I really do need some decent protection though. I guess I'd best test Bad behaviour before actually putting it on my forum. Unfortunately, I hit a snag (http://www.simplemachines.org/community/index.php?topic=533817.0), but hopefully that problem is soon solved.

Is there some knowledge here as to when a 2.0.8-compatible version of Bad Bahaviour may come out?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on February 19, 2015, 06:58:59 AM
any mod for 2.0.x will work on almost any other version of 2.0.x

additionally, you should be upgrading to 2.0.9, since the 2.0.9 update is a security release.


finally, I have no idea what you mean about 100% safe.   I have been running this bad behavior mod on all of my forums for years without issue.

postscript...   "decent protection" against what, exactly?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Auke on April 04, 2015, 05:56:17 PM
@ Kindred:

I will upgrade to 2.0.9 when I'm sure the Bad Behaviour mod is not causing any troubles. I first would like to have 'decent protection' against those cursed spammers that I now have to remove manually each day.

@ all:

Apparently all is okay now for installation, except for 1 thing: according to the automatic mod test, the test fails on 1 point. I would like to know if this could cause a serious problem if I would continue with installing. See attachment. My forum is still 2.0.8 (will shortly become 2.0.9), has default theme and only 7 installed mods.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 04, 2015, 10:25:10 PM
nearly every error could cause issues.  read the faq on what to do if a mod fails in portions.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Auke on April 06, 2015, 03:15:54 PM
I can't find the answer to the problem in the FAQ's (or I'm just not seeing it). Maybe there is some conflict with the other mods I installed? I'll uninstall some of them to see what happens. Fingers crossed...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 06, 2015, 03:24:10 PM
http://wiki.simplemachines.org/smf/Error_in_mod_installation
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Auke on April 06, 2015, 09:54:37 PM
Thanks Kindred. Didn't help me much though.

Anyway, I figured that probably one of the other installed mods was the culprit, so I've just uninstalled them one by one. And I actually found the problem! Apparently, Bad Behaviour has a problem when the mod 'BK-modding favicon and Custom Global html' is installed. I'm not sure yet, but when I was (un)installing the various mods a couple of times, it appeared that I could re-install this mod without trouble when Bad Behaviour was in already place. I thought there might be someone here who would find this info interesting.

Okay, I'm trying to figure out now which parts of BB I should activate and which parts not. Could someone please advise me on what to do with the 'Reverse Proxy' stuff? I have no idea what this is, and the ?-function doesn't help me here. Also, I'm not sure about the function of 'Block empty User Agents'.

For the time being I'll leave my BB mod as it is now. I do see the notification 'Project Honey Pot is offline!'. Does that mean that BB is not actually working on my website at he moment?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 06, 2015, 10:11:23 PM
Did you sign up for a honeypot API ID?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Auke on April 06, 2015, 10:52:25 PM
No, not yet. Is that mandatory if you want BB to function? I had a look at the Honey Pot site, but the registration form asks me to sign for agreement with what I think is probably at least 10 pages of legal texts. That will take me some hours before I've read and understood it...
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 07, 2015, 06:49:31 AM
well, that is why the project honeypot appears "offline" for you
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Auke on April 07, 2015, 04:23:12 PM
Okay, I just registered at Project Honey Pot.

In the Bad Behaviour settings I see 3 lines where I can (should?) enter something and which are obviously directly related to PHP:
- http:BL Access Key
- Honeypot Link
- Honeypot Link word

What should I enter here, and where can I find it?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 07, 2015, 05:06:26 PM
when you registered, you should have gotten an API and also gotten a set of files to download and place on your site
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Auke on April 07, 2015, 06:40:00 PM
On the QuickLink page of PHP there are a number of lines from which I apparently can choose one or more, e.g.:

<a href="http://www.xp-tips.com/cgi-bin/shortlivedreader.cgi?day=4"><!-- format-adorable --></a>

After looking up what API means, I think I'm correct to assume these are API's? Still, I have really no idea which part of this I should put where.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 07, 2015, 10:00:06 PM
no....

http://en.wikipedia.org/wiki/Application_programming_interface


the API key will be a code which allows your software to communicate with their site
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Auke on April 08, 2015, 12:39:47 AM
Okay, good I asked confirmation first...

Where can I find a step-by-step (SMALL steps please!) on how to get the PHP stuff working within BB?

BB already blocked some spammers, but several still slipped through. I hope connecting with PHP will enable BB to keep those out too.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 08, 2015, 06:46:03 AM
Auke,

I have no idea what you are talking about. There is o need to do anything with php.

Once BB is installed, everything is handled through the admin interface, with the exception of uploading the honeypot file(s) to your website using FTP or your file manager... no php.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Auke on April 08, 2015, 10:28:16 AM
Woops, didn't know there is something else called PHP... With PHP I mean Project Honey Pot, not the scripting language (Project Honey Pot calls itself PHP too).

What should I put in the open fields of the attachment? I guess that is what enables communication between BB and PHP?

How do I upload the honeypot file(s) to my website using FTP or my file manager?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 08, 2015, 10:58:48 PM
Iyou need to find your access key on the project honeypot site and it it into the field there...

And yes, use FTP or your file manager to load the project honeypot files to,your website and then put the link and the trigger word in those other fields.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Auke on April 08, 2015, 11:45:56 PM
Okay, I understand I have to do that. What I don't understand is HOW to do it. Where can I find a step-by-step manual on these issues? I basically need 'Installing Honey Pots for Dummies'. :-[
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on April 09, 2015, 06:36:19 AM
don't you know ho to use ftp or your host's file manager?

If you don't know that - how did you even install SMF in the first place?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Auke on April 09, 2015, 09:08:29 AM
With the help of some very patient people... :-[

I didn't start my forum because I wanted a forum but because I saw there was a need for this very specific forum. Unfortunately I haven't been able to find someone who is willing to take care of the technical aspects, which means I have to do it myself.
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TKG26 on May 14, 2015, 12:13:06 PM
Since installing this mod last August my spam bot registrations dropped to almost zero. The last few weeks or so I see more and more registrations coming through. Wondering what I may check first. Where the hole in the system might be.  Getting difficult to deciver human from bot again

Thanks
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TKG26 on May 18, 2015, 09:52:49 PM
anyone?
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: Kindred on May 18, 2015, 10:09:14 PM
This mod acts like a good second lock... But the primary lock should be your questions..... 10-20 good questions, asking for 3 will block 100% of the bots and many of the human spammers
Title: Re: Bad Behavior mod - The Web's premier link spam killer (Now with SMF 2 httpBL)
Post by: TKG26 on May 23, 2015, 09:43:40 PM
thanks i only had 2! LOL Ill make them answer more. That said i did install reCaptcha last week and that seemed to really help


THANKS AGIAN
Title: Re: Bad Behavior for SMF mod
Post by: butchs on December 27, 2015, 03:39:57 PM
New Version posted today:

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option and enter "Cf-Connecting-Ip" as "IP call to Reverse Proxy" in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.
Title: Re: Bad Behavior for SMF mod
Post by: Sigyn on March 01, 2016, 04:36:33 AM
This mod is refusing to uninstall from my site. Not only does it not do it the normal way (from clicking uninstall) but it gives me this error:
Quote
Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, you@example.com and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.


And when I check the logs there is nothing to help me. Is there someone who might be willing to manually uninstall this mod for me?
Title: Re: Bad Behavior for SMF mod
Post by: Biology Forums on April 01, 2016, 02:13:31 PM
The obfuscated email address that it presents is an address that cannot be mailed to, unfortunately.

noreply+nospam@nospam+nospam.nospam.hotmail+nospam-nospam.forums+nospam.nospam.com

Cannot be emailed. Any way to circumvent this problem?
Title: Re: Bad Behavior for SMF mod
Post by: Kindred on April 01, 2016, 02:26:00 PM
Shuban,
it's a noreply address anyway.... there's a reason why addresses are labels "noreply"


Sigyn,

It sounds like your server has a configuration problem which is preventing the uninstallation...  I suspect that you will probably have problems with installations going forward, as well.
Title: Re: Bad Behavior for SMF mod
Post by: NukeWorker.com on April 26, 2016, 10:16:05 PM
What does the BBC button do?
Title: Re: Bad Behavior for SMF mod
Post by: butchs on May 05, 2016, 05:56:11 PM
All data enclosed in Bad Behavior BBC "suspicious" tags will not be visible to a visitor in the "PERMITTED ENTRIES LOG" and "DENIED ENTRIES LOG".  This log is more effective if you are using Project Honeypot with the mod.  Otherwise it is just the permitted/ denied entries from the Bad Behavior core.

This is added security since only people who pass the BB test or are actual members of your forum can see this information!
Title: Re: Bad Behavior for SMF mod
Post by: Sudhakar Arjunan on May 06, 2016, 09:19:52 AM
I have installed bad behavior for smf 3 months ago. And for last 3 months even for admin it shows.

An Error Has Occurred
Sorry Guest, you are banned from using this forum!
spam post
This ban is not set to expire.

Dont know what to do ? any help is appreciated.
Title: Re: Bad Behavior for SMF mod
Post by: Kindred on May 06, 2016, 09:30:54 AM
I don't think that has to do with the bad behavior mod...  to me, it looks as if you banned your own IP address...
if it affects EVERYBODY, then you are possibly using something like cloudflare, and you banned the incoming IP (which would affect everyone)
Title: Re: Bad Behavior for SMF mod
Post by: Sudhakar Arjunan on May 06, 2016, 12:53:00 PM
Thank you Kindred for the reply.

I dont use any cloud flare or such cloud application. I host my site on a dedicated server only.

So please help me how to remove everybody / ip address ban or how to un banned the incoming ip.

If i access from some new computer, i can see the forum is opening.
Title: Re: Bad Behavior for SMF mod
Post by: Kindred on May 06, 2016, 01:41:50 PM
then access it form a new computer, log in as an admin and remove the bans
Title: Re: Bad Behavior for SMF mod
Post by: Sudhakar Arjunan on May 06, 2016, 02:10:26 PM
I checked it , but i see bans which i done in last 8 years.

No such bans on guest , or the ip address i use or the admin etc.

Only in ban log it shows that the ip am using shows as blocked - its just a log.
Title: Re: Bad Behavior for SMF mod
Post by: Boskonovic on May 15, 2016, 03:09:37 PM
Dear butchs,

I have completed the translation to Italian (both utf-8 and standard) of the mod.

Best Regards
Andrea
Title: Re: Bad Behavior for SMF mod
Post by: butchs on June 08, 2016, 07:18:35 PM
I don't think that has to do with the bad behavior mod...  to me, it looks as if you banned your own IP address...
if it affects EVERYBODY, then you are possibly using something like cloudflare, and you banned the incoming IP (which would affect everyone)

Yea, I do not have an expire note on my bans.

Sorry it took so long to reply - I crashed my computer with crazy overclocking...
Title: Re: Bad Behavior for SMF mod
Post by: JaGuR on June 17, 2016, 09:23:39 PM
Hi guys,

I hve had to disable the Bad Behavoiur Mod as it was blocking a few of my members, and idea's why or what I need to do to rectify the issue ?
Title: Re: Bad Behavior for SMF mod
Post by: butchs on June 28, 2016, 08:31:38 PM
For several years I listed all the helps in the first post.  Then someone at SMF cam up with the brilliant idea to standardize all the first posts and wipe them all out without warning.  I do not have the time to do it again.  Search HELP and you will find the answer.

In your case whitelsit all members:  http://www.simplemachines.org/community/index.php?topic=375980.msg3403306;topicseen#msg3403306
Title: Re: Bad Behavior for SMF mod
Post by: vbgamer45 on June 28, 2016, 11:15:43 PM
I agree i dislike that we can't edit posts...
Here is the html that i found from your orginal
Code: [Select]
<div class="inner" id="msg_2582045">
<ul class="bbc_list"></ul><span style="font-size: 14pt;" class="bbc_size"><a href="http://custom.simplemachines.org/mods/index.php?mod=2502" class="bbc_link" target="_blank">Link to Mod</a></span><br><br><div align="center"><span style="color: red;" class="bbc_color"><span style="font-size: 18pt;" class="bbc_size"><strong>Bad Behavior Mod</strong></span></span></div><div align="center"><span style="color: blue;" class="bbc_color">PHP-based solution for blocking link spam and robots</span></div><div align="center"><span style="color: blue;" class="bbc_color">Turning the Spam Flood Into a Trickle for Years</span></div><div align="center"><strong>Written by:</strong>&nbsp; &nbsp; <a href="http://www.simplemachines.org/community/index.php?action=profile;u=77887" class="bbc_link" target="_blank">butchs</a><br><br><a href="https://www.paypal.com/cgi-bin/webscr?cmd=_donations&amp;business=UJTMMF8FKGLZ6&amp;lc=US&amp;item_name=butchs%2f%20continued%20updates&amp;currency_code=USD&amp;bn=PP%2dDonationsBF%3abtn_donateCC_LG%2egif%3aNonHosted" class="bbc_link" target="_blank">Donations accepted to help support this mod</a></div><br><hr><strong><span style="font-size: 24pt;" class="bbc_size">INSTALLATION:</span></strong><br><br><em><strong>Please look at all the preview images on the <a href="http://custom.simplemachines.org/mods/index.php?mod=2502" class="bbc_link" target="_blank">mod</a> page.</strong></em><br><br><strong>Adjust settings before you enable the mod.</strong><br>(Mod will disable it's self when uninstalled)<br><br>Check all the options that are "Recommended" in "Bad Behavior Admin/ SETTINGS".<br><br>Whitelist all your regular members.&nbsp; Read "<a href="http://www.simplemachines.org/community/index.php?topic=375980.msg3403306#msg3403306" class="bbc_link" target="_blank">WHITELIST MEMBERS HELP</a>" for details.<br><br><div align="center">- - - - - - - - - - - - - - - - - - - - - - - <strong>OPTIONAL httpBL</strong> - - - - - - - - - - - - - - - - - - - - - - - </div>The core of the mod protects your site even if httpBL is not enabled.&nbsp; It is recommended to increase protection by adding httpBL.<br><br><span class="bbc_u">httpBL procedure:</span><br>Register your site at <a href="http://www.projecthoneypot.org/faq.php#b" class="bbc_link" target="_blank">ProjectHoneyPot</a>.<br>Get the access key at <a href="http://www.projecthoneypot.org/faq.php#g" class="bbc_link" target="_blank">ProjectHoneyPot</a>.<br>Add an OPTIONAL <a href="http://www.projecthoneypot.org/manage_honey_pots.php" class="bbc_link" target="_blank">honey pot</a> script for your site.<br>Copy the OPTIONAL honey pot script to your site (the same location as the SMF folder).<br>Activate the OPTIONAL <a href="http://www.projecthoneypot.org/manage_honey_pots.php" class="bbc_link" target="_blank">honey pot</a> script and confirm it is active.<br><br>Copy over the HoneyPot information in the "Bad Behavior Admin/ SETTINGS/ Project Honey Pot HTTP Blacklist" area:<br><ul class="bbc_list"><li>http:BL Access Key - Access Keys are 12-alpha characters (no numbers). They are lower-case. You should copy the Access Key exactly as it appears at the <a href="http://www.projecthoneypot.org/httpbl_configure.php" class="bbc_link" target="_blank">Project Honey Pot network</a>.</li><li>Minimum Threat Level - 25</li><li>Maximum Age of Data - 30</li><li>Honeypot Link - The link to the OPTIONAL honey pot Script Location or a <a href="http://www.projecthoneypot.org/manage_quicklink.php" class="bbc_link" target="_blank">QuickLink</a>.</li><li>Honeypot Link word - A word you make up.</li></ul><div align="center">- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - </div><br><div align="center">- - - - - - - - - - - - - - - - - - - - - - - <strong>OPTIONAL CloudFlare</strong> - - - - - - - - - - - - - - - - - - - - - - - </div>If you are successfully using CloudFlare:&nbsp; Enter "Cf-Connecting-Ip" in "IP call to Reverse Proxy" and check "Enable Reverse Proxy".<br><br>THIS MOD ASSUMES THAT YOU MADE MODIFICATIONS TO SMF SUCH THAT CLOUDFLARE IS OPERATIONAL ON YOUR SITE.&nbsp; See the Cloudflare mod <a href="http://www.simplemachines.org/community/index.php?topic=391926.msg2726085#msg2726085" class="bbc_link" target="_blank">here</a>.<br><div align="center">- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - </div><br><div align="center">- - - - - - - - - - - - - - - - - - - - - - - <strong>OPTIONAL Admin Choice</strong> - - - - - - - - - - - - - - - - - - - - - - - </div>Administrators are automatically whitelisted by the mod.&nbsp; If you are paranoid, you can make the these changes.<br><br>Enter your personal admin IP address or CIDR range "Bad Behavior Admin/ SETTINGS/ Whitelist/ IP Address".&nbsp; For more information read "<a href="http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023" class="bbc_link" target="_blank">ADVANCED WHITELIST HELP"</a>.<br><div align="center">- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - </div><br>Check "Enable Bad Behavior".<br><hr><strong><span style="font-size: 24pt;" class="bbc_size">HELP:</span></strong><br>Click the help icons <img src="/web/20150221011444im_/http://www.simplemachines.org/community/Themes/default/images/helptopics.gif" alt="" class="bbc_img"> in the mod for additional help.<br><br>Standard option information is located at the <a href="http://bad-behavior.ioerror.us/support/configuration/" class="bbc_link" target="_blank">core bad-behavior</a> site.<br><hr><strong><span style="font-size: 24pt;" class="bbc_size">FAQs:</span></strong><br><ul class="bbc_list"><li><a href="http://www.simplemachines.org/community/index.php?topic=375980.msg3403306#msg3403306" class="bbc_link" target="_blank">WHITELIST MEMBERS HELP</a></li><li><a href="http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023" class="bbc_link" target="_blank">ADVANCED WHITELIST HELP</a></li><li><a href="http://www.simplemachines.org/community/index.php?topic=375980.msg3152400;topicseen#msg3152400" class="bbc_link" target="_blank">USING OpenID HELP</a></li><li><a href="http://www.simplemachines.org/community/index.php?topic=375980.msg3152326;topicseen#msg3152326" class="bbc_link" target="_blank">USING PAYPAL HELP</a></li><li><a href="http://www.simplemachines.org/community/index.php?topic=375980.msg3122889;topicseen#msg3122889" class="bbc_link" target="_blank">SUSPICIOUS BBC TAG HELP - Only for SMF 2.0 Gold.</a></li><li><a href="http://www.simplemachines.org/community/index.php?topic=375980.msg3478178#msg3478178" class="bbc_link" target="_blank">UPGRADING FROM AN OLDER VERSION HELP.</a></li><li><a href="http://www.simplemachines.org/community/index.php?topic=375980.msg3565493#msg3565493" class="bbc_link" target="_blank">MANY BOT HITS A WEEK</a></li><li><a href="http://www.simplemachines.org/community/index.php?topic=375980.msg3499684;topicseen#msg3499684" class="bbc_link" target="_blank">RANDOM CHARACTERS ABOVE FORUM HEADER</a></li></ul><hr><strong><span style="font-size: 24pt;" class="bbc_size">TESTING:</span></strong><br>To insure that Bad Behavior is functioning correctly you can add the sting "Bad Behavior Test" to the User Agent (UA) of a HTTP request from someone who is not in the whitelist and is not the administrator.<br><ul class="bbc_list"><li><span class="bbc_u">Windows</span> use FireFox with the [nofollow]<a href="https://addons.mozilla.org/en-US/firefox/addon/header-tool/" class="bbc_link" target="_blank">"Header Tool"</a>[/nofollow] add-on and enter "User-Agent : Bad Behavior Test"&nbsp; in the dialog box. </li><li><span class="bbc_u">Macintosh</span>, [nofollow]<a href="http://macs.about.com/od/usingyourmac/qt/safaridevelop.htm" class="bbc_link" target="_blank">"enable the Develop menu"</a>[/nofollow] in Safari and paste "Bad Behavior Test" in "User Agent/Other".</li></ul><br>If you look at the page source (just below the title) you will see the speed of this mod at work:&nbsp; &lt;!-- Bad Behavior 2.x.xx run time: 3.025 ms --&gt;<br>[/list]</div>
Title: Re: Bad Behavior for SMF mod
Post by: butchs on June 29, 2016, 07:25:58 PM
Thank you.  I will try to move it...
Title: Re: Bad Behavior for SMF mod
Post by: Biology Forums on July 29, 2016, 05:26:22 PM
Where's the setting to purge the cache?
Title: Re: Bad Behavior for SMF mod
Post by: butchs on July 31, 2016, 01:18:23 PM
It automatically purges based on the "Cache Duration".
Title: Re: Bad Behavior for SMF mod
Post by: Biology Forums on August 06, 2016, 02:03:55 AM
It automatically purges based on the "Cache Duration".


Are you sure it works? I had it on one day and I learned that there were more than 900 k files in that folder
Title: Re: Bad Behavior for SMF mod
Post by: butchs on August 06, 2016, 07:32:33 AM
I vigorously test all my code.  Opps, I had a bad day and pointed you the wrong way.  That setting is the duration the visitor is tested by the application before it starts all over.  If the visitor is identified as good and etc they stay there until the purge!

What you want is in Maintenance/ Scheduled tasks:  Purge all Bad Behavior cache files older than one day.
You can change the default settings if you like..  I suggest keeping in hours or days.   Try run now.
Title: Re: Bad Behavior for SMF mod
Post by: Christiansen on November 02, 2016, 11:10:02 AM
I'm running Bad Behavior on my Jeep club forum at www dot rocketcitywranglers dot com.

I just got a couple errors in the Bad Behavior mod, image attached.  Any help would be much appreciated.  Let me know if you need anything else.
Title: Re: Bad Behavior for SMF mod
Post by: butchs on November 03, 2016, 07:59:05 PM
I am working on it.   The error will not stop the mod from working.   What is the version of your mod, SMF and php?
Title: Re: Bad Behavior for SMF mod
Post by: Christiansen on November 04, 2016, 10:49:24 AM
SMF:  2.0.12
Bad Behavior:  1.5.19

I'll have to get back to you on the PHP version tonight.
Title: Re: Bad Behavior for SMF mod
Post by: Christiansen on November 06, 2016, 07:59:31 AM
SMF:  2.0.12
Bad Behavior:  1.5.19

I'll have to get back to you on the PHP version tonight.

Sorry it took me so long.  PHP version is 5.6.27
Title: Re: Bad Behavior for SMF mod
Post by: Adrek on November 06, 2016, 04:37:51 PM
I also noticed this error from few days ago - it was triggered by logged in user and for this membergroup permission "Bad Behavior Whitelist Group" is checked.


MySQL version: 5.5.45
PHP: 5.4.45
SMF: 2.0.12
Server version: Apache
Bad Behavior mod: 1.5.19

(http://i.imgur.com/vJPyORO.png)
Title: Re: Bad Behavior for SMF mod
Post by: butchs on November 21, 2016, 08:45:30 PM
There is gong to be a delay in me looking at the code.  My computer fan burned out and I am waiting fro a new one.
Title: Re: Bad Behavior for SMF mod
Post by: surfer97 on December 22, 2016, 06:45:08 PM
I have one user complaining of persistently getting kicked out of sending a PM, the Denial Reason is "POST more than two days after GET". He's only using the regular PM screens in SMF, and not using a proxy, so doesn't seem to fit any of the reasons I have seen listed for this denial. Any idea why he (and no one else in the history of the forum as I recall) could be getting this?
Title: Re: Bad Behavior for SMF mod
Post by: butchs on December 31, 2016, 02:38:37 PM
That error is a is under post and is to test for trackback spam.  The test in question is checking if the maximum duration of the bad behavior cookie/ post is excessive.  Maybe he is taking hours to post or possibly His cookies are disabled.  You can try checking "EU Cookie Handling" to disable the cookie check, then it will only check the post timing.  Please note that nothing will happen unless you completely flush the server cache and he wipes out his computers cache.
Title: Re: Bad Behavior for SMF mod
Post by: Biology Forums on January 27, 2017, 01:18:16 AM
For the first time in a long time I am receiving a heck of a lot of spam, is this mod still working?
Title: Re: Bad Behavior for SMF mod
Post by: butchs on January 29, 2017, 11:45:56 AM
It is working just fine.  Check your http:BL Access Key.
Title: Re: Bad Behavior for SMF mod
Post by: Kindred on January 29, 2017, 05:56:03 PM
also check your other spam prevention methods...
Title: Re: Bad Behavior for SMF mod
Post by: Adrek on January 30, 2017, 01:25:11 PM
Today I also got few spammers, and I see that project website is closed for maintenance (on Facebook fanpage there are comments that site is not working for few weeks now).
Title: Re: Bad Behavior for SMF mod
Post by: Biology Forums on February 01, 2017, 12:29:50 AM
It is down, that's for sure
Title: Re: Bad Behavior for SMF mod
Post by: butchs on February 04, 2017, 08:24:04 AM
I really cannot help you with posts like that.  Commentary explains nothing.

If you do not see green "Project Honey Pot is online." at the top then go to the honeypot site and check your status, change password and confirm your access key.  Maybe you should uninstall and reinstall the mod?  Maybe your host is blocking Project Honey Pot?
Title: Re: Bad Behavior for SMF mod
Post by: landyvlad on February 15, 2017, 12:53:25 AM
from the httpBL thread - Project Honeypot's database that it uses for spam detection IS online. There is just no way to register for it at the moment, for new users.
Title: Re: Bad Behavior for SMF mod
Post by: butchs on February 15, 2017, 03:20:27 PM
This mod does more than just honey pot.
Title: Re: Bad Behavior for SMF mod
Post by: Biology Forums on March 21, 2017, 01:17:52 AM
I'm using 1.x and I believe this has officially stopped working even though it reports "Online" in the admin area
Title: Re: Bad Behavior for SMF mod
Post by: Kindred on March 21, 2017, 11:45:08 AM
???   AFAIK, Bad behavior AND httpBL both still work perfectly well with the current version of the mod
Title: Re: Bad Behavior for SMF mod
Post by: butchs on March 21, 2017, 09:05:49 PM
Thanks Kindred.  That would have been my reply.
Title: Re: Bad Behavior for SMF mod
Post by: landyvlad on March 23, 2017, 01:16:12 AM
By the way Project Honeypot is now back up and allowing people to register etc.  :)
Title: Re: Bad Behavior for SMF mod
Post by: landyvlad on March 24, 2017, 12:50:17 AM
Question.  I currently have "Stop Spammer" and "httpBL" mods running on my site.

Does the "Bad Behaviour for SMF mod" offer anything additional which is not already be done by the combination of those two mods?

Would it be worth it / useful / beneficial to have all three installed, or would I gain nothing extra?
Title: Re: Bad Behavior for SMF mod
Post by: Kindred on March 24, 2017, 11:47:31 PM
This uses the bad behavior script... (and has httpBL also built in)

so, if you use this, you don't need the other httpBL only mod
Title: Re: Bad Behavior for SMF mod
Post by: butchs on March 26, 2017, 08:21:27 AM
See the first post for a link to the bad behavior script website.
Title: Re: Bad Behavior for SMF mod
Post by: landyvlad on March 26, 2017, 09:38:51 PM
Thanks
Title: Re: Bad Behavior for SMF mod
Post by: BillLeeDee on June 28, 2017, 06:27:08 AM
I don't know if anyone has a thought or suggestion on this one, but I notice the following error when I get a certain type of suspicious activity. There is no user agent and the following error occurs with the accompanying bad action shown in the picture. Thanks in advance.
Title: Re: Bad Behavior for SMF mod
Post by: butchs on June 30, 2017, 02:24:39 PM
Do you have anything in the Whitelist settings of the mod?
Title: Re: Bad Behavior for SMF mod
Post by: BillLeeDee on July 01, 2017, 06:58:35 AM
Do you have anything in the Whitelist settings of the mod?

There are a couple of dozen IP addresses and one user agent listed
Title: Re: Bad Behavior for SMF mod
Post by: butchs on July 02, 2017, 08:13:47 AM
I suspect you have a extra blank in the User Agent field.  You most likely hit a carriage return after entering the value.  Please remove the carriage return.

Some of that image looks like a SQL Injection attack.  I suggest you install CrawlProtect (http://www.crawltrack.net/crawlprotect/).
Title: Re: Bad Behavior for SMF mod
Post by: BillLeeDee on July 02, 2017, 10:41:13 AM
@butchs: I checked the user agent I had slugged in and there wasn't any return character afterwards. Since it was only one I simply removed it.

Thanks for the recommendation of CrawlProtect as I wasn't aware of it. I had written a multitude of traps into my htaccess file but this looks like it might be a better solution. Thanks.
Title: Re: Bad Behavior for SMF mod
Post by: butchs on August 18, 2017, 02:59:33 PM
Helps are back in first post.
Title: Installing Bad Behavior for SMF mod on v2.0.14
Post by: siavoshkc on September 21, 2017, 10:27:38 AM
How can I install this mod on my v2.0.14? I can't find it in the list shown by my forum. Do I have to use manual method?

By the way is this the right place to ask this question?
Title: Re: Bad Behavior for SMF mod
Post by: butchs on September 24, 2017, 07:48:28 AM
The mod should install with v2.0.14.  Not sure why you cannot see it.  Only install with the manual method if you have a custom theme.
Title: Re: Bad Behavior for SMF mod
Post by: butchs on December 31, 2017, 09:34:40 PM
This mod has been updated to the latest version of Bad Behavior, added Italian and bug fixes.  BB Changes:

See the first post for more info...
Title: Re: Bad Behavior for SMF mod
Post by: doughboy99 on January 04, 2018, 06:55:17 AM
Hello

When i install this version I get a plus symbol at the top of every page in the forum. Bad behaviour doesn't run on the site although I can acces the setup pages. Reverting to an earlier version works  correctly.
Any ideas what might be causing this.

Thanks
Title: Re: Bad Behavior for SMF mod
Post by: butchs on January 04, 2018, 08:04:11 AM
There is nothing wrong.  That is a Project Honeypot Google Safe Spam trap.  Check out the link in the "RANDOM CHARACTERS ABOVE FORUM HEADER" FAQ in the first post of this thread.

Setting up a spam trap helps contribute to project honey pot and keeps your site safe.  Attached are some I caught.
Title: Re: Bad Behavior for SMF mod
Post by: Arantor on January 04, 2018, 08:22:07 AM
You caught a lot of CloudFlare IPs in that list, interesting.
Title: Re: Bad Behavior for SMF mod
Post by: butchs on January 04, 2018, 08:35:58 AM
They have to click on the link to get on the list.  I use CloudFlare but years ago I noticed that some people use it to spam and some try to bypass CF.   I have not seen much of the latter in years after they revamped their system.
Title: Re: Bad Behavior for SMF mod
Post by: Arantor on January 04, 2018, 08:44:06 AM
I was more noticing that the 172.68.7 range is owned by CloudFlare in Thailand for example, wasn't sure if this was skewing your findings or not.
Title: Re: Bad Behavior for SMF mod
Post by: BillLeeDee on January 12, 2018, 08:29:13 PM
I took a quick skim of the thread and might have missed it so please forgive me if this was already asked. Can the update be installed without removing the older version or do you need to remove the old version before installing the latest version?
Title: Re: Bad Behavior for SMF mod
Post by: Kindred on January 12, 2018, 10:35:42 PM
As with almost every mod ...  uninstall the old version first. ;)
Title: Re: Bad Behavior for SMF mod
Post by: BillLeeDee on January 13, 2018, 04:00:53 PM
That's what I thought but wanted to be certain. Thanks.
Title: Re: Bad Behavior for SMF mod
Post by: BillLeeDee on January 16, 2018, 06:01:38 PM
Has anyone noticed an text oddity with the 1.5.20 version. I uninstalled the older 1.5.19 version and installed the new version and noticed various portions of my site had the text size increase from what is normally. After installing it showed up as "upgrade" install instead of uninstall, so I had to restore the SMF directory from my backup.

I don't know if it has anything to do with the other assorted mods installed in the forum so when I get some spare time to take the forums offline I plan on another clean install with the Bad Behavior mod being the first one to be installed.
Title: Re: Bad Behavior for SMF mod
Post by: djkimmel on January 17, 2018, 10:19:32 PM
I had the same thing happen on several of my forums - the font size increased and messed up some of my layouts - primarily those with portals. I started thinking it might be a change in portal css but one of the forums the only change I made at the time was upgrading to Bad Behavior 1.5.20 and the fonts look supersized! I haven't had time yet to track down what it causing this.
Title: Re: Bad Behavior for SMF mod
Post by: djkimmel on January 18, 2018, 12:26:50 AM
Okay, I found the problem with mod Bad Behavior version 1.5.20 modified 12/31/2017. In the mod file /Sources/bad-behavior/BadBehavior-SMF.php that is called for all Bad Behavior actions, there is an errant carriage return and '+' sign at the very end of that file.

Delete the carriage return and plus sign so the file ends properly with '?>' and my fonts are no longer magnified.
Title: Re: Bad Behavior for SMF mod
Post by: djkimmel on January 18, 2018, 12:42:14 AM
Actually, looking at the 12/31/2017 modified date mod install package I do not see the '+' sign at the end? Only a line feed which should be removed anyway as I've always been told PHP doesn't like a blank line after the closing '?>' code. I didn't modify the install package but every install I did of Bad Behavior 1.5.20 has the carriage return and a plus sign at the end. However it is happening that is the problem with magnified fonts for my installs. Removing everything after the closing '?>' puts my fonts back to normal.
Title: Re: Bad Behavior for SMF mod
Post by: djkimmel on January 18, 2018, 01:44:53 AM
FYI - I tried removing the line feed at the end of the BadBehavior-SMF.php file and rewriting it into the mod install zip file. I installed Bad Behavior 1.5.20 on another forum with this edited file and it still ended up with the carriage return and a '+' sign at the end?? I don't know how it is doing this? I had to FTP this file after install and modify it again by removing the now present carriage return and '+' character at the end to stop my forum fonts from being magnified.
Title: Re: Bad Behavior for SMF mod
Post by: Kindred on January 18, 2018, 07:11:08 AM
sounds like your system may be doing something strange....
Title: Re: Bad Behavior for SMF mod
Post by: BillLeeDee on January 18, 2018, 08:45:24 PM
Okay, I found the problem with mod Bad Behavior version 1.5.20 modified 12/31/2017. In the mod file /Sources/bad-behavior/BadBehavior-SMF.php that is called for all Bad Behavior actions, there is an errant carriage return and '+' sign at the very end of that file.

Delete the carriage return and plus sign so the file ends properly with '?>' and my fonts are no longer magnified.

Thanks for sharing, djk. I was able to compare the file from both the .19 and .20 versions and the latter has the return and plus sign you noted. Removing it does seem to solve the problem.
Title: Re: Bad Behavior for SMF mod
Post by: djkimmel on January 19, 2018, 01:39:38 PM
I would like to know how my system is doing this?? I install mods and software from quite a few programs and this is the first time I have ever had this happen, and only with this version 1.5.20 of the Bad Behavior mod with this one file? I am unable to see how possibly this is happening with this one file in this one mod so I don't know that there is anything I can on my end at the moment other then manually fix the file each time I install/upgrade to it on a website.
Title: Re: Bad Behavior for SMF mod
Post by: butchs on February 03, 2018, 07:45:03 AM
Did you read the FAQ and did you make the change to your settings?  I will make it easy for you, here is the link:  RANDOM CHARACTERS ABOVE FORUM HEADER (http://www.simplemachines.org/community/index.php?topic=375980.msg3499684;topicseen#msg3499684)


Try selecting "Limit honeypot on forum" for less dramatic honeypots.

 ::)
Title: Re: Bad Behavior for SMF mod
Post by: butchs on February 03, 2018, 07:48:09 AM
FYI - I tried removing the line feed at the end of the BadBehavior-SMF.php file and rewriting it into the mod install zip file. I installed Bad Behavior 1.5.20 on another forum with this edited file and it still ended up with the carriage return and a '+' sign at the end?? I don't know how it is doing this? I had to FTP this file after install and modify it again by removing the now present carriage return and '+' character at the end to stop my forum fonts from being magnified.

The BB Authors source does not have "?>" at the end.  I add it for compatibility purposes but honestly I think it makes no difference.
Title: Re: Bad Behavior for SMF mod
Post by: djkimmel on February 05, 2018, 07:51:21 PM
Did you read the FAQ and did you make the change to your settings?  I will make it easy for you, here is the link:  RANDOM CHARACTERS ABOVE FORUM HEADER (http://www.simplemachines.org/community/index.php?topic=375980.msg3499684;topicseen#msg3499684)


Try selecting "Limit honeypot on forum" for less dramatic honeypots.

 ::)

Is this directed at me? I already have that option checked. I also looked at the link and it seems we are talking about 2 completely different things...?? But then, I'm not as smart as I used to be. All I know is after I remove the + sign that looking at in code is nothing more than a + sign my fonts are no longer magnified. Hopefully, that helps other persons who are seeing this odd behavior.
Title: Re: Bad Behavior for SMF mod
Post by: djkimmel on February 05, 2018, 07:56:32 PM
FYI - I tried removing the line feed at the end of the BadBehavior-SMF.php file and rewriting it into the mod install zip file. I installed Bad Behavior 1.5.20 on another forum with this edited file and it still ended up with the carriage return and a '+' sign at the end?? I don't know how it is doing this? I had to FTP this file after install and modify it again by removing the now present carriage return and '+' character at the end to stop my forum fonts from being magnified.

The BB Authors source does not have "?>" at the end.  I add it for compatibility purposes but honestly I think it makes no difference.

I have no problem with the "?>" at the end. I've been told, I believe on this forum, that PHP can act up if there is a carriage return/line feed after the closing "?>" and there was in my case. Along with the + sign that is nothing more than a +sign. Your explanation appears to me to be unrelated to what I'm seeing. I know about the honeypots and I know what they look like when viewing source code of a displayed page. This is a + sign at the end of the PHP file. To me, completely different.

I do love and greatly appreciate your mod. But it doesn't change that somehow a + sign is ending up at the end of the PHP file and that + sign appears to be magnifying font size. Unrelated? Maybe, but when I edit the PHP file and remove the + sign my fonts go back to normal. To me... that seems like they might be related.
Title: Re: Bad Behavior for SMF mod
Post by: djkimmel on February 06, 2018, 12:22:20 PM
On a different note I'm seeing an increase in the number of undefined index User-Agent errors lately on my forums. I didn't find anything in this topic about though I thought I have read something previously on this. I checked my whitelist settings and don't have any blank or extra lines in it (seems like I read that could cause this??). Lots of Facebook IP addresses but many others involved including some bad looking characters. Error:
Code: [Select]
8: Undefined index: User-Agent
File: /home/USERNAME/public_html/forum/Sources/bad-behavior/bad-behavior/whitelist.inc.php
Line: 21
Title: Re: Bad Behavior for SMF mod
Post by: butchs on February 07, 2018, 07:45:54 AM
There was a carriage return on the Mac original source and a + in Windows notepad++ source.  In either event, I deleted it and updated the Mod to version 1.5.21 the4 other day.

No change was made to the core authors "whitelist.inc.php" source from 1.5.19 to 1.5.21.  That new error is most likely due to a typo in your whitelist as the format must be perfect.  Please see the help in the first post and the mods built in help icons.
Title: Re: Bad Behavior for SMF mod
Post by: djkimmel on February 07, 2018, 08:46:34 PM
Okay. I keep looking at my whitelist settings. I'm probably missing something.

Thanks for finding the extra characters. Appreciate it.
Title: Re: Bad Behavior for SMF mod
Post by: dekatria on July 19, 2018, 09:08:38 AM
I removed the mod, yet there is still a table smf_log_badbehavior in the database.
I believe this should be removed too when deleting the mod.
How can I now remove it?
Title: Re: Bad Behavior for SMF mod
Post by: Kindred on July 19, 2018, 12:24:46 PM
well, it does not get deleted because the method of upgrading is uninstall the old version and install the new version.

Having the table there won't hurt anything, since it won't be used... but you can always go to phpmyadmin and drop the table.
Title: Re: Bad Behavior for SMF mod
Post by: landyvlad on December 03, 2018, 11:19:20 PM
A question about this mod?
Is this really only useful where a lot of spammers are getting through and actually posting linkspam?
I'm not getting link spam posted, maybe just two examples in two years.

I ask because I already have httpBL along with "Stop Spammer" and I wonder whether there is any advantage in adding this bad behaviour mod to my forum?

Thanks
Title: Re: Bad Behavior for SMF mod
Post by: Kindred on December 04, 2018, 08:47:09 AM
no. this mod does not have any affect on linkspam, afaik.

If they are getting through your questions - then you need to revise/add questions because the ones you have are either too easy or have been cataloged
Title: Re: Bad Behavior for SMF mod
Post by: butchs on December 09, 2018, 09:58:21 AM
In addition to bad behavior code this mode includes Cloudflare anti spam abilities.
Title: Re: Bad Behavior for SMF mod
Post by: Lazybones on November 01, 2019, 09:30:33 PM
Any chance of an update for SMF 2.1? Any one try installing it anyway?
Title: Re: Bad Behavior for SMF mod
Post by: butchs on November 02, 2019, 07:16:34 AM
I developed some preliminary code but the last time I messed with the Beta's and RC's I had to re-write it all the time.  Every time there was an update it impacted my entry point.  When 2.1 is released I will update for sure.  Maybe RC 2.
Title: Re: Bad Behavior for SMF mod
Post by: Lazybones on November 02, 2019, 12:28:25 PM
I developed some preliminary code but the last time I messed with the Beta's and RC's I had to re-write it all the time.  Every time there was an update it impacted my entry point.  When 2.1 is released I will update for sure.  Maybe RC 2.

We had to move hosting and decided to take the opportunity to jump to 2.1 RC2 since it was released at the end of March. I completely understand not wanting to code against substantial changes. Sadly it only took a few days for spammers to start registering even with reCAPTCHA enabled.
Title: Re: Bad Behavior for SMF mod
Post by: butchs on November 02, 2019, 12:32:26 PM
Understood. I am bogged down with a Cisco firewall that was replaced with a RMA.  Nothing is easy there... as they sent the wrong stuff again.
Title: Re: Bad Behavior for SMF mod
Post by: Kindred on November 04, 2019, 11:17:32 AM
reCPATCHA is almost as useless as CAPTCHA was, at this point.

Questions were, are, and will be the BEST method of spammer registration control.

even Bad Behavior will allow some through -- questions (especially in combination) are the BEST METHOD! :)
Title: Re: Bad Behavior for SMF mod
Post by: Lazybones on November 04, 2019, 11:21:50 AM
Humans might be registering the accounts and then posting with a script later. There seems to be sever days between registration and the first post.

We have several questions that are in place and have now changed them as well.

I had about three ani spam plugins running prior to the 2.1 RC2 upgrade in addition to questions.

Bad Behaviour just happened to be a fairly essential one according to our logs.
Title: Re: Bad Behavior for SMF mod
Post by: StarScream123 on December 29, 2019, 03:26:31 AM
reCPATCHA is almost as useless as CAPTCHA was, at this point.

Questions were, are, and will be the BEST method of spammer registration control.

even Bad Behavior will allow some through -- questions (especially in combination) are the BEST METHOD! :)

I've been using obscure questions that only people who are fans of my website would know and bots still seem to get through. It really is a never ending flood no matter what you do.
Title: Re: Bad Behavior for SMF mod
Post by: Kindred on December 30, 2019, 11:52:32 AM
Well, I have no had a single spammer get through both questions and bad behavior in 3 years now.

You need
1- 20+ questions, asking 2-3 per registration
2- change your question set at least yearly.

Title: Re: Bad Behavior for SMF mod
Post by: Ninja ZX-10RR on January 12, 2020, 12:47:58 PM
I can't find any references (in here, at least) that point to it but I'm rather baffled nobody ever mentioned/noticed that this mod, in smf_log_badbehavior uses "key" as a column name. Key is a reserved word (https://dev.mysql.com/doc/refman/5.5/en/keywords.html#keywords-5-5-detailed-K) and cannot be used as such...
It will instantly jam any upgrade procedure from ISO to UTF8, and it's overall just bad practice to use it I'd say. Luckily, since it jams, it won't corrupt any data so it's still safe to try to ugprade.

Pretty surprised since the rest of the mod is great and always used it on multiple sites, didn't see this one coming :P It would be nice if you could update it by simply renaming it in the db and files. Either way, I pointed it out and still thanks for an otherwise extremely solid mod :)
Title: Re: Bad Behavior for SMF mod
Post by: butchs on February 02, 2020, 01:49:39 PM
Gladly but "Key"DB column name is part of the core and I will only modify the code to allow support of SMF.  I suggest you request the change with he owner of the core  Michael Hampton at https://bad-behavior.ioerror.us.  If He  changes the column name, I will have to change my code to support it.