News:

Bored?  Looking to kill some time?  Want to chat with other SMF users?  Join us in IRC chat or Discord

Main Menu

Stop Spammer

Started by M-DVD, December 31, 2008, 07:31:43 AM

Previous topic - Next topic

EL34xyz

I am having to do the same thing as ZBWDO every day and sometimes 5 or more times
I am getting bombarded with spammers
I also have the "Reason for joining" mod installed, but they have automated their join reasons
The reason for joining adds another layer of automated spambot protection in most cases.

I do see that most of the spammers show up in red by the time I get the email to approve them.

Here's is the dance I have to go through every time.

Approve them without sending them an email
Report them again to the spammers data base because they are using a new user name, email or Ip address.
Go to their profile and ban them, checking all three of the ban triggers at the bottom of the screen
Go back to the members list and delete them as a member

I wish there was more of an automated process that could take care of all of the steps I have to go through with each spammer

ZBWDO

EL34xyz,

I had not yet read Snoopy's recommendation to install the httpBL mod when I had already found and installed the Anti-Spam Verification Questions mod.  This did the trick!  I am down to ZERO spambot registrations a day.  I may still install the httpBL because, unless I'm reading the description incorrectly, it sound like those spambots can't even troll my forum (is that true, Snoopy?).  But, in the intermediary, I'm just absolutely thrilled that for several days now there have been ZERO new spambot registrations!  Note that this mod installed and works just fine on 1.1.11.

geekartist

I'm having a situation I can't find any info on. We're using version 2.3.7 with SMF 1.1.11.

Basically, when an admin uses the links on the left to go to to Members and also Members > View All Members/Search For Members/Awaiting Approval/Awaiting Activation it generates many pages of error reports (in the admin error log) immediately.

It looks like it may be generating a report for every member, but the name on the error message in the log is the admin's name. So we see something like this:

...com/forums/index.php?action=viewmembers
8: Undefined index: stopspammer_enable
File: /home/ladyofth/public_html/forums/Themes/default/ManageMembers.template.php (view_members sub template - eval?)
Line: 83
   
....com/forums/index.php?action=viewmembers
8: Undefined index: stopspammer_enable
File: /home/ladyofth/public_html/forums/Sources/StopSpammer.php
Line: 127
   
.....com/forums/index.php?action=viewmembers
8: Undefined index: stopspammer_enable
File: /home/ladyofth/public_html/forums/Sources/StopSpammer.php
Line: 124

And those last 2 errors repeat for pages and pages. Near as I can tell, somehow Stop Spammer has decided to start running a report on every member on the list. I don't see anything in the settings that may be causing this. Any idea how to correct the situation?

ZBWDO

A couple of things that I can think of to try, though I am a bit new at this and you may want to wait for more expert help.

1.  Uninstall and reinstall the mod
2.  Find and repair any errors.    (Under Admin > Forum Maintenance > Find and repair any errors. (at the top, 3rd option)

Oya

geekartist - what language you are using? if youre not using english you may have to copy the changes from modifications.english.php to whatever language you are using

snoopy_virtual

Quote from: EL34xyz on September 27, 2010, 03:54:44 PM
I am having to do the same thing as ZBWDO every day and sometimes 5 or more times
I am getting bombarded with spammers
I also have the "Reason for joining" mod installed, but they have automated their join reasons
The reason for joining adds another layer of automated spambot protection in most cases.

I do see that most of the spammers show up in red by the time I get the email to approve them.

Here's is the dance I have to go through every time.

Approve them without sending them an email
Report them again to the spammers data base because they are using a new user name, email or Ip address.
Go to their profile and ban them, checking all three of the ban triggers at the bottom of the screen
Go back to the members list and delete them as a member

I wish there was more of an automated process that could take care of all of the steps I have to go through with each spammer

I don't understand why you need to approve any spammer.

Every time a spammer register in any of my forums I just report them to de StopForumSpam database if there is some new data (not already in the DB) and "reject" all of them.

I never approve any of them and, as I told ZBWDO before, I don't use the SMF ban system, because with my other mod httpBL the spammers ban themselves automatically.

I think I have said already a few times that I administer a lot of forums, but it only take me 5 minutes every day to reject the bad guys from all of them.

Quote from: ZBWDO on September 28, 2010, 06:21:06 AM
EL34xyz,

I had not yet read Snoopy's recommendation to install the httpBL mod when I had already found and installed the Anti-Spam Verification Questions mod.  This did the trick!  I am down to ZERO spambot registrations a day.  I may still install the httpBL because, unless I'm reading the description incorrectly, it sound like those spambots can't even troll my forum (is that true, Snoopy?).  But, in the intermediary, I'm just absolutely thrilled that for several days now there have been ZERO new spambot registrations!  Note that this mod installed and works just fine on 1.1.11.

I didn't know that mod, and it looks interesting.

It uses the same idea I used when I did my captcha system for mod httpBL, leaving some fields blanks on purpose (spam bots always write something in them).  ;D

I'm going to install it also in some of my forums. Not in all of them, because I want to see the difference with and without that Anti-Spam Verification Questions mod.

Anyway, this mod (as my StopSpammer mod) only protect you when a bot try to register in your forum. But they can see your forum and use any information they can gather for their spams.

Mod httpBL works before they can even see your forum.

You can find more info about all this inside the tutorial I'm writing here:

http://www.snoopyvirtualstudio.com/tutoriales/index.php?estudio=httpBL_2

It's not finished but it has a lot of info already.

==================

By the way, with both mods installed (StopSpammer and httpBL) most of my mods only get 1 or 2 spambot registrations a month.

Only a couple of my forums (the old ones and most famous, with thousands of visits every day) get 2 or 3 registrations a day. So in total I only need to check 5 or so new spammers a day. That's why it only takes me 5 minutes to check them. Before I started working on my anti-spam system I needed like 3 or 4 hours every day.  ;)

El verdadero sabio es aquel que lo ve todo, lo estudia todo, lo analiza todo y molesta poco.
A true wise man is he who sees everything, studies everything, analyses everything and hardly ever annoys.

snoopy_virtual

Quote from: geekartist on September 28, 2010, 06:37:13 AM
I'm having a situation I can't find any info on. We're using version 2.3.7 with SMF 1.1.11.

Basically, when an admin uses the links on the left to go to to Members and also Members > View All Members/Search For Members/Awaiting Approval/Awaiting Activation it generates many pages of error reports (in the admin error log) immediately.

It looks like it may be generating a report for every member, but the name on the error message in the log is the admin's name. So we see something like this:

...com/forums/index.php?action=viewmembers
8: Undefined index: stopspammer_enable
File: /home/ladyofth/public_html/forums/Themes/default/ManageMembers.template.php (view_members sub template - eval?)
Line: 83
   
....com/forums/index.php?action=viewmembers
8: Undefined index: stopspammer_enable
File: /home/ladyofth/public_html/forums/Sources/StopSpammer.php
Line: 127
   
.....com/forums/index.php?action=viewmembers
8: Undefined index: stopspammer_enable
File: /home/ladyofth/public_html/forums/Sources/StopSpammer.php
Line: 124

And those last 2 errors repeat for pages and pages. Near as I can tell, somehow Stop Spammer has decided to start running a report on every member on the list. I don't see anything in the settings that may be causing this. Any idea how to correct the situation?

I haven't seen this errors in any of the forums where I have the mod installed and it hasn't been reported before by anybody else, so you must have something wrong in your installation.

Let's try to find put what can it be:

Quote from: ZBWDO on September 28, 2010, 06:49:35 AM
A couple of things that I can think of to try, though I am a bit new at this and you may want to wait for more expert help.

1.  Uninstall and reinstall the mod
2.  Find and repair any errors.    (Under Admin > Forum Maintenance > Find and repair any errors. (at the top, 3rd option)

Uninstall and reinstall the mod would be an idea, but I don't think "Find and repair any errors" is going to sort your problem automatically.

It looks to me more like a problem installing it, not like a problem any "Forum Maintenance" function can repair automatically.

Anyway you can try both things and let us know if it sorted the problem.

By the way, I suppose you installed it using the proper "SMF Packages Manager". Am I right?

Quote from: Oya on September 28, 2010, 07:00:49 AM
geekartist - what language you are using? if youre not using english you may have to copy the changes from modifications.english.php to whatever language you are using

This mod has been translated to a lot of different languages, so I suppose geekartist must have installed the proper version for whatever language is using. Am I right?

=================

Just one small question while you try this couple of things ZBWDO suggested and you answer us the question about the language:

Can you look inside the folder of the Theme you are using and see if you have inside it any of these files?


  • ManageMembers.template.php
  • Register.template.php

If you have any of them the installation process is slightly different than normal.

In the mean time I will continue thinking to see if I find out any more things I can suggest to sort your problem.

El verdadero sabio es aquel que lo ve todo, lo estudia todo, lo analiza todo y molesta poco.
A true wise man is he who sees everything, studies everything, analyses everything and hardly ever annoys.

gizmo71

Quote from: Storman on April 13, 2010, 02:58:11 PM
8: Undefined index: types
File: /var/www/vhosts/mysite.com/httpdocs/forum/Sources/ManageMembers.php
Line: 381

Got bored of seeing that so I tracked it down and fixed it. Just change
serialize(array('mem_id' => $memID))
to
serialize(array('mem_id' => $memID, 'types' => array('mem_id' => '=')))

and everything will be lovely. :)

And thank you for this wonderful mod. It's not only stemmed the tide of spam we were experiencing, but opened my eyes to the hundreds of URL and signature spammers we'd collected in the last few months.

EL34xyz

#768
QuoteSnoopy: I don't understand why you need to approve any spammer.

So I can ban them and have all their info go into the triggers list
Then when they return to my forum they are on a ban list for three different triggers and must change something to be able to try and join again
I am out to hassle them as much as they hassle me
This is what they see when they return

Sorry guest, you are banned from using this forum

Full sized image can be seen here
http://www.el34world.com/Misc/images/spammer3.gif



They are banned and cannot use any of the previous ban triggers to try and re-register
This at least makes them do some work instead of just using their automated software.

Do you understand now?

EL34xyz

#769
ZBWBO,
I am not sure what you are saying

I already have a mod installed that ask the question "Why do you want to join this forum"
The mod is called "Join Reason"
The applicants have to type something related to my forum subject
That way I can tell if they are spammers or actually know something about the subject matter

The spammers are able to automate the registration screen including the Join Reason field, but they always use the same reasons

What I want to be able to do is have the registration screen check a list of know Join Reasons
If the know spammer reason is on the list, then stop then stop them from registering.
But this is something that I am asking the Join Reason mod author to look into

For example, in this screen shot
This spammer always uses the join reason - To have fun :)

Check out this screen shot
See the reason for joining this forum on the right side

Full sized image can be seen here
http://www.el34world.com/Misc/images/spammer2.gif


snoopy_virtual

Quote from: gizmo71 on September 28, 2010, 11:19:33 AM
Quote from: Storman on April 13, 2010, 02:58:11 PM
8: Undefined index: types
...

Got bored of seeing that so I tracked it down and fixed it. Just change
serialize(array('mem_id' => $memID))
to
serialize(array('mem_id' => $memID, 'types' => array('mem_id' => '=')))

and everything will be lovely. :)

OMG! That's it!

Thanks a lot gizmo71. Do you know how many hours I spent tracking down this bug without finding it?

The first time I saw it in my error logs was more than a year ago and, since then, I have been trying to sort it every time I had some spare time without any luck at all. Not to mention every time somebody has reported this bug I had to tell them "I know, I will sort it as soon as I can..." etc.

Of course I was not too worried about it, because it's not a dangerous bug. The mod worked perfect, but it was really annoying to see it coming to your error logs all the time.

Well, now thanks to you it's finally sorted.  ;)

Quote from: gizmo71 on September 28, 2010, 11:19:33 AM
And thank you for this wonderful mod. It's not only stemmed the tide of spam we were experiencing, but opened my eyes to the hundreds of URL and signature spammers we'd collected in the last few months.

You're welcome. And thank you again.  ;)

El verdadero sabio es aquel que lo ve todo, lo estudia todo, lo analiza todo y molesta poco.
A true wise man is he who sees everything, studies everything, analyses everything and hardly ever annoys.

snoopy_virtual

Quote from: EL34xyz on September 28, 2010, 02:46:25 PM
Quote from: snoopy_virtual on September 28, 2010, 10:00:58 AM
I don't understand why you need to approve any spammer.

So I can ban them and have all their info go into the triggers list
...
etc
...
Do you understand now?

Well, I know perfectly well how the SMF ban system works, because I have been using it for years.

I started using it the first time I started using SMF for all my forums (a lot of years ago) and I was using it until 2 years ago. So I think I understand what you are saying.

I think is you who don't understand the reason why I stopped using it and why I told you you don't need it.

Let me try to explain it a little better:

I work designing web sites and writing PHP programs for these sites. Every time a site need a forum I use SMF.

Sometimes the site owners know enough coding to administer the forum themselves, so I just do the design, install SMF for them and maybe write a few mods for the site if there is not one already available to do exactly what they want. But after that I leave them on their own to continue from there.

But sometimes they want me to stay like and admin to improve their site security, update all the programs, write new mods for them every time they need something new, etc.

That's why 2 years ago I was already the admin of 10 different forums. Some of them had already become really famous and had thousands of visits a day.

Of course, at the beginning (4 or 5 years ago) I was the admin of very few forums and none of them was really well known, so I was having to deal only with one spammer a month more or less. So it was not a problem to track them down, ban them and delete their posts.

But the amount of spammers went up and up and at the end (2 years ago) I was having like a hundred a day. So it was taking me a minimum of 3 hours a day (some times even 8 or 10 hours) to ban all of them, delete all their posts etc.

That was when I thought I needed to do a program to do all that as automatic as possible. So I started working with my friend M-DVD (who has already started to write this mod StopSpammer) helping him to do the mod as good as possible, and I started writing also my other mod httpBL.

I'm not going to tell you how mod httpBL works, because I already gave you a link to a very big tutorial where you can read a long explanation. What I am telling you is that, with both mods installed on my forums, I don't need now to ban anybody, because the spammers ban themselves automatically. And I only need now 5 minutes a day to deal with all the spammers in all my forums.

Quote from: EL34xyz on September 28, 2010, 02:54:36 PM
ZBWBO,
I am not sure what you are saying

I already have a mod installed that ask the question "Why do you want to join this forum"
The mod is called "Join Reason"
...
etc

Well, I think what ZBWDO is telling you is that instead of the mod you have just now ("Join Reason") you should have the other mod he is suggesting ("Anti-Spam Verification Questions").

And I agree with that. I have been studying both mods (reading the source code) and I think the mod you have (the way it is just now) is not protecting you at all. If the owner of the mod is not going to change it you should consider installing the other one instead.

What I was telling you both (EL34xyz and ZBWDO) is that mods like "Join Reason", "Anti-Spam Verification Questions", my mod "Stop Spammer", etc, only protect you against "Comment" spammers, but don't protect you at all against "Harvesters" and the rest of different spammers, so apart from this mods you should have some other mods like my mod "httpBL" and/or any similar one. For example "Bad Behavior mod" ( http://custom.simplemachines.org/mods/index.php?mod=2502 ) from our friend butchs is another good mod and fully compatible with mod "Stop Spammer" and mod "httpBL".

Of course, the amount of anti-spam mods you should have in your forum depends on the amount of visits you have, etc. What you need is to have as less spammers and as less hassle as possible.

In some forums I only have "Stop Spammer" and "httpBL" and that's enough for these forums. In other forums I need a lot more protection so apart from these 2 mods I have also a few more.

But of course, it's up to you.  ;)

El verdadero sabio es aquel que lo ve todo, lo estudia todo, lo analiza todo y molesta poco.
A true wise man is he who sees everything, studies everything, analyses everything and hardly ever annoys.

EL34xyz

Snoopy, Thanks for the info
BTW, you don't have to go into long explanations of all your forum experience, I know who you are.

Let me see if I understand your Httpbl mod correctly by this statement

QuoteMOD Stop Spammer cheks if the visitor is a spammer when they try
to register inside the forum while MOD httpBL checks them as soon as they arrive
to the forum and redirect them to a file called warning.php making
the whole site invisible to them.

This way even harvesters (robots that never post in a forum, but search for email addresses
to send them spam later) and any other kind of malicious web robots
cannot even see any part of the site.

Are you saying that the registration screen would be invisible if they are in the honey pot database?

How many triggers need to be fulfilled before this happens?
Username - Ip address and email address?
All three items or just one trigger?

I would not want someone with a common user name to be banned from joining just because his name happens to be somthing a spammer used at one time.

BTW, I am the admin and I must approve all applicants
No one can join automatically and start posting

snoopy_virtual

#773
Quote from: EL34xyz on September 29, 2010, 12:01:23 PM
Are you saying that the registration screen would be invisible if they are in the honey pot database?

Exactly. If they are in honey pot database they see only the warning page. Nothing else. Not even the registration screen.

Quote from: EL34xyz on September 29, 2010, 12:01:23 PM
How many triggers need to be fulfilled before this happens?
Username - Ip address and email address?
All three items or just one trigger?

I would not want someone with a common user name to be banned from joining just because his name happens to be somthing a spammer used at one time.

The honey pot database works only with IPs. They don't care about usernames or email addresses.

But they don't work with IPs on a static way, but dynamic, assigning a "Threat Level" number to every IP. And this number is changing every day, depending on what is detected from that particular IP. But I suppose you have already read all that in the tutorial.

===================

Anyway, if you are planning to install mod httpBL maybe it would be better if you wait a few days. I'm working just now on a new version and, if you install it now, you will need to upgrade it as soon as I have this new version finished.

I cannot be sure when this new version will be ready, but it can be anything from 2 days to maybe a week.

El verdadero sabio es aquel que lo ve todo, lo estudia todo, lo analiza todo y molesta poco.
A true wise man is he who sees everything, studies everything, analyses everything and hardly ever annoys.

busterone

Nice work snoopy. I was considering installing it myself, but will now wait for the updated version. I don't get but one or two spammers a week that I have to manually deny now due to Stop Spammer, but I also want to stop the harvesters as well.
I have been using Stop Spammer for a little over a year, and as of today, it reports that 6501 spammers have been stopped from registering to date. Great results.  :)

EL34

Ok, thanks snoop, I will wait a few days

I still think it is helpfull to read an actual typed in reason for joining the forum as one more line of defense.

If the IP is not on file in the data base, it is possible for them to sneak by me.

It's very obvious when I see a written reason for joining if they know anything about the subject of the forum or they are just blowing smoke.
Ok so the line of defense would go like this

1-Httpbl would block the registration right up front for a know spammer, but only if they are listed in one of the two databases.

2-Stop Spammer would tell me if they are a known spammer in a different database

3-Join reason gives me some text to analyze and make a desision based on that ( or some other mod that lets me see some hand written text)

It is really getting that bad enough that I need all these layers in place
Forum History -> EZBoard -> YABB -> SMF 1.1.19 -> SMF 2.0.19

snoopy_virtual

Check this:

http://www.simplemachines.org/community/index.php?topic=366399.msg2529450#msg2529450

It is a nice picture Wizzlefits did explaining how both mods work together.

And yes, it is really getting very bad. In some forums I need even 5 layers or more to be protected:

* Crawltrack from http://www.crawltrack.net
* Mod Bad Behavior
* Mod httpBL
* Mod Stop Spammer
* Mod Anti-Spam Verification Questions

And I am also helping butchs testing his new mod "Forum Firewall" to add it as well as soon as he finish it.  ;D

El verdadero sabio es aquel que lo ve todo, lo estudia todo, lo analiza todo y molesta poco.
A true wise man is he who sees everything, studies everything, analyses everything and hardly ever annoys.

KensonPlays

forum firewall, sounds interesting! smf 1.x? smf 2.x? both?

snoopy_virtual

Quote from: Kcmartz on September 30, 2010, 01:11:32 AM
forum firewall, sounds interesting! smf 1.x? smf 2.x? both?

Unfortunately for me only smf 2.x just now, but I see it's ok for you though.

But you should talk with butchs about it if you are interested.  ;)

El verdadero sabio es aquel que lo ve todo, lo estudia todo, lo analiza todo y molesta poco.
A true wise man is he who sees everything, studies everything, analyses everything and hardly ever annoys.

geekartist

Quote from: snoopy_virtual on September 28, 2010, 10:27:54 AM
Quote from: geekartist on September 28, 2010, 06:37:13 AM
I'm having a situation I can't find any info on. We're using version 2.3.7 with SMF 1.1.11.

Basically, when an admin uses the links on the left to go to to Members and also Members > View All Members/Search For Members/Awaiting Approval/Awaiting Activation it generates many pages of error reports (in the admin error log) immediately.

It looks like it may be generating a report for every member, but the name on the error message in the log is the admin's name. So we see something like this:

...com/forums/index.php?action=viewmembers
8: Undefined index: stopspammer_enable
File: /home/ladyofth/public_html/forums/Themes/default/ManageMembers.template.php (view_members sub template - eval?)
Line: 83
   
....com/forums/index.php?action=viewmembers
8: Undefined index: stopspammer_enable
File: /home/ladyofth/public_html/forums/Sources/StopSpammer.php
Line: 127
   
.....com/forums/index.php?action=viewmembers
8: Undefined index: stopspammer_enable
File: /home/ladyofth/public_html/forums/Sources/StopSpammer.php
Line: 124

And those last 2 errors repeat for pages and pages. Near as I can tell, somehow Stop Spammer has decided to start running a report on every member on the list. I don't see anything in the settings that may be causing this. Any idea how to correct the situation?

I haven't seen this errors in any of the forums where I have the mod installed and it hasn't been reported before by anybody else, so you must have something wrong in your installation.

Let's try to find put what can it be:

Quote from: ZBWDO on September 28, 2010, 06:49:35 AM
A couple of things that I can think of to try, though I am a bit new at this and you may want to wait for more expert help.

1.  Uninstall and reinstall the mod
2.  Find and repair any errors.    (Under Admin > Forum Maintenance > Find and repair any errors. (at the top, 3rd option)

Uninstall and reinstall the mod would be an idea, but I don't think "Find and repair any errors" is going to sort your problem automatically.

It looks to me more like a problem installing it, not like a problem any "Forum Maintenance" function can repair automatically.

Anyway you can try both things and let us know if it sorted the problem.

By the way, I suppose you installed it using the proper "SMF Packages Manager". Am I right?

Quote from: Oya on September 28, 2010, 07:00:49 AM
geekartist - what language you are using? if youre not using english you may have to copy the changes from modifications.english.php to whatever language you are using

This mod has been translated to a lot of different languages, so I suppose geekartist must have installed the proper version for whatever language is using. Am I right?

=================

Just one small question while you try this couple of things ZBWDO suggested and you answer us the question about the language:

Can you look inside the folder of the Theme you are using and see if you have inside it any of these files?


  • ManageMembers.template.php
  • Register.template.php

If you have any of them the installation process is slightly different than normal.

In the mean time I will continue thinking to see if I find out any more things I can suggest to sort your problem.

There is a lot here, so I'll just answer all of you at the bottom (thanks so much for the input, BTW).

Haven't installed and reinstalled, as I'm a little hesitant about doing that just yet since this is an inherited project. Was hoping to make that a last resort but if no one has other ideas, I'll schedule that for the next day or so (although please read to the end...I did find something interesting...). Someone else installed the forum and the packages. The Stop Spammer package was a fairly recent installation (past month or so). And yes, repair feature didn't find anything going on with this.

Oya, it's spitting out content in English, so I'm assuming it is set to that. I don't actually see where to set a language, although I do see a forum setting that allows users to choose their own language to post in. Is that what you are referring to? Or is do I need to locate modifications.english.php to set the language? (Or is there another PHP file it's set in that I'm not locating info on?)

I do see ManageMembers.template.php and Register.template.php. So perhaps something went wonky in the installation if these were present during the install and the person setting it up wasn't aware how those files can impact the install?

Also, I also see ManageCalendar.template.php~. I see a number of files in the theme directory and a few others with a tilde (~) at the end of the file name. Could this be a contributing problem? Is that normal for SMF? Seems a little odd to me.

Advertisement: