News:

Join the Facebook Fan Page.

Main Menu

httpBL

Started by Diego Andrés, February 17, 2010, 03:55:54 PM

Previous topic - Next topic

landyvlad

OK so it seems it is working.  In the last 4 days it has detected and stopped (according to the spammers log page) 8 attempts, from 3 different IP addresses in total.

At the same time though an average of two a day are getting through past this to be intercepted by the "stop spammer' mod.

I couldn't find anything which details the difference between the various 'logs' so am seeking some guidance on this:

The 'humans log' indicates that two high threat ones have been stopped (and these are from the same IP as 6 of those in the 'spammers log'. It was also detected stopped 7 medium threat and one low threat attempt.

How does it know / decide whether it is a bot or human spammer attack?  I presume that's what the difference between these two logs is.


What is the "Errors Log" ?  As in what does it record - what sort of 'errors' ?
In the brief time this mod has been up and running, the errors log extends to 94 pages!
Also the IP column of that log has strange (non IP) codes in it eg. 2a02:c7f:d81b:a0  so obviously recording something different and just displaying it there?

Thanks for your help.
"Put as much effort into your question as you'd expect someone to give in an answer"

Please do not PM, IM or Email me with questions on astrophysics or theology.  You will get better and faster responses by asking homeless people in the street. Thank you.

Be the person your dog thinks you are.

snoopy_virtual

Quote from: landyvlad on March 26, 2017, 09:49:41 PM
The 'humans log' indicates that two high threat ones have been stopped (and these are from the same IP as 6 of those in the 'spammers log'. It was also detected stopped 7 medium threat and one low threat attempt.

How does it know / decide whether it is a bot or human spammer attack?  I presume that's what the difference between these two logs is.

The Humans log is where you can see the visitors who have seen the captcha inside the warning page and who have answered the questions.

Only humans should be able to answer those questions. (That's how the program knows if they are human or robots).

But it looks like you are getting spam-bots who are visiting your site and answering the questions.

That means you haven't made the change to the warning page I suggested (or you have don't it wrong).

In all my sites I usually get something like 100 entries per day in the spammers log but just 1 or 2 per week in the humans log.

Quote from: landyvlad on March 26, 2017, 09:49:41 PM
What is the "Errors Log" ?  As in what does it record - what sort of 'errors' ?
In the brief time this mod has been up and running, the errors log extends to 94 pages!
Also the IP column of that log has strange (non IP) codes in it eg. 2a02:c7f:d81b:a0  so obviously recording something different and just displaying it there?

The entries in the Errors log are all the errors inside the program so it should be always empty unless there is something wrong with the mod.

I already told you it would be a lot easier for me to see what's wrong if we could talk using Skype and I could take a look at your site using Teamviewer.

El verdadero sabio es aquel que lo ve todo, lo estudia todo, lo analiza todo y molesta poco.
A true wise man is he who sees everything, studies everything, analyses everything and hardly ever annoys.

landyvlad

OK snoopy I'll get to work on getting skype working in next few days.  Cheers mate.
"Put as much effort into your question as you'd expect someone to give in an answer"

Please do not PM, IM or Email me with questions on astrophysics or theology.  You will get better and faster responses by asking homeless people in the street. Thank you.

Be the person your dog thinks you are.

edi1967

hi snoopy i using your Who.template of here:

http://www.simplemachines.org/community/index.php?topic=366399.msg2816231#msg2816231

but i have one little problem in your Who.template there are a couple of strings that i have not translated in my italian forum so them create me errore.
Please you could help me and tell me them translation?

$txt[139] = ?
$txt[92] = ?

thank you so much



snoopy_virtual

That was done 7 years ago and it was for SMF 1. That's why you cannot find those old $txt entries.

If you are using SMF 2 that page shouldn't work properly. Is it working for you?

Anyway, if you check the source code of SMF 1, in the file /Themes/default/languages/index.english.php you can see:


$txt[139] = 'Pages';
$txt[92] = 'View the profile of';

El verdadero sabio es aquel que lo ve todo, lo estudia todo, lo analiza todo y molesta poco.
A true wise man is he who sees everything, studies everything, analyses everything and hardly ever annoys.

edi1967

Quote from: snoopy_virtual on May 02, 2017, 06:39:43 AM
That was done 7 years ago and it was for SMF 1. That's why you cannot find those old $txt entries.

If you are using SMF 2 that page shouldn't work properly. Is it working for you?


Work perfectly in SMF 2.0.13

Thxnk you

skitty

just out of curiosity i keep getting Type of error: Undefined in the logs for the forums. its been happening it for a while but i never really looked at it that much.

snoopy_virtual

Quote from: skitty on May 21, 2017, 04:32:02 PM
just out of curiosity i keep getting Type of error: Undefined in the logs for the forums. its been happening it for a while but i never really looked at it that much.

Could you copy the exact error you are getting and paste it here?

I mean the full text.

Just "Type of error: Undefined" could be almost anything.

El verdadero sabio es aquel que lo ve todo, lo estudia todo, lo analiza todo y molesta poco.
A true wise man is he who sees everything, studies everything, analyses everything and hardly ever annoys.

landyvlad

I've been seeing a MASSIVE increase in Spammers over the lest few weeks.

It's only a small forum www.gsx1400owners.org ,  running SMF 2.0.13
I am running this httpBL mod as well as Stop Spammer mod (I'll ask there as well). Current versions of course.

Where we previously might have had to manually reject one or two a week, we are now manually rejecting at least 10 (often many more) each day. A few are even getting through to the forum itself (not being intercepted at all)

I get that they are largely being stopped and popped into the moderation queue BUT these are usually flagged red (spammers) against both the IP AND email address.  I'd have thought it should automatically boot those, rather than leave them for moderation?  That is, shouldn't they be intercepted and 'killed' before even making it to the possibility if registering.. which appears to be what's happening?

If you have any advice about how I should be addressing this issue, I'd be most appreciative.


(oh and one secondary question - I'm considering updating, I assume no problems between this mod and SMF2.0.14? )
"Put as much effort into your question as you'd expect someone to give in an answer"

Please do not PM, IM or Email me with questions on astrophysics or theology.  You will get better and faster responses by asking homeless people in the street. Thank you.

Be the person your dog thinks you are.

Kindred

Add good questions
Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

ms_ukyankee

QuoteI've been seeing a MASSIVE increase in Spammers over the lest few weeks.

I get this once or twice a year and I notice it drops off again if I change the questions and answers when I notice an increase. I'm guessing they use a bot to auto-fill answers, so if the answers change it doesn't work anymore. It seems to solve the problem for a few months.
SMF since 2004 <3

Kindred

You should have at least 20 questions in the stack and ask 2-3 at registration.
Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

landyvlad

Twenty? Ouch ?!
I had a single Q&A.  That's now deleted

I now have 6 Q&A with a requirement of 2 to be answered.  Will see how that goes, thanks.

(Out of interest I don't suppose that if a bot does get through there is any way of knowing what question was compromised? ) 
"Put as much effort into your question as you'd expect someone to give in an answer"

Please do not PM, IM or Email me with questions on astrophysics or theology.  You will get better and faster responses by asking homeless people in the street. Thank you.

Be the person your dog thinks you are.

Kindred

Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

landyvlad

The changes seemed to have stemmed the flow back to close to 'normal'. Thanks
"Put as much effort into your question as you'd expect someone to give in an answer"

Please do not PM, IM or Email me with questions on astrophysics or theology.  You will get better and faster responses by asking homeless people in the street. Thank you.

Be the person your dog thinks you are.

Torngate

First I wanna say I love this mod, but I've been having two errors pop up in my logs with alarming frequency (Thousands a day, somehow?) that don't seem to be impacting performance on the site or the mod, yet show up and I can't say I understand them.

First, a "general" class error.

8: Undefined variable: ip
Apply Filter: Only show the errors from this file
File: /blahblahblahblah/forum/Sources/httpBL_Subs.php
Line: 519

and a "Uncategorized" error

2: Missing argument 1 for httpBL_look_for_empty_ip(), called in /home2/shadowi7/public_html/forum/Sources/httpBL_Subs.php on line 680 and defined
Apply Filter: Only show the errors from this file
File: /thingstuffthing/forum/Sources/httpBL_Subs.php
Line: 517

Any idea how to fix those? They seem to happen at random, when a user does a lot of things.

Any help would be appreciated!

Forum Version: SMF 2.0.15,
PHP: 7.0.25
Server version: Apache

I can provide more information if needed.

Thanks!
Site Administrator- Shadow Fleet Star Trek RPG

snoopy_virtual

@Torngate

Sorry.

This is a known bug that I discovered ages ago, but never found time to sort.

Look inside your Sources folder for the file httpBL_Subs.php

Inside that file look for the line:


$ip = httpBL_look_for_empty_ip();


Replace with:


$ip = httpBL_look_for_empty_ip($ip);


And that's it. Problem sorted.

El verdadero sabio es aquel que lo ve todo, lo estudia todo, lo analiza todo y molesta poco.
A true wise man is he who sees everything, studies everything, analyses everything and hardly ever annoys.

Torngate

Quote from: snoopy_virtual on December 02, 2017, 01:13:11 PM
@Torngate

Sorry.

This is a known bug that I discovered ages ago, but never found time to sort.

Look inside your Sources folder for the file httpBL_Subs.php

Inside that file look for the line:


$ip = httpBL_look_for_empty_ip();


Replace with:


$ip = httpBL_look_for_empty_ip($ip);


And that's it. Problem sorted.

This worked great! Thank you!
Site Administrator- Shadow Fleet Star Trek RPG

landyvlad

I was having the same issue so have now done this fix. Ta.

Would this impact the number of dodgy types sneaking past the mod and ending up in the 'requires approval' queue?  Because since the 2.0.15 upgrade that has gone up significantly.

(nb I also have 'stop spammer' and have followed the reinstall and file edit that kindred advised and that seems to be working fine.

"Put as much effort into your question as you'd expect someone to give in an answer"

Please do not PM, IM or Email me with questions on astrophysics or theology.  You will get better and faster responses by asking homeless people in the street. Thank you.

Be the person your dog thinks you are.

dynaweb

Thanks for the great mod!
FSS to HTML Widget [nofollow] - Snowboarding Forums [nofollow]

Advertisement: