[ABD] phpBB spam hammer

Any abandoned MODs will be moved to this forum.

WARNING: MODs in this forum are not currently being supported or maintained by the original MOD author. Proceed at your own risk.
Forum rules
IMPORTANT: MOD Development Forum rules

WARNING: MODs in this forum are not currently being supported nor updated by the original MOD author. Proceed at your own risk.
User avatar
heredia21
Registered User
Posts: 942
Joined: Sun Apr 18, 2010 6:14 pm
Contact:

Re: [DEV] phpBB spam hammer

Post by heredia21 » Sun Feb 27, 2011 9:17 pm

dangerousprototypes wrote:You can search the characters here:
http://www.fileformat.info/info/unicode ... iew=entity

These are Han character, and you could block it with range of the characters [\x{3000}-\x{8FFF}]

/([\x{0400}-\x{04FF}]|[\x{0600}-\x{06FF}]|[\x{3000}-\x{8FFF}])+/u

Hmm this is what i have right now: 0400-04FF,0600-06FF,3100-312F

Would i just change it to 0400-04FF,0600-06FF,3000-8FFF,3100-312F?
Best BlackBerry website for all users! BlackBerry News - http://blackberryempire.com

dangerousprototypes
Registered User
Posts: 91
Joined: Fri Feb 11, 2011 5:53 am
Contact:

Re: [DEV] phpBB spam hammer

Post by dangerousprototypes » Mon Feb 28, 2011 7:31 am

These are HEX number ranges. 3000-8FFF already includes 3100-312F, so it need not be included twice.

My recommendation is to use the whole REGEX like this:

Code: Select all

/([\x{0400}-\x{04FF}]|[\x{0600}-\x{06FF}]|[\x{3000}-\x{8FFF}])+/u
/ / encapsulate the regex search string
u tell it we are using unicode characters instead of regular text
[\x{}-\x{}] tell it to look for a character in this range
(|||) - tell it to look for any of these ranges (OR)
+ tells it we want to seek one or more character in the ranges given

I realize that the comma separated list seems to work, but I have no idea why and wouldn't trust it to give proper results:
commas don't mean OR, and without the (||||) format I don't know what instruction REGEX is actually following
without u after the trailing / it searches normal text mode and should ignore any UTF8 (unicode values) as non-printable text
without + it could be searching for all, one, none, one of each, I don't really know
Please do not PM or mail with questions. Ask in the forum where everyone can share the answer.

Philthy
Registered User
Posts: 210
Joined: Tue Dec 27, 2005 10:05 am
Location: Dawlish, Devon
Contact:

Re: [DEV] phpBB spam hammer

Post by Philthy » Tue Mar 01, 2011 5:25 pm

Image The spammers have finally found my site ! :D
I've not set the spam hammer to auto delete for profile abuse,as I want to see what they are up to.
I am truly loving this :lol:

Code: Select all

sakamakaan	95.173.183.68	Tue Mar 01, 2011 4:36 pm	{Spam hammer: CHECKED PROFILE of 'sakamakaan'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
sakamakaan	95.173.183.68	Tue Mar 01, 2011 4:36 pm	{Spam hammer: CHECKED PROFILE of 'sakamakaan'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
soydayesogy	95.132.109.195	Tue Mar 01, 2011 1:42 pm	{Spam hammer: CHECKED PROFILE of 'soydayesogy'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
lsermon23s	72.130.109.146	Tue Mar 01, 2011 11:24 am	{Spam hammer: CHECKED PROFILE of 'lsermon23s'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
lsermon23s	72.130.109.146	Tue Mar 01, 2011 11:23 am	{Spam hammer: CHECKED PROFILE of 'lsermon23s'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
marcierloldx	69.80.97.156	Tue Mar 01, 2011 9:53 am	{Spam hammer: CHECKED PROFILE of 'marcierloldx'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
marcierloldx	69.80.97.156	Tue Mar 01, 2011 9:53 am	{Spam hammer: CHECKED PROFILE of 'marcierloldx'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
supleiobn	91.121.18.12	Tue Mar 01, 2011 9:31 am	{Spam hammer: CHECKED PROFILE of 'supleiobn'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
supleiobn	91.121.18.12	Tue Mar 01, 2011 9:30 am	{Spam hammer: CHECKED PROFILE of 'supleiobn'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
Dripsefurrisy	98.213.44.208	Tue Mar 01, 2011 6:47 am	{Spam hammer: CHECKED PROFILE of 'Dripsefurrisy'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
Dripsefurrisy	98.213.44.208	Tue Mar 01, 2011 6:47 am	{Spam hammer: CHECKED PROFILE of 'Dripsefurrisy'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
steasydAy	69.80.97.185	Tue Mar 01, 2011 4:57 am	{Spam hammer: CHECKED PROFILE of 'steasydAy'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
steasydAy	69.80.97.185	Tue Mar 01, 2011 4:57 am	{Spam hammer: CHECKED PROFILE of 'steasydAy'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
annenuase	222.73.85.155	Tue Mar 01, 2011 4:31 am	{Spam hammer: CHECKED SIGNATURE of 'annenuase'. DETECTED: links, ERRORS: Antispam: You can't have off-site URLs in your sig until you post a few times. Click for help. CONTENTS: [ur=http://www.spmasiteremoved]louboutins sale[/url]}	
annenuase	222.73.85.155	Tue Mar 01, 2011 4:31 am	{Spam hammer: CHECKED PROFILE of 'annenuase'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
annenuase	222.73.85.155	Tue Mar 01, 2011 4:31 am	{Spam hammer: CHECKED PROFILE of 'annenuase'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
mathildamayb	222.165.130.214	Tue Mar 01, 2011 3:44 am	{Spam hammer: CHECKED PROFILE of 'mathildamayb'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
mathildamayb	222.165.130.214	Tue Mar 01, 2011 3:44 am	{Spam hammer: CHECKED PROFILE of 'mathildamayb'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
Dapcoonobloox	95.133.178.13	Mon Feb 28, 2011 10:59 pm	{Spam hammer: CHECKED PROFILE of 'Dapcoonobloox'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
Dapcoonobloox	95.133.178.13	Mon Feb 28, 2011 10:59 pm	{Spam hammer: CHECKED PROFILE of 'Dapcoonobloox'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
outerbeauty	178.32.49.75	Mon Feb 28, 2011 10:57 pm	{Spam hammer: CHECKED PROFILE of 'outerbeauty'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
outerbeauty	178.32.49.75	Mon Feb 28, 2011 10:57 pm	{Spam hammer: CHECKED PROFILE of 'outerbeauty'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
steasydAy	69.80.97.185	Mon Feb 28, 2011 10:57 pm	{Spam hammer: CHECKED PROFILE of 'steasydAy'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
steasydAy	69.80.97.185	Mon Feb 28, 2011 10:57 pm	{Spam hammer: CHECKED PROFILE of 'steasydAy'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}	
DyncDuaddy	178.130.18.49	Mon Feb 28, 2011 9:13 pm	{Spam hammer: CHECKED PROFILE of 'DyncDuaddy'. DETECTED: profile disabled, ERRORS: Antispam: You can't have a profile yet. You need to post a few times first. Click for help.}
Go on ! it's not as steep as it looks.....

John T. Folden
Registered User
Posts: 188
Joined: Tue Sep 04, 2007 12:16 am

Re: [DEV] phpBB spam hammer

Post by John T. Folden » Tue Mar 01, 2011 5:33 pm

Philthy wrote:Image The spammers have finally found my site ! :D
:lol: I guess so!
The Blue Whale Pub - SPN/SF/F TV Discussion Forum
ZOMBIE ALERT: The Walking Dead are coming to AMC!

dangerousprototypes
Registered User
Posts: 91
Joined: Fri Feb 11, 2011 5:53 am
Contact:

Re: [DEV] phpBB spam hammer

Post by dangerousprototypes » Tue Mar 01, 2011 5:56 pm

Classic profile spam bot :) We could log the content I suppose for a cheap thrill.

The honeypot clears these users out really fast, I have pages and pages of them, none are legit. Same with the signature honeypot and the too many links honeypot.
Please do not PM or mail with questions. Ask in the forum where everyone can share the answer.

John T. Folden
Registered User
Posts: 188
Joined: Tue Sep 04, 2007 12:16 am

Re: [DEV] phpBB spam hammer

Post by John T. Folden » Tue Mar 01, 2011 6:04 pm

I haven't had ANY spambot posts make it through in over a week and since switching from reCaptcha to a simple Q&A captcha spambot registrations are down to nearly 0, as well. It hasn't stopped the human spammers, of course, but they seem to get tired of trying to edit their messages over and over again just to make one post. ;)

No one has been going for the profile that I saw but the signature field has been a big disappointment for a few of them.
The Blue Whale Pub - SPN/SF/F TV Discussion Forum
ZOMBIE ALERT: The Walking Dead are coming to AMC!

Philthy
Registered User
Posts: 210
Joined: Tue Dec 27, 2005 10:05 am
Location: Dawlish, Devon
Contact:

Re: [DEV] phpBB spam hammer

Post by Philthy » Wed Mar 02, 2011 3:23 pm

I'm so confident in this, I've gone live with it as part of my update to 3.0.8.
One thing I'm noting, is some of the bots are attempting huge posts, which fill the log.
A possible addition, and another hoop for them, would be a maximum number of characters for the first post?
I'm still tweaking, so I'm trying the existing admin function of limiting the number of links in a post.
Looking very good so far though :D
Go on ! it's not as steep as it looks.....

Sanity Check
Registered User
Posts: 11
Joined: Sat Mar 06, 2010 11:10 am

Re: [DEV] phpBB spam hammer

Post by Sanity Check » Wed Mar 02, 2011 9:59 pm

Is there a place where I can download the latest version of what you guys have put together? I've got a client (a church) that's getting hammered with spam. This would be a good solution for them.

John T. Folden
Registered User
Posts: 188
Joined: Tue Sep 04, 2007 12:16 am

Re: [DEV] phpBB spam hammer

Post by John T. Folden » Wed Mar 02, 2011 10:00 pm

Philthy wrote:A possible addition, and another hoop for them, would be a maximum number of characters for the first post?

I've gotten a few of those. :D Of course, they are usually wall to wall with links, as well. By the time all the links were removed, they'd probably be under any 'maximum number of characters' restriction. ;)
The Blue Whale Pub - SPN/SF/F TV Discussion Forum
ZOMBIE ALERT: The Walking Dead are coming to AMC!

John T. Folden
Registered User
Posts: 188
Joined: Tue Sep 04, 2007 12:16 am

Re: [DEV] phpBB spam hammer

Post by John T. Folden » Wed Mar 02, 2011 10:02 pm

Sanity Check wrote:Is there a place where I can download the latest version of what you guys have put together? I've got a client (a church) that's getting hammered with spam. This would be a good solution for them.
Download the install package from the first post, grab the latest functions_link_filer.php from SVN:
http://code.google.com/p/dangerous-prot ... -new-users

and you should be good to go. :)
The Blue Whale Pub - SPN/SF/F TV Discussion Forum
ZOMBIE ALERT: The Walking Dead are coming to AMC!

indra
Registered User
Posts: 104
Joined: Fri Dec 31, 2010 8:20 am
Location: North Sumatra - Indonesia
Name: Indra Gunawan
Contact:

Re: [DEV] phpBB spam hammer

Post by indra » Thu Mar 03, 2011 5:52 am

fantastic MOD..
thanks for made

Sanity Check
Registered User
Posts: 11
Joined: Sat Mar 06, 2010 11:10 am

Re: [DEV] phpBB spam hammer

Post by Sanity Check » Thu Mar 03, 2011 2:43 pm

Thanks for the info on where to download files. It took some doing, but I finally succeeded in installing it using AutoMOD.

Minor things to report:

I'm using PHPBB 3.0.8. I had to fix the strings in posting.php and board.php before AutoMOD could successfully modify those files.

Also, uninstall fails to remove the SQL queries.

Philthy
Registered User
Posts: 210
Joined: Tue Dec 27, 2005 10:05 am
Location: Dawlish, Devon
Contact:

Re: [DEV] phpBB spam hammer

Post by Philthy » Thu Mar 03, 2011 5:24 pm

Sanity Check wrote: I'm using PHPBB 3.0.8. I had to fix the strings in posting.php and board.php before AutoMOD could successfully modify those files.
Wow it worked with automod !
How did you fix the strings, maybe I can correct the install file?

Good luck with the mod,let us know how you get on.
Go on ! it's not as steep as it looks.....

dangerousprototypes
Registered User
Posts: 91
Joined: Fri Feb 11, 2011 5:53 am
Contact:

Re: [DEV] phpBB spam hammer

Post by dangerousprototypes » Sat Mar 05, 2011 2:38 pm

I had a second reply through my contact form. They didn't know how to make it work with modx either. Is it that I gave poor locating instructions with various different spacing from the wiki translation?
Please do not PM or mail with questions. Ask in the forum where everyone can share the answer.

dangerousprototypes
Registered User
Posts: 91
Joined: Fri Feb 11, 2011 5:53 am
Contact:

Re: [DEV] phpBB spam hammer

Post by dangerousprototypes » Sat Mar 05, 2011 3:04 pm

hehe... Here's a dark secret: when a legit business (like a brick-in-mortar, registered with the local chamber of commerce) shows up in a spam, I go to the site and them call them :) Most signed up for some SEO pack "get your site at the top of google" and one 30 second call is all it takes to straighten them out :) Probably not the best way to fight spam, but I get a kick out of calling plumbers in south london or awnings people in Arizona and letting them know why I'm calling...
Did you know your URL appears beside 500 Russian pron sites on my forum? Let me read the two before and after your site, tell me if this is what you're into. "Young hot....."
LOL!
Please do not PM or mail with questions. Ask in the forum where everyone can share the answer.

Locked

Return to “[3.0.x] Abandoned MODs”