Signup abuse detection and blocking

Signup abuse detection and blocking [Paid] 1.20.7

No permission to buy ($45.00)
Thanks, that's useful information. Not looked at UserCheck before (y)
And of course blacklist sketchy domains, so you never have to deal with those registrations again .

This addon is a life saver.
The main thing that's missing is a function to approve registration but ban domain & force email change.
 
Last edited:
Can anyone explain to me why Gmail gets a +1

This in my email rules.

+0*@gmail.com

Which I thought whitelisted Gmail

But I still get this
What am I missing? Thanks
 
Would it be possible to add this as an option?

If we assume that a user already has an account, they should receive a warning message with the following text:

We believe that you already have an account. Please use your existing account and do not create a new one. We do not allow duplicate accounts and will not approve a second account. Thank you.
 
Hello,

Is there an official documentation for this somewhere? I'm trying to configure this but struggling to understand some of the settings and how to configure them. For example, here in email domains, what's the expected format? Do we include scores? Or just domains?
1781559258852.webp

Also some of the settings have a score section/option where sometimes it's an integer while other times it's a phrase:
1781559351810.webp

How are the scores calculated? Is higher score worse? or better? How do we set or configure the score thresholds or totals?

I tried checking the site ( https://atelieraphelion.com/products/signup-abuse-detection-and-blocking.64/releases ) but didn't see a link to any official manual or documentation.

Also for the love of all that is holy, where do we approve users that are placed in "requiring approval"? I checked the Moderation/Approval Queue on the frontend of the site but nothing shows up... and I can't find anything in the AdminCP either :P I'm getting old and having a hard time finding these things I guess! (I am a super admin and super moderator already and made sure I have permissions to do those things)

1781559609915.webp

Thanks! :)
 
Is there an official documentation for this somewhere?
Not really as most of the time the inline documentation is enough and people iteratively tinker with this add-on. And writing indepth documentation is a huge time-sink for these sorts of add-ons which largely have helper text on the options anyway.

I'm trying to configure this but struggling to understand some of the settings and how to configure them. For example, here in email domains, what's the expected format? Do we include scores? Or just domains?
View attachment 339917
The add-on supports adding a score for an unknown email domain, the allowed email domain skips that. These will be populated by stuff like "hotmail.com" or similar when you click "allow email domain" from the front-end approval queue when the relevant permissions exist

Also some of the settings have a score section/option where sometimes it's an integer while other times it's a phrase:
View attachment 339918

How are the scores calculated? Is higher score worse? or better? How do we set or configure the score thresholds or totals?
There is a auto-moderate threshold and then an auto-reject threshold. The score with a phrase is to moderate/reject via a direct rule selection instead of via score meeting some threshold.

Also for the love of all that is holy, where do we approve users that are placed in "requiring approval"? I checked the Moderation/Approval Queue on the frontend of the site but nothing shows up... and I can't find anything in the AdminCP either :P I'm getting old and having a hard time finding these things I guess! (I am a super admin and super moderator already and made sure I have permissions to do those things)

View attachment 339919
Approving users requires an account to be a moderator and to have the "approve user" permission.
 
Not really as most of the time the inline documentation is enough and people iteratively tinker with this add-on. And writing indepth documentation is a huge time-sink for these sorts of add-ons which largely have helper text on the options anyway.
Yeah that makes sense, I was just curious. I have developed add-ons before in general and can definitely attest that documentation takes a long time to write and stuff. But also with add-ons this awesome and complex, it can be helpful too for newbies. Maybe even some AI generated documentation can help but I digress :)

Anyway - thanks for your replies - this has been helpful and I can experiment with the settings to see how they work and such.

The add-on supports adding a score for an unknown email domain, the allowed email domain skips that. These will be populated by stuff like "hotmail.com" or similar when you click "allow email domain" from the front-end approval queue when the relevant permissions exist
What's the format of the CSV import feature?

Approving users requires an account to be a moderator and to have the "approve user" permission.
In my screenshot, you can see I have that permission. Where do we actually approve the users? Is it the moderator approval queue on the front-end? Or is it somewhere in the AdminCP? Just wondering since I tried the moderator approval queue and no users appeared there.
 
What's the format of the CSV import feature?
Quite simple;
Code:
email_domain,reason
google.com,
In my screenshot, you can see I have that permission. Where do we actually approve the users? Is it the moderator approval queue on the front-end? Or is it somewhere in the AdminCP? Just wondering since I tried the moderator approval queue and no users appeared there.
Yes, it is the moderator's "Approval queue" button at the very top. There should be a filter button, see if there is 'user' is in the content type dropdown for it.
 
Please consider to add Content deletion reason to the approval queue. Im not sure if this addon or Moderator Essentials would be the best one to add it to.

 
I just had 3 user registration attempts within 12 minutes from the same IP, different emails, etc....that should have immediately tripped the registrations and been noted in reporting. I installed the new "standard library" earlier today, and I believe it may have messed this up.

Edit: its a REAL user registration, so multiple accounts would be the only trip wire.
 
Last edited:
No issues on our forum after updating, but I started using the IPDENY Country list https://www.ipdeny.com/ipblocks/data/countries/$Country.zone to completely block the nefarious countries on the Windows firewall and any chronic gets blocked on the hardware firewall. Also, I've been blocking the Chinese Tecent cloud ranges for a while and have quite the IP list!

I had Gemini create a PowerShell script that updates the firewall each night.

In addition to that, also found something called Firehol http://iplists.firehol.org/?ipset=firehol_level1 and a script runs nightly to update the firewall for those addresses as well. It includes StopForumSpam addresses.

The results have been amazing on reduced spam, crap web traffic, etc!
 
No issues on our forum after updating, but I started using the IPDENY Country list https://www.ipdeny.com/ipblocks/data/countries/$Country.zone to completely block the nefarious countries on the Windows firewall and any chronic gets blocked on the hardware firewall. Also, I've been blocking the Chinese Tecent cloud ranges for a while and have quite the IP list!
This add-on already support blocking registrations by country.
I just had 3 user registration attempts within 12 minutes from the same IP, different emails, etc....that should have immediately tripped the registrations and been noted in reporting. I installed the new "standard library" earlier today, and I believe it may have messed this up.

Edit: its a REAL user registration, so multiple accounts would be the only trip wire.
Can you try rebuilding the Standard Library add-on?

Do each of them have a registration record with details when you look at them in the admincp?
 
Can you try rebuilding the Standard Library add-on?

Do each of them have a registration record with details when you look at them in the admincp?
Rebuilt both add-ons (and installed the latest version)

Yes, the records were present, but the matching registration details didn't get flagged. I've since had another attempted multiple registration that DID flag correctly, so it appears to be working.
 
This add-on already support blocking registrations by country.
When possible, It's MUCH BETTER for many reasons to block countries at the server firewall than on an individual per website basis. It also blocks e-mail, wordpress attacks etc. There is no reason to have any website individually blocking country traffic. If you had 10 forums on the server, each one would be running resources to block this.
 
When possible, It's MUCH BETTER for many reasons to block countries at the server firewall than on an individual per website basis. It also blocks e-mail, wordpress attacks etc. There is no reason to have any website individually blocking country traffic. If you had 10 forums on the server, each one would be running resources to block this.
You seem to completely misunderstand what this add on does: It can (upon loads of other things) block registrations per country. If you block countries at the server firewall you typically would block visitors from those countries, not just registrations. Completely different story. Also, the amount of registrations should not lead to relevant loads when blocking certain countries.

XenForo ist not Wordpress and neither a mail server - and probably not too many people do run 10 forums in parallel on their server (given they run a server at all in the first hand). If they do they hopefully know how manage load and how to configure a firewall.

You are criticizing things that absolutely do not fit to the add on as it was never intended for those topics but on the other hand does a lot of things during the registration process that your central server firewall won't and can't do. What on earth is your point and what are you trying to achieve with your posts here in the thread?
 
Last edited:
You seem to completely misunderstand what this add on does: It can (open loads of other things) block registrations per country). If you block countries at the server firewall you typically would block visitors from those countries, not just registrations.
I'm not misunderstanding anything. I was simply pointing out I've started blocking country traffic at the firewall. I've been using the Internet since 1990. In our case, there is no reason, whatsoever for us to have traffic from Ukraine, China, Russia, India, Nigeria etc.

For most people, they probably should be blocking country traffic at the firewall, not on each individual website, it's not like you are Google or Microsoft and need to pass traffic from Nigeria through your server. LOL

It's great that the add-on does this, but it's a better practice for resources to block countries at the firewall, especially if there are multiple XF sites on the same server. Less resources are consumed by the server and it also protects other unrelated resources on the server.
 
Last edited:
I've been using the Internet since 1990.
You are my hero. I guess you do have a T-shirt with that statement.
In our case, there is no reason, whatsoever for us to have traffic from Ukraine, China, Russia, India, Nigeria etc.
What is the connection to this add on? If you don't need it or don't want it: Don't use it. A lot of users find it pretty helpful and use it (me included).

For most people, they probably should be blocking country traffic at the firewall, not on each individual website, it's not like you are Google or Microsoft and need to pass traffic from Nigeria through your server. LOL
Again: What is the connection to this add on?

I mean: If you've been on the internet since 1990 chances are that you may have heard about things like "threads", "topics" or even this thing they call "off topic"? ;)
 
I wouldn't mind if an LLM like Claude Code would handle specific situations in the approval queue and reports. Especially evaluating suspect registrations and duplicate accounts.
 
I wouldn't mind if an LLM like Claude Code would handle specific situations in the approval queue and reports. Especially evaluating suspect registrations and duplicate accounts.
That would be a deal breaker for me and I’d stop using the add-on unless it’s a feature that can be blocked.
 
Back
Top Bottom