Signup abuse detection and blocking [Paid] 1.15.6

[Joe Link]

Your reject reason wasn't actually being shown before this update

That's really odd! It seems to be displaying both before and after the update. I have it set to reject anyone with a VPN over at Southwest Firearms. When I turn my VPN (Nord) on and try to register, I see the message (which is what I took a screenshot of).

You've forgotten way more than I know about this stuff so I know better than to argue, but I'm curious as to why I see it (and whether others are seeing it or something different). Maybe you can give it a shot on the site?

 

[marshreef]

Today i had a user rejected coming from one of the many school district IP ranges.








Is there a way to whitelist particular ASN's? or what is the best way to not have these users rejected.

 

[Xon]

@marshreef you have the "getipintel" value set to reject rather than moderate on a high enough value. Simple config change should do it.

 

[Movie Prop Sites]

@Xon, have a bit of a weird one for you.

For Multi-account Reporting, we have your software create a thread in a specific forum for us.

Here is the title of a typical thread:

UserX has 1 multiple accounts

Here is the body:

On Registration, UserX (Awaiting approval) has the following potential multiple account(s):
UserY (Awaiting email confirmation)
Ignore for future events

Triggered detection methods: Cookie IP address: XX.XXX.XXX.XXX

However, if you edit that body text you see this code:

[multi_account_block]{"event":1030}[/multi_account_block]

The problem is, we would like to be able to search that forum that only contains those notices for the name "UserY" but the text "UserY" doesn't actually exist within the posts. Is there any way we can do this?

 

[Xon]

There was an option to embed a static copy into the post "Include raw information into reported content", this effectively disables the permission checking on who can view this information.

This sadly doesn't embed previous versions into search.

I'll need to think about a better solution

 

[Joe Link]

That's really odd! It seems to be displaying both before and after the update. I have it set to reject anyone with a VPN over at Southwest Firearms. When I turn my VPN (Nord) on and try to register, I see the message (which is what I took a screenshot of).

You've forgotten way more than I know about this stuff so I know better than to argue, but I'm curious as to why I see it (and whether others are seeing it or something different). Maybe you can give it a shot on the site?

@Xon have you had a chance to take a look at this? I've tested it with multiple devices and a VPN, and it appears the message is displaying properly (though we're still getting the errors in the Server Error Log).

 

[Xon]

The latest version of this add-on contains a work-around for that error, which is very similar to how XF2.2.4 implements it.

 

[Joe Link]

Great, thanks!

 

[D.O.A.]

They do offer a free plan. But frankly 500 registration attempts per day is a lot.

That reminds me, your add-on was seriously tested by unwanted tiktok users, we didn't get any results though because the server blew up

 

[Xon]

Ooof.

I actually find getipintel really useful for catching unknown signup sources.

 

[creativeforge]

Hi, I'm trying to find a solution to avoid having usernames flagged being sent for manual approval. 100% of these actually end up being legitimate, so it's a waste of time for both the new member and the forum moderators.

Would your addon address that specifically, or is it overkill for our needs?

Thanks!

See: https://xenforo.com/community/threa...ames-flagging-100-useless.193090/post-1510070

 

[Xon]

It will definitely allow for that. It does have some additional setting you may wish to consider such as ASN blocking (aka ISP), as well as country blocking. These can all be disabled by just blanking the relevant setting. They are grouped up so it is easier to handle.

The getipintel integration (disabled by default) is very useful for identifying unknown-ish problematic signup sources.

 

[Kuolema]

I've registered on your website in order to buy the addon. My username on your forum is the same as it is on here. I entered my validation token for my XenForo license.

 

[Xon]

I've registered on your website in order to buy the addon. My username on your forum is the same as it is on here. I entered my validation token for my XenForo license.

Your account should be approved now

 

[jb-net]

Is there a way to use Country filtering/scoring without using cloudflare? I'm asking since I'm using amazon web services. Thanks!

 

[marshreef]

Hello,

We are having some fun with users from a particular region of the world of late...

I'm not sure how/what is happening but it appears the user registration is rejected and yet they are still able to post a thread.

Here I see the user registration was rejected:

Username	Action	Date	Details
Maria27388	Rejected	Today at 1:55 AM	Checking: Maria27388, vi.c.tor.i.annak.ol.et.mp@gmail.com, 37.111.129.76 reject. AS matched: ASN24499, TPP-AS-PK Telenor Pakistan, PK moderate. Email matched: vi.c.tor.i.annak.ol.et.mp@gmail.com Hostname detected: 37.111.129.76 +2. Javascript disabled accept. IP threat score: 0 Total score: +2 Rejected. Direct rule selection

and yet this user was still able to create a spam thread


Any thoughts on how this might be happening?

 

[alexm]

Any thoughts on how this might be happening?

Tapatalk?

 

[marshreef]

oh yeah that is what I'm thinking just trying to get some hard facts

 

[Xon]

Xon updated Signup abuse detection and blocking with a new update entry:

1.9.0 - Feature update

• Use <xf:fa icon="..." /> instead of hard-coded icons
• Ensure multi-account tracking isn't triggered from an admincp login
• Correctly set tracking cookie on logout & keep-alive ping (previous code was ineffective as it had the wrong cookie path)
• Capture client timezone & language into user registration log
• Add filtering for allowed email domains in admincp

Read the rest of this update entry...

 

[hostingunlock]

if you were to buy this add-on it could be truncate xf_sv_user_registration_log