Signup abuse detection and blocking

Signup abuse detection and blocking [Paid] 1.16.11

No permission to buy ($45.00)
Overview FAQ Updates (116) Reviews (23) History Discussion
Xon said:
I'll need to add support for disabling the multi-account detection for the login code-path to support that add-on. I haven't looked into what would be required to support that add-on but I don't think it would be too much effort
Click to expand...

I’d appreciate it when you have time.
 
I got this err when trying to upgrade the threadmarks

XF\Db\DuplicateKeyException: xf_sv_threadmark: MySQL query error [1062]: Duplicate entry '1466' for key 'xf_sv_threadmark.content_type_id' in src/XF/Db/AbstractStatement.php at line 230
 
Xon said:
I'll need to add support for disabling the multi-account detection for the login code-path to support that add-on. I haven't looked into what would be required to support that add-on but I don't think it would be too much effort
Click to expand...
Coincidentally, I'm running into this very issue. Is there a way to reset the cookie for Anti-Spam? After I login, it notes the user starts getting reported for all the other people I've logged in as. It would be great if I could reset their cookie and give them another chance so to speak. I reset their cookie between A and B user after I've logged in as C. So if they log in again its a new violation. Currently it seems if I've logged in as C. A gets reported when B signs in, if I've signed into that user.
 
For how long is post checking active? Does it respect the spam management setting of how many posts to check? @Xon
 
Some question regarding the Addon:

1. Why I get two "Email matched" entiresi one with +1 and the other with +0 although it is the same Email
And why get the entry:
+0. Unknown email domain: gmail.com

although in the addon setting, under Email rules I got the Rule:
+0|*@gmail.com

2. What security disadvantage does it have for me if someone says "Javascript disabled":
+2. Javascript disabled

I don't quite understand this part either:
Approve
Require email confirmation (always notifies)
User email is not confirmed
Click to expand...
Will be sent another email to the user to confirm his email and only if he confirms his email, the account will get autmatically approved ?
Could you please explain this area in more detail how the process works here?

1741761828270.webp

Is there technical documentation for the add-on?
 
USY said:
And why get the entry:
+0. Unknown email domain: gmail.com

although in the addon setting, under Email rules I got the Rule:
+0|*@gmail.com
Click to expand...
You have to add the domain to this section ..admin.php?banning/allowed-email-domains
That section you are referring to is just for scoring email domains, that doesn't put them on the 'allowed/known' list.

USY said:
2. What security disadvantage does it have for me if someone says "Javascript disabled":
+2. Javascript disabled
Click to expand...
This is used to identify potential bots and other malicious tools. It's a part of the scoring process, so you can configure it how you see fit.

USY said:
Will be sent another email to the user to confirm his email and only if he confirms his email, the account will get autmatically approved ?
Could you please explain this area in more detail how the process works here?
Click to expand...
Do you have Google auth integration turned on? If you click "Approve" with the "Require email confirmation (always notifies)" box checked, it will send a email confirmation message. If they came through the Google authentication, they won't get a email confirmation message the first time.

USY said:
1. Why I get two "Email matched" entiresi one with +1 and the other with +0 although it is the same Email
Click to expand...
I don't know how you're getting 2 emails in that checking process, I've never seen that happen. So, @Xon would have to answer that one.
 
Last edited:
  • Like
Reactions: USY
USY said:
Some question regarding the Addon:

1. Why I get two "Email matched" entiresi one with +1 and the other with +0 although it is the same Email
Click to expand...
You've got an email rule matching the email address, sadly doesn't really report wildcard matches well.

USY said:
And why get the entry:
+0. Unknown email domain: gmail.com
Click to expand...
Because the add-on doesn't ship with a list of "known" or "approved" email domains. This functionality is designed for sites which have a list of email domains which are known allowed/good. That is it supports grey-listing unknown email addresses.

USY said:
although in the addon setting, under Email rules I got the Rule:
+0|*@gmail.com
Click to expand...
This is where the +0. Email matched: xxxxxxxx1124@gmail.com is coming from.

USY said:
2. What security disadvantage does it have for me if someone says "Javascript disabled":
+2. Javascript disabled
Click to expand...
Having javascript disabled during signup is fairly unusual these days. It used to suggest bot-like behavior.

USY said:
I don't quite understand this part either:

Will be sent another email to the user to confirm his email and only if he confirms his email, the account will get autmatically approved ?
Could you please explain this area in more detail how the process works here?
Click to expand...
M

Thread 'Moderated users bypass email confirmation'

This isn't a bug in terms of malfunctioning code as it's been specifically programmed to do this, but I'm not sure I agree with the behaviour.

Had a client ask about requiring email confirmation before being added to the approval queue. I tested and found that for most registrations, this happens already.

If a user gets queued for approval for spam though, they bypass this step completely. I'm not sure this is necessarily how people will actually realise this works.

The "Enable email confirmation" option says "If selected, users will need to click on a link in an email before their...
  • Like

If a user appears in the approval queue, they have not been sent a confirmation email. Setting them to approved bypassed email confirmation, this is a poorly documented design flaw. There is a reason it adds the "user email is not confirmed" sub-text.
 
  • Like
Reactions: USY
Spam trigger logs don't get enriched like the user registration logs for various reasons (it can't actually be a clickable link since nested <a> tags don't work)
 
How to avoid multiple account detection based on IP?.
Since most users are connected via VPN, proxies, or CGNAT, they often have identical IP addresses.

Therefore, I want to avoid these being recognized as multiple accounts based JUST on the IP adresses.

I would like the recognition by combining IP + Cookie + and if possibly by a third additional feature

Is this possible, and if yes, how ?
 
USY said:
How to avoid multiple account detection based on IP?.
Since most users are connected via VPN, proxies, or CGNAT, they often have identical IP addresses.

Therefore, I want to avoid these being recognized as multiple accounts based JUST on the IP adresses.

I would like the recognition by combining IP + Cookie + and if possibly by a third additional feature

Is this possible, and if yes, how ?
Click to expand...
1741944105731.webp
 
  • Like
Reactions: USY
The current version doesn't trigger multiple account detection purely of shared IP usage, it requires the cookie hit (or email link usage hit) and then logs if a shared IP was also detected
 
I don't understand the difference between:
Multi-account registration mode - general
and
Multi-account registration mode - specific

Can someone explain this ?

1742377487109.webp
 
If a multi-account is detected, and it is banned or a member of a specific set of groups or has a specific permission then do one action (probably this one should be reject). Otherwise do the other action (probably should be moderate)
 
Last edited:
  • Like
Reactions: USY
Xon said:
If a multi-account is detected, and it is banned or a member of a specific set of groups or has a speisifc permission then do one action (probably this one should be reject). Otherwise do the other action (probably should be moderate)
Click to expand...
How can I prevent new registrations if a user already has an account?
Would my settings in the screenshot good?
 
Xon said:
I'll need to add support for disabling the multi-account detection for the login code-path to support that add-on. I haven't looked into what would be required to support that add-on but I don't think it would be too much effort
Click to expand...

i ve also got a lot of these confusing false positive multiaccount detections with all accounts ive ever logged in by lau addon
it would be great to clean up this mess and ignore new detections related to this action
 
findozor said:
i ve also got a lot of these confusing false positive multiaccount detections with all accounts ive ever logged in by lau addon
it would be great to clean up this mess and ignore new detections related to this action
Click to expand...
One more vote for this. The two addons are so helpful but have a lot of false positives I can’t correct.
 
You must log in or register to reply here.
Back
Top Bottom