TPU: Detect and Block Spam Registrations 1.6.6

[EOTurtle]

Thanks for the reply. I just ended up going back to the verbose listing. I downloaded a spreadsheet of the listing, inserted a column filed with "reject|" and then in a third column combined the first two cells all the way down. Then edited the scores for AU, CA and US. It's maybe not as elegant as wildcarding, but it absolutely works.
If anyone wants it...

reject|AC
reject|AD
reject|AE
reject|AF
reject|AG
reject|AI
reject|AL
reject|AM
reject|AN
reject|AO
reject|AQ
reject|AR
reject|AS
reject|AT
moderateposts|AU
reject|AW
reject|AX
reject|AZ
reject|BA
reject|BB
reject|BD
reject|BE
reject|BF
reject|BG
reject|BH
reject|BI
reject|BJ
reject|BM
reject|BN
reject|BO
reject|BR
reject|BS
reject|BT
reject|BV
reject|BW
reject|BY
reject|BZ
-1|CA
reject|CC
reject|CD
reject|CF
reject|CG
reject|CH
reject|CI
reject|CK
reject|CL
reject|CM
reject|CN
reject|CO
reject|CR
reject|CS
reject|CU
reject|CV
reject|CX
reject|CY
reject|CZ
reject|DE
reject|DJ
reject|DK
reject|DM
reject|DO
reject|DZ
reject|EC
reject|EE
reject|EG
reject|EH
reject|ER
reject|ES
reject|ET
reject|EU
reject|FI
reject|FJ
reject|FK
reject|FM
reject|FO
reject|FR
reject|FX
reject|GA
reject|GB
reject|GD
reject|GE
reject|GF
reject|GG
reject|GH
reject|GI
reject|GL
reject|GM
reject|GN
reject|GP
reject|GQ
reject|GR
reject|GS
reject|GT
reject|GU
reject|GW
reject|GY
reject|HK
reject|HM
reject|HN
reject|HR
reject|HT
reject|HU
reject|ID
reject|IE
reject|IL
reject|IM
reject|IN
reject|IO
reject|IQ
reject|IR
reject|IS
reject|IT
reject|JE
reject|JM
reject|JO
reject|JP
reject|KE
reject|KG
reject|KH
reject|KI
reject|KM
reject|KN
reject|KP
reject|KR
reject|KW
reject|KY
reject|KZ
reject|LA
reject|LB
reject|LC
reject|LI
reject|LK
reject|LR
reject|LS
reject|LT
reject|LU
reject|LV
reject|LY
reject|MA
reject|MC
reject|MD
reject|ME
reject|MG
reject|MH
reject|MK
reject|ML
reject|MM
reject|MN
reject|MO
reject|MP
reject|MQ
reject|MR
reject|MS
reject|MT
reject|MU
reject|MV
reject|MW
reject|MX
reject|MY
reject|MZ
reject|NA
reject|NC
reject|NE
reject|NF
reject|NG
reject|NI
reject|NL
reject|NO
reject|NP
reject|NR
reject|NT
reject|NU
reject|NZ
reject|OM
reject|PA
reject|PE
reject|PF
reject|PG
reject|PH
reject|PK
reject|PL
reject|PM
reject|PN
reject|PR
reject|PS
reject|PT
reject|PW
reject|PY
reject|QA
reject|RE
reject|RO
reject|RS
reject|RU
reject|RW
reject|SA
reject|SB
reject|SC
reject|SD
reject|SE
reject|SG
reject|SH
reject|SI
reject|SJ
reject|SK
reject|SL
reject|SM
reject|SN
reject|SO
reject|SR
reject|ST
reject|SU
reject|SV
reject|SY
reject|SZ
reject|TC
reject|TD
reject|TF
reject|TG
reject|TH
reject|TJ
reject|TK
reject|TM
reject|TN
reject|TO
reject|TP
reject|TR
reject|TT
reject|TV
reject|TW
reject|TZ
reject|UA
reject|UG
reject|UK
reject|UM
-1|US
reject|UY
reject|UZ
reject|VA
reject|VC
reject|VE
reject|VG
reject|VI
reject|VN
reject|VU
reject|WF
reject|WS
reject|XK
reject|YE
reject|YT
reject|YU
reject|ZA
reject|ZR
reject|ZM
reject|ZW
reject|XX

Because every registration from the US and Canada automatically gets a point subtracted from their score, the criteria scoring (ASN, hostname, email, etc.) all gets bumped up by one (+1 becomes +2, the TOR browser at +4 becomes +5, etc.) so the default triggers for moderating and rejection remain the same.

The result is we have most people registering with scores of - 1, a few with +1 (say, Outlook email) or +3 (Outlook & something else), and everybody from other countries who would otherwise probably score much higher just gets rejected.

We have probably 4-5 registrations a day, with half of those from places like IN, CN and PK, that have to be deleted. This addon eliminates that, so thanks.

For the curious...
ExpeditersOnline

 

[rivacom]

I'm using 1.6.4 of the addon and my board is version 1.4.2.

#0 /home/revenant/web/revenantgaming.com/public_html/library/Zend/Uri.php(143): Zend_Uri_Http->__construct('http', '//www.stopforum...')
#1 /home/revenant/web/revenantgaming.com/public_html/library/Zend/Http/Client.php(270): Zend_Uri::factory('http://www.stop...')
#2 /home/revenant/web/revenantgaming.com/public_html/library/Zend/Http/Client.php(253): Zend_Http_Client->setUri('http://www.stop...')
#3 /home/revenant/web/revenantgaming.com/public_html/library/XenForo/Helper/Http.php(21): Zend_Http_Client->__construct('http://www.stop...', Array)
#4 /home/revenant/web/revenantgaming.com/public_html/library/XenForo/Model/SpamPrevention.php(899): XenForo_Helper_Http::getClient('http://www.stop...')
#5 /home/revenant/web/revenantgaming.com/public_html/library/XenForo/Model/SpamPrevention.php(188): XenForo_Model_SpamPrevention->_getSfsApiResponse(Array, 'http://www.stop...', false)
#6 /home/revenant/web/revenantgaming.com/public_html/library/XenForo/Model/SpamPrevention.php(93): XenForo_Model_SpamPrevention->_checkSfsResult(Array, Object(Zend_Controller_Request_Http))
#7 /home/revenant/web/revenantgaming.com/public_html/library/XenForo/Model/SpamPrevention.php(79): XenForo_Model_SpamPrevention->_allowRegistration(Array, Object(Zend_Controller_Request_Http))
#8 /home/revenant/web/revenantgaming.com/public_html/library/TPUDetectSpamReg/ModelSpamPrevention.php(56): XenForo_Model_SpamPrevention->allowRegistration(Array, Object(Zend_Controller_Request_Http))
#9 /home/revenant/web/revenantgaming.com/public_html/library/XenForo/ControllerPublic/Register.php(1406): TPUDetectSpamReg_ModelSpamPrevention->allowRegistration(Array, Object(Zend_Controller_Request_Http))
#10 /home/revenant/web/revenantgaming.com/public_html/library/XenForo/ControllerPublic/Register.php(401): XenForo_ControllerPublic_Register->_runSpamCheck(Object(LiveUpdate_DataWriter_User), Array)
#11 /home/revenant/web/revenantgaming.com/public_html/library/Andy/NewUserConversation/ControllerPublic/Register.php(16): XenForo_ControllerPublic_Register->actionRegister()
#12 /home/revenant/web/revenantgaming.com/public_html/library/XenForo/FrontController.php(347): Andy_NewUserConversation_ControllerPublic_Register->actionRegister()
#13 /home/revenant/web/revenantgaming.com/public_html/library/XenForo/FrontController.php(134): XenForo_FrontController->dispatch(Object(XenForo_RouteMatch))
#14 /home/revenant/web/revenantgaming.com/public_html/index.php(13): XenForo_FrontController->run()

Any ideas on my error?

 

[Robust]

Do we disable XF's integrated spam protection to use this?

@W1zzard

 

[W1zzard]

Do we disable XF's integrated spam protection to use this?

@W1zzard

You can leave it turned on (that's what I have), but it should work without, too.

Any ideas on my error?

That doesn't seem to be caused by the addon, but rather by the stock code that's trying to connect to stopforumspam

 

[Robust]

You can leave it turned on (that's what I have), but it should work without, too.


That doesn't seem to be caused by the addon, but rather by the stock code that's trying to connect to stopforumspam

Also, some users use generic usernames like God which are reported for spam and need manual confirm, it's annoying. Any way around it?

 

[W1zzard]

Also, some users use generic usernames like God which are reported for spam and need manual confirm, it's annoying. Any way around it?

Turn off SFS in XenForo and use SFS from my addon instead which lets you adjust scoring for SFS username match

 

[Robust]

Turn off SFS in XenForo and use SFS from my addon instead which lets you adjust scoring for SFS username match

Brill. Also, how do I get a project honeypot key? I can't find the place on their site.

 

[rdn]

Brill. Also, how do I get a project honeypot key? I can't find the place on their site.

Services > HTTP Blacklist

 

[EOTurtle]

When a registrant is rejected due to the scoring, they receive the 'looks like spam activity' error page, which is how it should be. Does anyone know of a template or code mod that would get them the 'registrations are not currently being accepted' page error if they are rejected solely because of the country? Post #181 above shows that I'm rejecting registrations from every country except the US, Canada and Australia. I could, of course, just change the text on the 'spam activity' page to reflect no registrations being accepted, but I would prefer to differentiate between spam rejections and country rejections.

 

[Xon]

@W1zzard fyi; I have a pending pull request for a bugfix; https://github.com/W1zzardTPU/XenForo_TPUDetectSpamReg/pull/1

 

[Kintaro]

+3|*
-3|US

is not working for me.

I just tried registering tough a proxy (from Malta) and my test user didn't get +3

StopForumSpam matched (ip: 55),
TPUDetectSpamReg checking: test-account, xxxxx@gmail.com, 185.56.137.11,
AS detected: ASN60558, SECUREDSERVERS-EU PHOENIX NAP, LLC.,EU,
+3. SFS hit: ip,
Hostname detected: 185.56.137.11,
+1. Port open: 80,
+1. Port open: 22,
Country detected: MT,
Total score: +5,
Moderated. Score exceeded (+5 >= 3)

It detect Malta but nothing more.

 

[SimonV]

Hi All!

I just updated to the newest version of TPU and now I'm getting this error over and over:

ErrorException: curl_setopt(): CURLOPT_FOLLOWLOCATION cannot be activated when an open_basedir is set - library/TPUDetectSpamReg/ModelSpamPrevention.php:77 ​

TPU was working fine in the older version and I haven't changed anything on my server that should have caused this to start happening.

Any ideas why I'm getting this error now and didn't get it before updating TPU ?

I hope there is a solution that doesn't involve messing with my server php, etc. settings.

Thanks!

Did you get to the bottom of this issue? What was the cause / fix?

Thanks.

 

[jeffwidman]

I'm getting a bunch of errors that say:

ErrorException: Undefined variable: dns - library/TPUDetectSpamReg/AS.php:40
Generated By: Unknown Account, Yesterday at 11:25 AM
Stack Trace
#0 /home/nginx/domains/mydomain.com/public/library/TPUDetectSpamReg/AS.php(40): XenForo_Application::handlePhpError(8, 'Undefined varia...', '/home/nginx/dom...', 40, Array)
#1 /home/nginx/domains/mydomain.com/public/library/TPUDetectSpamReg/AS.php(79): TPUDetectSpamReg_AS::getASNameAndNumber('39.36.199.139', NULL, NULL)
#2 [internal function]: TPUDetectSpamReg_AS::getRegSpamScore(Array, Array, '1', '0', Object(TPUDetectSpamReg_ModelSpamPrevention))
#3 /home/nginx/domains/mydomain.com/public/library/XenForo/CodeEvent.php(90): call_user_func_array(Array, Array)
#4 /home/nginx/domains/mydomain.com/public/library/TPUDetectSpamReg/ModelSpamPrevention.php(67): XenForo_CodeEvent::fire('tpu_detect_spam...', Array)
#5 /home/nginx/domains/mydomain.com/public/library/XenForo/ControllerPublic/Register.php(1426): TPUDetectSpamReg_ModelSpamPrevention->allowRegistration(Array, Object(Zend_Controller_Request_Http))
#6 /home/nginx/domains/mydomain.com/public/library/XenForo/ControllerPublic/Register.php(401): XenForo_ControllerPublic_Register->_runSpamCheck(Object(XenGallery_DataWriter_User), Array)
#7 /home/nginx/domains/mydomain.com/public/library/XenForo/FrontController.php(351): XenForo_ControllerPublic_Register->actionRegister()
#8 /home/nginx/domains/mydomain.com/public/library/XenForo/FrontController.php(134): XenForo_FrontController->dispatch(Object(XenForo_RouteMatch))
#9 /home/nginx/domains/mydomain.com/public/index.php(13): XenForo_FrontController->run()
#10 {main}
Request State
array(3) {
  ["url"] => string(46) "http://www.mydomain.com/register/register"
  ["_GET"] => array(1) {
    ["/register/register"] => string(0) ""
  }
  ["_POST"] => array(13) {
    ["username"] => string(0) ""
    ["0639afaf2e5beaeacf7bc43282a2c54a"] => string(10) "username"
    ["bb2440d4c9959a7d7c659aad3c3c261b"] => string(0) ""
    ["28a76167b6bb7fe3aab5e10667c0f259"] => string(21) "username@outlook.com"
    ["6f10e657e802b5f22b6b2bbe0577208d"] => string(6) "female"
    ["dob_month"] => string(1) "9"
    ["dob_day"] => string(2) "07"
    ["dob_year"] => string(4) "1990"
    ["bc9420255f91e6feb33ec78fd2ea3529"] => string(13) "Asia/Tashkent"
    ["g-recaptcha-response"] => string(953) "stuff"
    ["agree"] => string(1) "1"
    ["_xfToken"] => string(8) "*"
    ["reg_key"] => string(32) "stuff"
  }
}

 

[Xon]

@jeffwidman my previous fix didn't work 100%. Can you try this version; https://github.com/Xon/XenForo_TPUDetectSpamReg/archive/fix_null_as.zip and report if it still happens?

 

[W1zzard]

The AS Lookup service was down a lot in the last days, so it couldn't perform the lookup and caused that error instead.

A future version will hide the error message, Xon's code should work.

 

[popr]

I keep getting "country detected: XX" even though the country is obviously detected in the "AS." Is there a fix for this or something I need to add to my server? Please see example below. Note the Z's are to hide their real identity.

1. Mzzzzzz - TPUDetectSpamReg checking: Mzzzzzz Gzzzzzz@hotmail.com, 184.71.zz.zz,
   AS detected: ASN6327, SHAW - Shaw Communications Inc.,CA,
   Hostname detected: mail.plexussystemsinc.com,
   Country detected: XX,
   Total score: +0
   Yesterday at 11:33 PM, Content: user

1. Jzzz Bzzz - TPUDetectSpamReg checking: Jzzz Bzzz, jzzz@gmail.com, 70.127.zz.zz,
   AS detected: ASN33363, BHN-TAMPA - BRIGHT HOUSE NETWORKS, LLC,US,
   Hostname detected: 70-127-zz-zz.res.bhn.net,
   Country detected: XX,
   +1. Email local part exceeds 15 chars: jzzz,
   Total score: +1
   Yesterday at 9:35 PM, Content: user

 

[Brent W]

The latest Github version has this bug:

Server Error Log
Error Info
ErrorException: Undefined index: purgedays - library/TPUDetectSpamReg/Cleanup.php:18
Generated By: Unknown Account, Yesterday at 6:00 PM
Stack Trace
#0 /home/aspies/public_html/library/TPUDetectSpamReg/Cleanup.php(18): XenForo_Application::handlePhpError(8, 'Undefined index...', '/home/aspies/pu...', 18, Array)
#1 [internal function]: TPUDetectSpamReg_Cleanup::cleanup(Array)
#2 /home/aspies/public_html/library/XenForo/Model/Cron.php(357): call_user_func(Array, Array)
#3 /home/aspies/public_html/library/XenForo/Deferred/Cron.php(24): XenForo_Model_Cron->runEntry(Array)
#4 /home/aspies/public_html/library/XenForo/Model/Deferred.php(295): XenForo_Deferred_Cron->execute(Array, Array, 7.9999969005585, '')
#5 /home/aspies/public_html/library/XenForo/Model/Deferred.php(429): XenForo_Model_Deferred->runDeferred(Array, 7.9999969005585, '', false)
#6 /home/aspies/public_html/library/XenForo/Model/Deferred.php(374): XenForo_Model_Deferred->_runInternal(Array, NULL, '', false)
#7 /home/aspies/public_html/deferred.php(23): XenForo_Model_Deferred->run(false)
#8 {main}
Request State
array(3) {
  ["url"] => string(42) "https://www.aspiescentral.com/deferred.php"
  ["_GET"] => array(0) {
  }
  ["_POST"] => array(3) {
    ["_xfRequestUri"] => string(1) "/"
    ["_xfNoRedirect"] => string(1) "1"
    ["_xfResponseType"] => string(4) "json"
  }
}

 

[W1zzard]

The latest Github version has this bug:

Server Error Log
Error Info
ErrorException: Undefined index: purgedays - library/TPUDetectSpamReg/Cleanup.php:18
Generated By: Unknown Account, Yesterday at 6:00 PM
Stack Trace
#0 /home/aspies/public_html/library/TPUDetectSpamReg/Cleanup.php(18): XenForo_Application::handlePhpError(8, 'Undefined index...', '/home/aspies/pu...', 18, Array)
#1 [internal function]: TPUDetectSpamReg_Cleanup::cleanup(Array)
#2 /home/aspies/public_html/library/XenForo/Model/Cron.php(357): call_user_func(Array, Array)
#3 /home/aspies/public_html/library/XenForo/Deferred/Cron.php(24): XenForo_Model_Cron->runEntry(Array)
#4 /home/aspies/public_html/library/XenForo/Model/Deferred.php(295): XenForo_Deferred_Cron->execute(Array, Array, 7.9999969005585, '')
#5 /home/aspies/public_html/library/XenForo/Model/Deferred.php(429): XenForo_Model_Deferred->runDeferred(Array, 7.9999969005585, '', false)
#6 /home/aspies/public_html/library/XenForo/Model/Deferred.php(374): XenForo_Model_Deferred->_runInternal(Array, NULL, '', false)
#7 /home/aspies/public_html/deferred.php(23): XenForo_Model_Deferred->run(false)
#8 {main}
Request State
array(3) {
  ["url"] => string(42) "https://www.aspiescentral.com/deferred.php"
  ["_GET"] => array(0) {
  }
  ["_POST"] => array(3) {
    ["_xfRequestUri"] => string(1) "/"
    ["_xfNoRedirect"] => string(1) "1"
    ["_xfResponseType"] => string(4) "json"
  }
}

Can you check in your options if you have this settings box?

 

[Brent W]

Yes. It is set as 0

 

[W1zzard]

Set it to a different value, click save, then set it to 0 again, see if that makes any difference