Spambot detector (with the use of this API)

MysteryFCM · 2009-02-19 1:57 am

I'm actually in the process of working on a fairly large update to the SBST that should also help improve both reliability of data, and efficiency (and of course, since I've received alot of questions concerning usage and installation, it's gonna have a lil more documentation and comments)

MysteryFCM · 2009-02-19 3:33 am

v0.20 Released

* Fixed $bln_SaveToFile ignored when set to false
* Moved version history from config.php to history.txt

- Removed fSpamlist submission routine from check_spammers.php for those that want to test it via the web interface

DO NOT TEST IT WITH YOUR OWN DATA MIXED WITH SPAMMER DATA IF YOU'VE GOT YOUR FSPAMLIST SUBMISSION API KEY ENTERED!!

+ Added counter routine (requested)
+ Added simple e-mail validation (also does IP lookup to ensure the hostname actually resolves - it's not a valid e-mail if it doesn't)
+ Added simple IP validation
+ Added Version History link to index.php footer (next to "Get the code!")
+ Added spammers blocked (next to "Version History")

Download:
http://support.it-mate.co.uk/?mode=Prod … searchtool

MysteryFCM · 2009-02-20 1:41 pm

Spam Bot Search Tool v0.21

I've released this in response to SFS being down earlier. All that's been added is the ability to enable/disable the checking of SFS or FSL.

To disable a database, open config.php and set the respective variable to false, for example, to disable StopForumSpam;

$CheckSFS = FALSE;

Download v0.21
http://support.it-mate.co.uk/?mode=Prod … searchtool

Ref:
http://hphosts.blogspot.com/2009/02/sto … fline.html

kpatz · 2009-02-20 2:19 pm

Mike wrote:

The biggest problem is determining a site's "real" IP...often times a site can be reached at one IP but sends POST requests from another. We've seen this several times on server we own, where outgoing request appear on the base IP and not necessarily on the IP fround from dig or various lookup services.

Some servers may have more than one IP assigned, a group of IPs for example (11.11.11.232 - 239 for example). The site might be hosted on .232, but outgoing requests from the server might come from .239.

Mike · 2009-02-20 4:37 pm

kpatz wrote:

Mike wrote:
The biggest problem is determining a site's "real" IP...often times a site can be reached at one IP but sends POST requests from another. We've seen this several times on server we own, where outgoing request appear on the base IP and not necessarily on the IP fround from dig or various lookup services.
Some servers may have more than one IP assigned, a group of IPs for example (11.11.11.232 - 239 for example). The site might be hosted on .232, but outgoing requests from the server might come from .239.

Exactly. The only way to determine what IP a site will send requests on is to test it; as near as we can tell there doesn't appear to be any other reliable means of determining it. We'll most likely make a test form available as an aid in detecting the IP that requests come from.

MysteryFCM · 2009-02-23 1:25 am

Spambot Search Tool v0.22 has been released

Changes:

+ Added function to check if server is online
+ Added notes to top of all files
* Moved getURL function to functions.php
* Re-written e-mail validation as a function and moved to functions.php
* Replaced IP validation with function by Mike (botscout.com)
* Moved old IP validation routine to functions.php and re-written as function
* Partial re-write of Spamhaus query routine in check_spammers_plain.php
* Fixed fSpamList SimpleXMLElement check (was only checking $xml->Email instead of all 3)
* Modified ProjectHoneyPot query so "Search Engine" and "Suspicious" aren't flagged when using check_spammers_plain.php
* Fixed SpamHaus query so PBL and CBL aren't flagged when using check_spammers_plain.php

Download:
http://support.it-mate.co.uk/?mode=Prod … searchtool

Next to add is the caching

fspamlist · 2009-02-23 4:50 am

Next to add is the caching

look at the serialize function in php to flatten an array. This may be useful in caching.

MysteryFCM · 2009-02-23 4:55 am

Nice one, cheers

MysteryFCM · 2009-02-25 5:23 pm

The following is for those without get_headers() and/or file_put_contents() available and contains ONLY the patched files. Just extract the zip and overwrite the existing copy of the files.

http://temerc.com/forums/viewtopic.php? … 0#p3436790

MysteryFCM · 2009-02-26 11:35 pm

Spambot Search Tool v0.23

This release incorporates fixes, modifications and an addition, all of which are listed below.

Version: 0.23

Date: 25-02-2009

+ Added error handling in case file_put_contents() is not available (used for the counter and dumping results to text file)
+ Added error handling in case get_headers() is not available (used for the isURLOnline() function)

Special thanks to ShadowPuterDude (malwareteks.com) for reporting these issues to me

Date: 26-02-2009

+ Added error handling in case SBST is forced to use PHP 5 on a system with PHP4 + 5 via .htaccess
* Modified check_spammers.php so the SimpleXMLElement availability check is done prior to the queries running
* Modified isURLOnline to check for PHP5 (skips and defaults to true if < PHP 5)

Special thanks to ShadowPuterDude (malwareteks.com) for reporting the above issues to me

+ Added selective matching so you can have the SBST block only if more than one of the spammers details match (see config.php) (requested)

Download:
http://support.it-mate.co.uk/?mode=Prod … searchtool

Mrwilson · 2009-03-07 4:07 pm

Ok its a year later, but I still wanted to thank Smurf_Minions and the others on this forum who explained the necessities for the spammer script. I successfully added Smurf_Minions script to my website registration scripts(non-forum) and enabled it to check both stopforumspam and the other site's database that was mentioned.

Thanks for being there. You are appreciated from a part time wannabe php scriptor.

MysteryFCM · 2009-03-07 4:56 pm

Can't speak for SM but, I'm sure he'd say it's our pleasure

Mrwilson · 2009-03-07 10:39 pm

Well, I meant all of you anyways and especially your comments on the use of the script. Thanks again

MysteryFCM · 2009-03-08 12:34 pm

No problem

Björn · 2009-03-18 1:23 am

Using version from 11-03-2009

I have read, read and ... Can not see why I got this error:
Fatal error: Call to undefined function curl_version() in x:\yyy\Forum\Check_Spammers\index.php on line 243

I am bad in both English and PHP.

MysteryFCM · 2009-03-18 1:38 am

Change;

curl_version() !=='Array'

To;

@curl_version() !=='Array'

This should supress the error until you get a chance to check cURL is installed, up to date and actually enabled in php.ini. To check it's enabled in php.ini, open the file, and locate the line containing;

extension=php_curl.dll

If it's got a semi colon at the beginning of the line, remove it, then re-start the server.

I'd also recommend checking file_get_contents is enabled aswell, as you'll need this if your going to be using PHP applications (allow_url_fopen should be "on" (allow_url_include should be OFF))

/edit

I forgot to mention, if the error is not supressed, change;

if(@curl_version() !=='Array' && !function_exists('file_get_contents')){
    echo '<span class="error">'.$nocurlorfgc.'</span>';
}else{
    if(file_exists('./check_spammers.php')){
        include("./check_spammers.php");
    }else{
        echo 'check_spammers.php is missing';
    }
}

To;

//if(@curl_version() !=='Array' && !function_exists('file_get_contents')){
//    echo '<span class="error">'.$nocurlorfgc.'</span>';
//}else{
    if(file_exists('./check_spammers.php')){
        include("./check_spammers.php");
    }else{
        echo 'check_spammers.php is missing';
    }
//}

Last edited by MysteryFCM (2009-03-18 2:05 am)

Björn · 2009-03-18 10:34 am

Thank you for reply.

No error after changing to @curl_version() !=='Array'
Unmark "extension=php_curl.dll" is ok in php.ini. (Use same in php5.ini)
Still no result.

Changing whole part of "if(@curl_version() !=='Array' && !function_exists..."
Now I get footer on page but still no reaction on spam check.

Noting in database or to textfile (Enabled).

Check spammer in Stop Forum Spam trigg ok:
clebraanoreib (False)
92.48.193.55 (True)
vunnysuix@mail.ru (True)

When click on link "View Spammers" I get this:
Error: Cannot query database ....

I have only key for stopforumspam.com yet.

Last edited by Björn (2009-03-18 10:34 am)

MysteryFCM · 2009-03-18 4:37 pm

Logging to text file/database, is dependant on your settings in config.php.

The only reason for it's not working with respect to returning results, would be if file_get_contents() and cURL() were not available.

To check these are available, put the following in a file called "test.php", and load it in your browser (ensure it is placed in your website root);

<?php
// Check file_get_contents()
$check =  file_get_contents('http://mysteryfcm.co.uk/online.txt');
if($check){
echo $check.'<br/>';
}

// Check cURL()
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, 'http://mysteryfcm.co.uk/online.txt');
curl_setopt($curl, CURLOPT_VERBOSE, 1);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_HEADER, 1);
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1);
$return = curl_exec($curl);
$info = curl_getinfo($curl);

?>

Last edited by MysteryFCM (2009-03-18 4:37 pm)

Björn · 2009-03-18 8:51 pm

Thank you, now it run :-)

Run your script, it tell me something was wrong. I check agn and found one more php.ini, in Apache. I have open up php.ini in PHP-directory before. That's the big problem.

I clean up Check_Spammers and make a new install.

But, still nothing in database or as text file. Have:
$bln_SaveToFile = TRUE; and $bln_SaveToDB = TRUE;
"View Spammers" and "View Reports" is empty.

"counter.txt" is updated.

After running a spam check and check have one or more positive, I get in bottom of page: "Table 'sbst.tblspammers' doesn't exist". If nothing, form display "Nope, it's not a spammer".

Thank you for your work!

Last edited by Björn (2009-03-18 8:52 pm)

MysteryFCM · 2009-03-18 8:55 pm

Cool, does this mean you've got it working now? Can you tell me what changes you had to make to the php.ini file?

If you're not bothered about the database, you can change $bln_SaveToDB = FALSE; ("View Spammers" will then load from text files, if $bln_SaveToDB is set to true, it will load from the DB).

If you DO want the database, and have not already done so, check config.php contains your database connection details, and that the database was created correctly (I've seen a couple systems where it successfully created it, and a couple where it failed - I've not figured out why it failed on some but not all yet)

Björn · 2009-03-22 8:00 am

I am back from a trip.

No, not all is in function.

I can seek and get answer from all enabled and this is the important part :-)

"counter.txt" is updated. It say 7 but I have only 5 blocked, yet.

"View Spammers" and "View Reports" still not in function.

I have in config.php:
$bln_SaveToFile = TRUE;
$bln_SaveToDB = TRUE;

In MySQL I have make directory ...data/SBST (Still empty)
$dbShost = 'localhost'; (Also have try 127.0.0.1)
$dbSname = 'SBST';
$dbSusername = 'My root name';
$dbSpassword = 'My password';

My first setup was wrong, I make mistake to edit wrong php.ini, I do it in ../php/ directory. That was why the first trouble come. When I edit in .../apache/bin/php.ini it start working. (Open up for extension=php_curl.dll)

I hope you understand my bad English. Best regard, Björn.

Ps, http://guldforum.se/Forum/Check_Spammers/ ds.

Last edited by Björn (2009-03-22 8:04 am)

MysteryFCM · 2009-03-22 10:14 pm

Sorry for taking so long.

Can you check the database exists (and the tables exist within it), and that the spambots folder is writable by the server please?.

Björn · 2009-03-23 7:34 am

Database is empty, only directory exist. No table. Have check also with MyPhpAdmin.

Everything is writable in WinXP.

I have 12 different database and can not see what is wrong in this SBST.
Correct spelling compared with config.php.

/edit
Change SBST to sbst for test, no different function.

There is a lot of error in code. I check with W3C:
http://validator.w3.org/check?verbose=1 … it%3Dcheck

Last edited by Björn (2009-03-23 7:46 am)

MysteryFCM · 2009-03-23 7:46 am

Because the tables haven't been created, can you try creating the tables manually in phpMyAdmin in the SBST database?

Tables required:

Name Type

fldspammer_id int AUTO_INCREMENT Primary key
fldspammer_name varchar(255)
fldspammer_ip varchar(15)
fldspammer_mail varchar(255)
flddb_matched varchar(255)
fldadded DATE
fldspammer_count int

Last edited by MysteryFCM (2009-03-23 7:50 am)

Björn · 2009-03-23 8:30 am

Okay, done.

Now I get "Table 'sbst.tblspammers' doesn't exist" down the table.

#176 2009-02-19 1:57 am

Re: Spambot detector (with the use of this API)

#177 2009-02-19 3:33 am

Re: Spambot detector (with the use of this API)

#178 2009-02-20 1:41 pm

Re: Spambot detector (with the use of this API)

#179 2009-02-20 2:19 pm

Re: Spambot detector (with the use of this API)

#180 2009-02-20 4:37 pm

Re: Spambot detector (with the use of this API)

#181 2009-02-23 1:25 am

Re: Spambot detector (with the use of this API)

#182 2009-02-23 4:50 am

Re: Spambot detector (with the use of this API)

#183 2009-02-23 4:55 am

Re: Spambot detector (with the use of this API)

#184 2009-02-25 5:23 pm

Re: Spambot detector (with the use of this API)

#185 2009-02-26 11:35 pm

Re: Spambot detector (with the use of this API)

#186 2009-03-07 4:07 pm

Re: Spambot detector (with the use of this API)

#187 2009-03-07 4:56 pm

Re: Spambot detector (with the use of this API)

#188 2009-03-07 10:39 pm

Re: Spambot detector (with the use of this API)

#189 2009-03-08 12:34 pm

Re: Spambot detector (with the use of this API)

#190 2009-03-18 1:23 am

Re: Spambot detector (with the use of this API)

#191 2009-03-18 1:38 am

Re: Spambot detector (with the use of this API)

#192 2009-03-18 10:34 am

Re: Spambot detector (with the use of this API)

#193 2009-03-18 4:37 pm

Re: Spambot detector (with the use of this API)

#194 2009-03-18 8:51 pm

Re: Spambot detector (with the use of this API)

#195 2009-03-18 8:55 pm

Re: Spambot detector (with the use of this API)

#196 2009-03-22 8:00 am

Re: Spambot detector (with the use of this API)

#197 2009-03-22 10:14 pm

Re: Spambot detector (with the use of this API)

#198 2009-03-23 7:34 am

Re: Spambot detector (with the use of this API)

#199 2009-03-23 7:46 am

Re: Spambot detector (with the use of this API)

#200 2009-03-23 8:30 am

Re: Spambot detector (with the use of this API)

Board footer