UBB.Developers Forums UBB.threads 7 Development How Do I? Permanent blocking of a user?

We have an extremely obnoxious user who we banned by username and by all the IP's that we could find from the messages he posted, using the "%" wildcard. But this guy continues to "haunt" the board by registering using a new username each time. Blocking his several IP's wasn't effective obviously. If we could see his IP when he registers, then we could block that too, but I can't seem to find a way to do this either.

Any suggestions on how we can effectively deal with this pest would be greatly appreciated, short of blocking entire domains, which as you know isn't the prudent thing to do as it blocks out dozens of otherwise great registered users.

Jeff

That's tough.

Are you allowing more than one username per email?
Are you having initial passwords sent via email?
That would slow him down a little. He would have to have unique email addresses and they would have to be valid for him to register a username.

Also... a little trick I did with a couple of trolls once, that seemed to work. If you remove them from ALL usergroups...they will receive SQL errors everywhere and won't be able to see anything. I assumed they thought our board was broken (only to them -he he) and moved on.

If you run the following SQL command under Admin, it will show you the Email and IP address when they registered:

code:

SELECT `U_RegEmail`,`U_RegIP` FROM `w3t_Users` WHERE 1 AND `U_Username` LIKE 'xxxxxx'

---

Put the username where I have the xxxxxx

Hope that helps!

Are you allowing more than one username per email? No

Are you having initial passwords sent via email? Yes

The SQL command surely will be an asset as it will allow us to ban the IP he registers with, which before now was not accessible. That still leaves us with the problem of discerning if a new user is him! []http://www.the-highway.com/Smileys/scratch.gif[/]

Thanks for the help!

Jeff

We have a small group of people we have banned and wanted to make sure didn't come back. We banned their accounts (duh ) then their IP's, cut back as far as we could cut without affecting anyone else who is a member, then I used the same IP's and denied them access to the website via .htaccess. Now when they try to access all they get is a 403 Forbidden error. (I may change that to something a little more clever at some point, but I haven't gotten around to it. )

The drawbacks, as you've noted, are denying access to someone who should be able to access. In the last several months I've only had 1 person email me and tell me they were seeing the 403 error that should actually have had access. It was as simple as adding her IP to the .htaccess as allow and she had no problem after that. I was actually quite surprised, because we have almost 4000 members and we have been getting at least 10 new members a day over the last month or so. I make sure there is an email address on the 403 page so that if a legitimate user gets it they can contact me to help them out.

Unfortunately a big problem is AOL. We still have a LOT of people on AOL (maybe 50%?) and for the most part their IP's change so much there is no way you could block anyone without just blocking AOL. I know of several websites that have done this (I used to frequent Anandtech.com and they did this a couple years ago.) I'm sure a lot of people complained and they're right, it isn't fair, but it's also not fair to run a website and have to spend your entire day and night hunting and fighting trolls.

Since we can't really solve the problem with AOL'ers, we have the board set to require admin. approval for all new users. They sign up, I (and the other admin) get an email saying a new user registered, then we pull it up in the admin. panel. It has their IP and their email address they used. We faithfully run every IP through NeoTrace and see if it looks suspicious. If it happens to come from an area that we know one of our former trolls is in, we investigate it a little more closely before approving it.

When we were having a particularly bad time, we set up a new group called "New". We made all new users part of the "New" group instead of "Users", and set the "New" group to read only access to all of the forums. That gave us time to check them out a little more closely, see which forums they went to, what threads they were reading, etc. If they were hanging out in threads that a new user simply wouldn't have known existed (like a forum not seen to unregistered and a thread that was a month old) we knew they were digging up something, probably trying to cause trouble. Again, it warranted closer inspection. Sometimes I've even just sent the new person a PM telling them we are looking into some marketing strategies and it would be very helpful to know how they heard about our site and how they found us.

Yep, it sounds like a lot of work. But it's at least kept the trolling down significantly. Good luck!

Lisa,

Thanks for understanding the problem in banning IP's, e.g., with so many AOL users. The .htaccess idea sounds like something worth trying.... but could you give me some details instructions on how to set this up and where to put the file itself?

Unfortunately, I don't have the option to have new registrations approved by the Admnistrators/Moderators (I'm using the Perl version). So that's out!

Lastly, the SQL command which JoshPet gave me finds the "registration IP". Now this is a bit confusing to my aging gray matter because running this command on myself brings back an IP that has nothing even remotely similar to my actual WAN IP?? So would banning that "registration IP" be effective at all? []http://www.the-highway.com/Smileys/hairout.gif[/] []http://www.the-highway.com/Smileys/help.gif[/]

Jeff

Be careful with the .htaccess file if you use FrontPage, I believe servers put the code FrontPage uses in an .htaccess file, so if you upload a new one you could/would be writing over those codes and FrontPage wouldn't be able to access the site anymore (until the host reinstalled them.)

Usually the .htaccess file is placed in the root folder, so that it applies to your whole site, but it's definitely less restrictive to put it in your ubbthreads directory, if your board is all that you are concerned with blocking.

The .htaccess file is an ASCII text document that can be placed in any directory on your site. It can be used to control access to files and directories, and customize some server operation in your site. A .htaccess file can be created in any word processor but must be saved as text only. You must use FTP software in ASCII mode to upload or edit your .htaccess file.

To block a user, you'll put their IP address in the file like this:

code:
<Limit GET>
order allow,deny
deny from 128.23.45.
deny from 207.158.255.213
allow from all
</Limit>

---

anyone trying to access the site from the IP '128.23.45?.???' would get a forbidden error. The IP 207.158.255.213 would give the same error. The code goes on to say to allow everyone else access.

You just want to use notepad or something similar, type in the code (using the IP's you want to block), then save it as ".htaccess" (no quotes). FTP it to your threads directory (make sure you upload it as ASCII! not binary!) and you should be all set. If your FTP program won't allow you to upload the file with no character before the "." then name it something like htaccess.txt and rename it to .htaccess after it's uploaded. It has to be named .htaccess (no character before the ".").

As far as finding the correct IP's to block, we usually try banning both the registration IP and the IP they posted with. They are often different, especially if they registered a long time ago. They may have registered from a different computer, from a different ISP, etc. So we ban the registration IP for a backup measure, but we are most concerned with the IP on their posts.

If you want to PM or email me the IP of the person, I'd be glad to help you figure out what to ban.

Another idea to find the IP's you really want to block would be to go through your website's logs for the day when the person has accessed. If your site is small enough it shouldn't be too hard to find it. You may have to wait until the next time he/she accesses the site and then immediately download the log to narrow it down better. It doesn't work for our site because our logs are over 6MB per day, but it would be very helpful if we were smaller. This would be the IP the server would be looking for to deny or allow access via the .htaccess file.

One of the problems you'll run into with blocking IPs is that not everyone has a static IP address. It's more common to get a different IP address every time you access your ISP. If you start getting hit by a troll, and you know their IP address you could block the specific IP address, but if they come back then you'll have to block a range of addresses.

With UBB Classic I use to block registrations that used an email address from one of the anonymizer sites, and at one time I had to block AOL and Yahoo email addresses...

Lisa,

That was extremely helpful and informative. I don't use FrontPage and the FP extensions have not been installed on my server... so that's a non issue.

I'll definitely give this a try. I sure wish I had gotten this information before I removed the username along with all the IP's. But I did have the wherewithal to write them down.... so I still have them for this one particular individual, hehe. []http://www.the-highway.com/Smileys/evilgrin.gif[/]

Jeff

If you could classify this person as harassing you or your patrons, you might want to email their ISP and ask them to block them (they would most likely cancel their account due to basic TOS violations).

I had some jerk using my SMTP server to send spam once, he used a hotmail account. I emailed [][email protected][/] and they cancelled his email the same day. That was sweet

posted by Lisa_P:

---

Unfortunately a big problem is AOL. We still have a LOT of people on AOL (maybe 50%?) and for the most part their IP's change so much there is no way you could block anyone without just blocking AOL.

---

One could create an "exempt" table to store user id numbers then during the "check ban" function it would ignore the banned IP address if it's being used by an "exempt" user. Then a whole block of IP addresses could be banned and not affect trusted users.

I have done something simular for other purposes and not with php for a website. It works well.

[]One could create an "exempt" table to store user id numbers then during the "check ban" function . . .

---

Sounds interesting Dave. How about some details on how to create such an "exempt" table (for Perl, of course) []http://www.the-highway.com/Smileys/rofl.gif[/]

Jeff

posted by Pilgrim:

---

We have an extremely obnoxious user who we banned by username and by all the IP's that we could find from the messages he posted, using the "%" wildcard. But this guy continues to "haunt" the board by registering using a new username each time. Blocking his several IP's wasn't effective obviously. If we could see his IP when he registers, then we could block that too, but I can't seem to find a way to do this either.

Any suggestions on how we can effectively deal with this pest would be greatly appreciated, short of blocking entire domains, which as you know isn't the prudent thing to do as it blocks out dozens of otherwise great registered users.

Jeff

---

If you approve all subscription requests, you can add the IP address and username to the email sent to the Administrators of the forums.

In adduser.php, find the following line (near bottom of file):

$msg = "{$ubbt_lang['NEWREGBODY']} {$config['phpurl']}/admin/login.php?file=approveuser.php";

And change it to:

$msg = "{$ubbt_lang['NEWREGBODY']} {$config['phpurl']}/admin/login.php?file=approveuser.php \nIP: $ip_q $newuser";

Note: the above is all on ONE line but the spaces may make it wrap in this message.

When you get email notification of a new subscription request, your email will now contain the IP address and username.

It may be that the troublesome user has found out how to use anonymous proxy servers on the internet and thus is able to use a different IP address every time he posts. There's not much one can do about this kind of annoyance. When I had this problem, I had to change all of my forums to registered only, except for one, which I left open for the unregistered users.

Btw, my site is at http://www.nagual.com/ubbthreads/ubbthreads.php

FC