Page 3 of 4

Re: An account was just locked. - Repeated 80 times...

PostPosted: Sun Mar 06, 2011 12:10 pm
Author: Teelk
Search bots are being forced to use Lo-Fi MOD. Lo-Fi MOD still has phpbb and integramod copyrights as text that can be indexed by search engines. Douches who use spam bots to hack forums find those forums on search engines. To remove the text copyrights do the following quick and dirty hack.

OPEN
templates/Integra2/lofi/lofi_footer.tpl and templates/Integra2/lofi/bots/lofi_bots_footer.tpl

FIND
Code: Select all
   Powered by <a>IntegraMOD</a>{INTEGRAMOD_VERSION} © 2004, 2005 The Integramod Group {TRANSLATION_INFO}<br>
   [ Forum powered by <a>phpBB</a>{PHPBB_VERSION} © 2001, 2005 phpBB Group :: {S_TIMEZONE} :: Design by <a>phpBBXS.Com</a> | <a>Lo-Fi Mod</a> ]<br>

REPLACE WITH
<table>
<tr>
<td>
<img>
</td>
<td>
<a><img></a><span>{INTEGRAMOD_VERSION} </span><img></td>
<td>
<img>
</td>
</tr>
</table>
<table>
<tr>
<td>
<img>
</td>
<td>
<a><img></a><span>{PHPBB_VERSION} </span><img></td>
<td>
<img>
</td>
</tr>
</table>
Do this for all templates.

Re: An account was just locked. - Repeated 80 times...

PostPosted: Sun Mar 06, 2011 2:50 pm
Author: AlaskaMat
Teelk,
I hate to ask because I'm afraid its a stupid question, but what file do I look in to find/replace the code you provided?
Thanks,

Re: An account was just locked. - Repeated 80 times...

PostPosted: Sun Mar 06, 2011 2:52 pm
Author: Teelk
Not a stupid question at all, it was stupid of me to forget to include that information. It's in tempates/Integra2/overall_footer.tpl
I'll edit the other post too.

EDIT: Wow... I'm really not with it at all. Ignore where I just told you to look, I edited the other post with the right file.

Re: An account was just locked. - Repeated 80 times...

PostPosted: Sun Mar 06, 2011 2:59 pm
Author: Teelk
And I just noticed that this should be done to another file as well.

templates/Integra2/lofi/bots/lofi_bots_footer.tpl

And of coarse to all the templates you use...

Re: An account was just locked. - Repeated 80 times...

PostPosted: Sun Mar 06, 2011 3:46 pm
Author: AlaskaMat
Thanks, Teelk
This issue has been driving a lot of us nuts. I'll give it a try.

Re: An account was just locked. - Repeated 80 times...

PostPosted: Sun Mar 06, 2011 4:46 pm
Author: mspringgay
Disappointed the mod won't help. Your suggestion of forcing a visual sign on would work just great for me if I was on 1.4.1. Unfortunately still on 1.4.0 just no time to work through an upgrade.

Any how for me its only effecting a couple accounts since mostly run a closed forum. My attempt to minimize the impact has been to abandon one of the accounts adding additional logic to ban any IP attempting to login. Hopefully I'll catch enough of the IPs that the other accounts will stop getting locked up.

Appreciate you looking into ways to prevent the issue.

Re: An account was just locked. - Repeated 80 times...

PostPosted: Mon Mar 07, 2011 1:24 am
Author: Teelk
Mspringgay,

I would suggest trying a confirmation right on the login page, [url=http]Anti Robotic Login Flood MOD[/url].

By the looks of it, it should install on 1.4.0 without issue.

Re: An account was just locked. - Repeated 80 times...

PostPosted: Tue Mar 22, 2011 10:17 pm
Author: viragotech
"HelterSkelter" wrote:Great to see you Teelk!
The mod I sent you is also available for phpBB3 and in that version you have the ability to block ip's and email addresses that have been reported to "block forum spam". We use it here.


Any way you could share the list of IP and such the forum here is auto blocking. Giving us a head start on them???

Re: An account was just locked. - Repeated 80 times...

PostPosted: Wed Mar 23, 2011 9:57 am
Author: viragotech
First line of defense looks to be working. I didn't have 100s of locked account notices this AM. [using stuff from this thread too http://www.integramod.com/forum/viewtop ... =18&t=5792 ]


Progress; finally, if anyone members we have had allot of problems and they are finally starting to come to light. As more and more forums have the same problems now ;)


Also should be some big master list somewhere for a head start.



F'in Spam Bots

People who work in Spam should be publicly hanged as a lesson to others. Very brutal but it works. Watching someone’s neck grow a ft longer will put some perspective on your way of life.

Re: An account was just locked. - Repeated 80 times...

PostPosted: Sun Mar 27, 2011 10:00 am
Author: Texas-Racer
Our forum was having this same problem for months, they was locking up to 30 accounts at a time. I recently took over ownership of the forum and started investigating. All of the IP's was coming from TOR, I found a master list of all the TOR IP's, took a leap of faith, and banned every single one. The problem instantly stopped. It took me a couple of hours because I had to add a comma after each IP for the mass ban, and there is literally around 1,000 IP's. I banned them under the user admin, ban control.
I still have the list I added the commas to for the ban, this was just last week, and will gladly share that list with anyone that wants them. The TOR list does change as people add their computer to the network, but the master list I found updates every hour and you can check a new attacker against the TOR master list to see if that IP needs banned.
This has not effected any of my members. If they complain they got banned then you should investigate that user a little deeper. If they are using the TOR software to surf the internet simply tell them to turn the software off while using your sight and reveal their real IP.
TOR master list
https://www.dan.me.uk/torlist/
https://www.dan.me.uk/tornodes
Contact me for the list I have with the commas added for the ban list.

Re: An account was just locked. - Repeated 80 times...

PostPosted: Sun Mar 27, 2011 10:50 am
Author: viragotech
Where is the CT Proxy, IP & UserAgent Blocker list kept and can it be manually edited?

Re: An account was just locked. - Repeated 80 times...

PostPosted: Sun Mar 27, 2011 12:02 pm
Author: Helter
it is stored in your database under "phpbb_ctracker_ipblocker"

Re: An account was just locked. - Repeated 80 times...

PostPosted: Sun Mar 27, 2011 12:13 pm
Author: viragotech
"HelterSkelter" wrote:it is stored in your database under "phpbb_ctracker_ipblocker"


Thank but that looks like even more work ;) [Plus I can see how many times they failed <img> ]

Re: An account was just locked. - Repeated 80 times...

PostPosted: Sun Mar 27, 2011 1:41 pm
Author: viragotech
"Texas-Racer" wrote:TOR master list
https://www.dan.me.uk/torlist/
Contact me for the list I have with the commas added for the ban list.


2509 IPs on that master list YIKES

But yes most of our failed logins trace back to Tor.

Re: An account was just locked. - Repeated 80 times...

PostPosted: Sun Mar 27, 2011 2:16 pm
Author: Texas-Racer
It did literally take around two hours to add the comas, desperate people do desperate things.