I've been speaking lately with folks from Spamhaus about anti spam measure in YOURLS and a YOURLS plugin for this. Currently the #1 result in Google for "spamhaus PHP" is a post on Lockergnome which gets it totally wrong and provides a script that does not work, so here is a PHP script that does work.
This script checks a URL (its domain part, in fact) against the 3 major black lists: Spamhaus, SURBL and URIBL.
The script:
- /**
- * Check a URL against the 3 major blacklists
- *
- * @param string $url The URL to check
- * @return mixed true if blacklisted, false if not blacklisted, 'malformed' if URL looks weird
- */
- function ozh_is_blacklisted( $url ) {
- $parsed = parse_url( $url );
- if( !isset( $parsed['host'] ) )
- return 'malformed';
- // Remove www. from domain (but not from www.com)
- $parsed['host'] = preg_replace( '/^www\.(.+\.)/i', '$1', $parsed['host'] );
- // The 3 major blacklists
- $blacklists = array(
- 'zen.spamhaus.org',
- 'multi.surbl.org',
- 'black.uribl.com',
- );
- // Check against each black list, exit if blacklisted
- foreach( $blacklists as $blacklist ) {
- $domain = $parsed['host'] . '.' . $blacklist . '.';
- $record = dns_get_record( $domain );
- if( count( $record ) > 0 )
- return true;
- }
- // All clear, probably not spam
- return false;
- }
Usage:
- if( ozh_is_blacklisted( $url ) ) {
- // do something brutal (eg die() your script, yell at user, etc...)
- }
- // all is fine *for today*, do your regular stuff.
- // This said, it'd be nice to recheck every couple of days
Feel free to steal.
Shorter URL
Want to share or tweet this post? Please use this short URL: http://ozh.in/vk
So, is this plugin available? I just got YOURLS set up last night. LOVE it.
Daniel Johnson, Jr. » It is. Check the official plugin list
Great work. But Spamhaus says you need to reverse the IP, I don't see where your code does that. (FYI: http://www.spamhaus.org/faq/section/DNSBL%20Usage#252) Also, ZEN checks the PBL which should not be used to determine if an IP address belongs to a spammer. The query result needs to be parsed to see if the IP is on the SBL or XBL only.
JP » Yep you're right. I should update the code. Fancy doing it? :)
I'm not familiar with SURBL and URIBL, but I'll try. I'll focus on Spamhaus because I was already working on a MyBB plugin for it. It will take a few days, in the meantime here's how to take the IP and reverse it for Spamhaus:
OK, I might be wrong but it may have been easier than I thought. Spamhaus and URIBL both return 127.0.0.2 if the IP address is on their blacklist. I'm not sure about SURBL but it may be the same. I was not able to test this. Could you test and let me know?
JP » The thing is, except Spamhaus, I don't think you're supposed to reverse IPs, yet your code does it for all providers :)
Ozh, you have to reverse IP for all three.
http://www.uribl.com/about.shtml#implementation
http://www.surbl.org/guidelines
http://www.spamhaus.org/faq/section/DNSBL%20Usage#252
JP » Oh yeah, sorry, I mixed up things. Your script is very fine for checking IPs (like, before accepting mail for instance) but this doesn't work well for web spam since a domain can be blacklisted (evil.com) but the IP it's hosted on can be clear (201.202.203.204 shared hosting with lots of clean sites), or the other way round
So, i've reinstalled my yourls site, and found i needed a spam filter after only a day. HOWEVER, when i try to use this plugin, it blocks EVERYTHING.
i've not been able to post a single site that would get shortened. I leave it on and only turn it off when I want to post a link, but it prevents any legitimate posts from going though in the meantime. Any word on this?
Crazy-Jake: check https://github.com/YOURLS/antispam/issues/2
line 22 of JP's code needs to be changed to:
return implode(".", array_reverse(explode(".", $ip))) . ".". $blacklist;
as it is it returns xxx.xxx.xxxzen.spamhaus.org instead of
xxx.xxx.xxx.zen.spamhaus.org
function is_blacklisted($ip) {
$blacklists = getblacklistproviders();
foreach($blacklists as $blacklist) {
$url = buildurl($ip, $blacklist);
$record = dns_get_record($url);
if ($record === "127.0.0.2") {
return true;
}
}
return false;
}
function getblacklistproviders() {
// add providers here
return array(
'zen.spamhaus.org',
'multi.surbl.org',
'multi.uribl.com'
);
}
function buildurl($ip, $blacklistprovider) {
return implode(".", array_reverse(explode(".", $ip))). "." . $blacklistprovider;
}