1

this problem has been killing me and I could not find a solution.

I implement a scoring system based on links in PHP.

A person "A" can post a link on social networks like Twitter and when another person "B" open this link, the individual A wins 10 points.

The problem is that when the link is posted on twitter for example. It opens so many times giving too many points to the other person.

I have tried to identify the User agent in PHP to determine when a human opens the link, but some twitter hits look like this:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36

This could clearly be a human, but it is not, Because that user agent opened twice the link in the same second with 2 different IP. 52.19.163.13 and 52.16.66.216. If I'm not mistaken are Amazon servers.

Even I excluded all the robots in robots.txt but is not working. This is the way I try to identify a human.

$app->get('/link/:code', function($codigo){

if(is_human() and !is_bot())
{
   $res = $db->giveCoins($codigo);

    if ($res !== 0) {

    echo "Redirect to another page"; //cannot be a human interaction on this page

    }else
        {
        echo "Robot";
        }
}

});

And these are the functions I use to analyze the User Agent:

function is_bot(){

$botlist = array("Gigabot", "Googlebot",
                "FlipboardProxy", "Purebot", 
                "facebookexternalhit","applebot",
                "Google-HTTP-Java-Client",
                "Chrome/33.0.0.0");

foreach($botlist as $bot){
if(strpos($_SERVER['HTTP_USER_AGENT'],$bot)!==false)
return true;    // Is a bot
}
return false;    // Not a bot
}        

function is_human(){

$humanlist = array("Android","Safari",
                  "Chrome","OPR","Opera",
                  "Chromium","Firefox");

foreach($humanlist as $bot){
if(strpos($_SERVER['HTTP_USER_AGENT'],$bot)!==false)
return true;    // Probably a human
}
return false;    // Probably not a human
}

I do not know if there is a smarter way to determine if is a human who opens the link. Thanks for the attention

Sebastian
  • 133
  • 2
  • 14
  • 1
    Possible duplicate of [how to detect search engine bots with php?](http://stackoverflow.com/questions/677419/how-to-detect-search-engine-bots-with-php) – Tomasz Kowalczyk Jun 03 '16 at 16:36
  • @TomaszKowalczyk That's literally what OP is doing, and it's apparently giving him false positives. – ccKep Jun 03 '16 at 16:43
  • You wouldn't want to make the landing page do a CAPTCHA, to redirect to the award page? – infixed Jun 03 '16 at 16:44
  • @Sebastian How are you certain that's not a human? If you can answer that question: Implement the same logic you used to answer it in your code? – ccKep Jun 03 '16 at 16:44
  • @ccKep Because I tried it on a new Twitter account without followers. Nobody could have pressed the link. – Sebastian Jun 03 '16 at 16:49
  • @infixed I thought, but the only link function is to provide points to the A user and quickly be redirected to the next page. If I put captchas there is a possibility that the user B does not end the process by mistrust. – Sebastian Jun 03 '16 at 16:59
  • I personally hate CAPTCHAs because I hate telling NoScript to allow scrpts from an unproven site to run. But I figured you were leaning on people being greedy, so it wouldn't matter too much. Maybe a few would slip the hook. OTOH not a CAPTCHA, but a landing page of many anchors, with most of them being invisible to a real browsing sessions, but findable by a robot increases the chance that a robot could trip the wrong one. – infixed Jun 03 '16 at 17:10
  • I checked the IP address of the user agent exposed on the question and seem to be Amazon web services directions. I will block those IP's, but something similar may happen with other platforms, then I'm really interested in a slightly more global solution. – Sebastian Jun 03 '16 at 17:16
  • I think the best way here is a second confirmation, like a captcha or login with social network, if it applies here. A white list would be to restrictive, and a black list would be too fragile. – Felippe Duarte Jun 03 '16 at 17:23

0 Answers0