Attention:

Support Rules and Guidelines
Before you post your support topic, please remember to:
  • Read the support forum rules.
  • Check the wiki and use search to see if your problem can be answered there first.
  • Link your board please, and make sure that the problem on your board is visible to guests or provide a test account.
  • Do not post Board Wrappers and CSS unless requested. With a board link, this is not necessary.
  • Be as descriptive as you can and use as many details as possible when describing your problem.
  • Please briefly mark any links to forums that may not be work-safe.
This will help ensure your support issue will be attended to in a quick and efficient manner.

Pages: (4) 1 2 3 ... Last » ( Go to first unread post ) Add ReplyNew TopicNew Poll

 spambots?
#
it's just started today, but we've had several of these sort of advertisements show up on the site- it seems like spambots, but I'm not even sure if thats possible! Not sure if you can see the link since we've moved the threads to the trashcan.

Thanks in advance <3
PM
#
That can't be viewed by anyone that isn't staff of your site, but if it's what I think it is, the same is happening on Caution lately.

signature
#
We have been getting this the last 24 hours as well. All seem to be from IP's that are from the Russian Federation according to the IPlocation facility.

Heart of the West

We have banned the IP's and deleted them to the trash can of the site, but here are two example screenshots of the 7 we have had so far. Some are in Russian and others in English.

Screen Shot 1

Screen shot 2

Is there anything else we can do? It's happening in the guest friendly area for advertising other RPG sites.


PM
#
Here is one that I didn't delete:
http://heartofthewest.jcink.net/index.php?...st=0&#entry3553

EDIT:

It is now deleted as we have been hit multiple times since this one.

This post has been edited by charlotte1912: Jan 4 2017, 04:38 PM
PM
#
Please provide the IP(s) so I can see if it's one specific data center or all spread out and see where they've been as well.

Guest forums tend to be a hotbed for spam in general, so this is always a challenge.

signature
email: admin@jcink.com :: blog: John C.
#
78.109.24.109 192.36.27.6
Those are the two I have on hand, I'll post the rest when I get home.
PM
#
Two different countries there, hmm, so that's not good. We might have to start scanning every guest IP address during posting to see if they're in a spam database unfortunately. I'd like to not have to do that but if this becomes a problem that will be the only option we've got. Please let me know if you keep getting these.

signature
email: admin@jcink.com :: blog: John C.
#
Here our ours, list as follows: (in order of hit date and time - oldest to newest)

164.215.87.7

188.168.150.34

46.191.170.95

94.41.113.249

94.41.217.253

95.154.150.75

141.105.42.92

46.191.171.253

136.169.193.91

2.92.25.26 ( x2)

79.134.206.178

EDIT: We did a blanket IP ban on a few of these e.g 79.*.*.* and 141.105.*.* The last one was approx 1:30pm EST

This post has been edited by charlotte1912: Jan 4 2017, 04:57 PM
PM
#
Ok,

I have looked up each one of those IPs and their ranges, most of them have been associated with ranges that were caught spamming according to sfs.

So I have walled that group and as well any subgroups (wherever you see a /24 in this list, 255 ip addresses within that same subnet have also been banned) from the system, although I don't think this is going to be super effective at all unless they are just using the same IPs over and over again.

CODE
deny 164.215.87.7;
deny 46.191.170.0/24;
deny 94.41.113.0/24;
deny 94.41.217.0/24;
deny 95.154.150.0/24;
deny 141.105.42.92;
deny 46.191.171.0/24;
deny 136.169.193.0/24;
deny 2.92.25.0/24;
deny 79.134.206.0/24;

I would NOT do a blanket ban on 79.*.*.* -- this bans way too many valid users.

signature
email: admin@jcink.com :: blog: John C.
#
So would blanketing anything with just the first number say 188 and then *.*.* also be too limiting? What would you suggest as an alternative?
PM
#
Block /24's or: example 2.92.25.*

At maximum, block 2.92.*.*

This may be something we have to address at a higher level though with checking every guest post's IP, cat & mouse of blocking IPs doesn't sound like it will be effective here.

signature
email: admin@jcink.com :: blog: John C.
#
And one more for the list:

176.214.149.255

They are quite persistent :/

This post has been edited by charlotte1912: Jan 4 2017, 10:09 PM
PM
#
That's a fresh one apparently.

http://stopforumspam.com/ipcheck/176.214.149.255

signature
email: admin@jcink.com :: blog: John C.
#
One more for the collection. At least it is less frequent now http://files.b1.jcink.com/html/emoticons/smile.gif

212.232.4.183
PM
#
Good to hear!

signature
email: admin@jcink.com :: blog: John C.
0 User(s) are reading this topic (0 Guests and 0 Anonymous Users)
0 Members:
Share this topic:
« Next Oldest | General Support | Next Newest »

OptionsPages: (4) 1 2 3 ... Last » Add ReplyNew TopicNew Poll