Attention:

Support Rules and Guidelines
Before you post your support topic, please remember to:
  • Read the support forum rules.
  • Check the wiki and use search to see if your problem can be answered there first.
  • Link your board please, and make sure that the problem on your board is visible to guests or provide a test account.
  • Do not post Board Wrappers and CSS unless requested. With a board link, this is not necessary.
  • Be as descriptive as you can and use as many details as possible when describing your problem.
  • Please briefly mark any links to forums that may not be work-safe.
This will help ensure your support issue will be attended to in a quick and efficient manner.

Pages: (4) 1 2 3 4  ( Go to first unread post ) Add ReplyNew TopicNew Poll

 spambots?
#
The latest one was such a lovely message.. lol

Title: Asshole

Message: ...

Seems to have Dunald somewhere in the name of its hits.
IP: 5.57.218.204
PM
#
I have had the same happening lately John, here are the IP's i got:

217.23.14.190
192.36.27.4
34.195.147.209
134.249.52.48
178.213.191.22

I have banned those from my board but, they seem to just post wherever they are allowed and sadly (like wanted ads, face claims) i cannot close those for guests to post so, please help?
PM
#
I understand your frustration. I will look into adding a scan on all incoming IPs posting to guest forums as I am seeing more of this than just on your board(s). However it also isn't super widespread, either, at least not yet. I've walled those IP ranges for now as well, all /24s

Unfortunately the IP addresses used are also obviously very random. Spammers love guest forums as I said :/ I realize that many utilize the guest feature but it's always the biggest risk for spam, and the hardest to secure without making it a huge inconvenience to post.

Only about half of those IPs were listed in a spam database somewhere, so it won't be a silver bullet.

signature
email: admin@jcink.com :: blog: John C.
#
I implemented scanning of guest IP addresses. Based on the data I've collected in the last 24 hours, about 2,000 attempts to spam have been blocked by the checking.

Have any of you had spam similar to the stuff reported in the last 24 hours?

signature
email: admin@jcink.com :: blog: John C.
#
i've just recently started getting some spambots too!!

83.26.51.84
92.222.81.196
178.159.37.60

here's another ip for you
i'm a little confused, how are they getting past the capchas or are they actual people posting these?

This post has been edited by jess the hufflepuff: Jan 13 2017, 10:06 PM
PM
#
captchas have been broken for years. none of them are 100%, they try and try until it is broken, even at a 30% success rate. actual people are not posting these.

did all of those IPs appear today or is that from the past? the last two are being actively blocked. I counted 300 blocked attempts for the third IP, and 10 for the second. the first was unlisted for some reason, unfortunately, I just listed it now.

so far im seeing pretty good success with the blacklist checking. over 6,000 attempts blocked now.

signature
email: admin@jcink.com :: blog: John C.
#
oooh had no idea!

178.159.37.60 was from the 11th of jan
5.166.196.156 [i didn't add this to the list, just noticed it] was from the 12th of jan
83.26.51.84 was from today
and i can't seem to find the 92 ip anymore

178.159.37.60 here's another one from the 10th! which is when they started, so i haven't had as much as the others that have been posting, but they seem to have only just started

i'll keep you updated if i get more
PM
#
IP: [ 185.154.13.7 ]
IP: [ 178.125.83.96 ]

these were maybe within the last couple of hours on shine!

This post has been edited by clicker: Jan 14 2017, 07:44 PM
PM
#
Looks like those are very fresh.

This doesn't look like it's going to stop any time soon, so moderation is going to be a must. The only thing we can do is try to change the captcha to something else, maybe add something that will confuse the bots for a while.

I'm seeing a much better situation though since I enabled the scanning of each guest IP.

signature
email: admin@jcink.com :: blog: John C.
#
these are all from the last like 10 or so hours!

they both posted 2 different advertisements, as well!
5.164.245.37
95.79.82.33
PM
#
Those are fresh too, so I will add them, but this is becoming a game of cat & mouse.

IP banning specifically will not be effective so going forward I won't be banning anymore individual IPs unless I identify them to be highly toxic.

To date we've had about 10k attempts blocked by the scanning but it's missing the freshest of spammer IPs

signature
email: admin@jcink.com :: blog: John C.
#
IP: [ 178.217.48.244 ]

thanks for taking the time to try & look into this! in the meantime, just deleting the posts really isn't that excess. :^ )
PM
#
caution and shine are getting quite a bit

ones from caution:

216.218.222.13
217.23.14.190
163.172.157.153
173.199.65.45
212.129.49.241
84.16.241.100
178.159.37.60
83.26.51.84
185.154.13.7
178.137.167.157
95.79.82.33
5.164.245.37

ones from shine:

185.2.101.31
95.25.70.109
46.119.5.2
46.118.153.29
178.137.18.32
77.234.44.159
173.254.197.71
37.113.13.8
193.93.195.60
117.235.134.236
178.159.37.60
46.0.104.169
178.213.6.189
176.8.88.79
91.243.93.241
5.167.116.41
109.227.124.83
109.162.122.6

while yes topics can be purged and/or moved, it's getting tedious and disabling guest posting isn't realistic for the ads area (though for some reason shine is getting all of them in the site necessities -> application templates area). i just hope this stops soon~
PM
#
Are those all of them overall or just from today? many of them are listed and being already actively blocked now as of Jan 11th when I added the scanning.

so far caution has about ~200 blocked from scanning and so does shine from my logs. about equal there with the # of attempts.

but some of them, for example, are getting in because of being very new, ex:

5.164.245.37

http://stopforumspam.com/ipcheck/5.164.245.37

just listed a couple hours ago unfortunately so it got you before it was listed.

in the next few days I will try adding a new line to the form to see if that helps. something basic like "Type the site's name here" or "What is 1+1" to see if I can at least temporarily throw off the bots.

signature
email: admin@jcink.com :: blog: John C.
#
QUOTE (John @ Jan 15 2017, 05:36 PM)
Are those all of them overall or just from today? many of them are listed and being already actively blocked now as of Jan 11th when I added the scanning.

so far caution has about ~200 blocked from scanning and so does shine from my logs. about equal there with the # of attempts.

but some of them, for example, are getting in because of being very new, ex:

5.164.245.37

http://stopforumspam.com/ipcheck/5.164.245.37

just listed a couple hours ago unfortunately so it got you before it was listed.

in the next few days I will try adding a new line to the form to see if that helps. something basic like "Type the site's name here" or "What is 1+1" to see if I can at least temporarily throw off the bots.


all the caution ones are from the 3rd until today, and the shine ones are only from the past 2-5 days up until today (aside from two if the IPs that were a little bit before the spam bots went crazy).

i'm so glad you're gonna add something. hopefully it'll successfully throw them off and then it'll stop. i'll keep my fingers crossed! and thank you so much for being such an amazing hoster. the fact you're so on top of things and so fast is really appreciated.
PM
0 User(s) are reading this topic (0 Guests and 0 Anonymous Users)
0 Members:
Share this topic:
« Next Oldest | General Support | Next Newest »

OptionsPages: (4) 1 2 3 4  Add ReplyNew TopicNew Poll