Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

A forum I run has been the victim of spam user accounts recently - several accounts that have been registered and the profile fill with advertising/links. All of this is for the same company, or group of companies.

I deleted several accounts weeks ago and blocked some IP addresses, but today they have come back with the same spam. Every account has a different IP address, but they are all of the form 122.179.*.* or 122.169.*.*.

I am considering blocking those two IP ranges, but there are potentially thousands of IPs in that range. They appear to be assigned to India (although the spam is for an American company) so given the site is for a western, English-speaking audience maybe it doesn't matter. My questions:

  1. How are they posting on so many IPs?
  2. Is there likely to be a limit to the number of IPs they have access to?
  3. Is there anything else I can do at the IP-level to block them? (I am looking into other measures like blocking usernames/links.)
share|improve this question
    
They probably are using proxies. And probably they can access many, and each proxy's IP can change too. I bet you know much of this stuff already, but blocking by IP is not really the best way (other than being not effective, you could -although unlikely - block some genuine user too). I had a similar problem, and I've just disabled links in the profile and added captcha to registration, but if it's manual spam is not gonna help much. I'd try to make it difficult for a bot, then probably if it's manual spam they'll get sick of manually posting stuff that's going to be deleted before G sees it. –  milo5b Dec 14 '12 at 16:50
add comment

3 Answers 3

1.

They seem to be coming from a DSL connection so after they post the message, if they disconnect from the internet and reconnect again, they will get a different IP

2.

Yes, there's a limit so block only the class you're sure you have spam coming from in order to limit 'false positives'.

Using APNIC's Whois we can see that class 122.179 is broken into:

122.179.0.0 - 122.179.127.255
122.179.128.0 - 122.179.191.255
122.179.192.0 - 122.179.255.255

and class 122.169 is widespread into:

122.169.0.0 - 122.169.7.255
122.169.8.0 - 122.169.11.255
122.169.12.0 - 122.169.13.255
122.169.14.0 - 122.169.14.255
122.169.15.0 - 122.169.15.255
...
122.169.112.0 - 122.169.127.255
122.169.128.0 - 122.169.191.255
122.169.192.0 - 122.169.192.255
...

3.

Since your audience isn't India and the company they are spamming about is in the US, they were probably hired or outsourced for advertising and they took it too far.
You could research all the IP Blocks their providers have and ban each one of them (eg. 'BHARTI TELENET LTD.MUMBAI', 'ABTS AP').

Good luck!

share|improve this answer
add comment

Have you tried to block the range of IP addresses via an .htaccess file?

To block multiple IP addresses, list them one per line.

order allow,deny
deny from 177.0.0.1 
deny from 177.0.0.2
deny from 177.0.0.3
allow from all

You can also block an entire IP block/range.

e.g. – deny from 177.0.0

This will refuse access for any user with an address in the 177.0.0.0 to 177.0.0.255 range.

share|improve this answer
add comment

My suggestion since I recently dealt with a similar problem on a forum of mine is to change registration so that a user must be accepted by an admin before they become a member of the forum.

share|improve this answer
    
This is a good idea but obviously thwarts legit users too. Therefore, I suggest detecting the country the user comes from and if the country is India, China, etc. then require admin approval before their first post is approved. Another option is to put a slightly more rigorous sign up/registration for users that hail from other countries or have suspicious IP addresses. –  mikey_w Mar 26 '13 at 19:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.