6

A forum I run has been the victim of spam user accounts recently - several accounts that have been registered and the profile fill with advertising/links. All of this is for the same company, or group of companies.

I deleted several accounts weeks ago and blocked some IP addresses, but today they have come back with the same spam. Every account has a different IP address, but they are all of the form 122.179.*.* or 122.169.*.*.

I am considering blocking those two IP ranges, but there are potentially thousands of IPs in that range. They appear to be assigned to India (although the spam is for an American company) so given the site is for a western, English-speaking audience maybe it doesn't matter. My questions:

  1. How are they posting on so many IPs?
  2. Is there likely to be a limit to the number of IPs they have access to?
  3. Is there anything else I can do at the IP-level to block them? (I am looking into other measures like blocking usernames/links.)
Improve this question
1
  • 2
    They probably are using proxies. And probably they can access many, and each proxy's IP can change too. I bet you know much of this stuff already, but blocking by IP is not really the best way (other than being not effective, you could -although unlikely - block some genuine user too). I had a similar problem, and I've just disabled links in the profile and added captcha to registration, but if it's manual spam is not gonna help much. I'd try to make it difficult for a bot, then probably if it's manual spam they'll get sick of manually posting stuff that's going to be deleted before G sees it.
    – milo5b
    Commented Dec 14, 2012 at 16:50

6 Answers 6

Reset to default
3

1.

They seem to be coming from a DSL connection so after they post the message, if they disconnect from the internet and reconnect again, they will get a different IP

2.

Yes, there's a limit so block only the class you're sure you have spam coming from in order to limit 'false positives'.

Using APNIC's Whois we can see that class 122.179 is broken into:

122.179.0.0 - 122.179.127.255
122.179.128.0 - 122.179.191.255
122.179.192.0 - 122.179.255.255

and class 122.169 is widespread into:

122.169.0.0 - 122.169.7.255
122.169.8.0 - 122.169.11.255
122.169.12.0 - 122.169.13.255
122.169.14.0 - 122.169.14.255
122.169.15.0 - 122.169.15.255
...
122.169.112.0 - 122.169.127.255
122.169.128.0 - 122.169.191.255
122.169.192.0 - 122.169.192.255
...

3.

Since your audience isn't India and the company they are spamming about is in the US, they were probably hired or outsourced for advertising and they took it too far.
You could research all the IP Blocks their providers have and ban each one of them (eg. 'BHARTI TELENET LTD.MUMBAI', 'ABTS AP').

Good luck!

Improve this answer
2

Have you tried to block the range of IP addresses via an .htaccess file?

To block multiple IP addresses, list them one per line.

order allow,deny
deny from 177.0.0.1 
deny from 177.0.0.2
deny from 177.0.0.3
allow from all

You can also block an entire IP block/range.

e.g. – deny from 177.0.0

This will refuse access for any user with an address in the 177.0.0.0 to 177.0.0.255 range.

Improve this answer
2

The Stop Forum Spam site is a resource to help block forum spammers. Its database can be queried manually or by API by IP address, username, or email address. For Simple Machines Forum (SMF) sites I use a module that queries its database as a means of blocking forum spamers. Modules are also available for many other forum software packages to automatically query its database; you can find a list of other forum software for which modules are available at the Mods & Plugins page on the Stop Forum Spam site.

A search on 122.169 and 122.179 on the Stop Forum Spam search page shows other forums are seeing spammers using IP addresses in those ranges currently.

Improve this answer
1

My suggestion since I recently dealt with a similar problem on a forum of mine is to change registration so that a user must be accepted by an admin before they become a member of the forum.

Improve this answer
1
  • 2
    This is a good idea but obviously thwarts legit users too. Therefore, I suggest detecting the country the user comes from and if the country is India, China, etc. then require admin approval before their first post is approved. Another option is to put a slightly more rigorous sign up/registration for users that hail from other countries or have suspicious IP addresses.
    – mikey_w
    Commented Mar 26, 2013 at 19:36
0

No matter what you try, various devices with various IP's will always try to do malicious things to websites. The term effective here is "script kiddies".

Your best bet is to first check your logs on the server the forum is on. If the website software is apache then look for access_log and error_log files.

In those log files, you'll likely notice several dozen entries involving the exact same IP address trying to connect to a set of URLs.

There are a couple of ways to mostly evade your problem you're having.

  1. Either move the files representing the forum and/or rename them and update the scripts and configuration files accordingly. For example, in a wordpress setup, rename wp-admin.php to worda.php and change all wp-admin.php in all files that are part of wordpress to worda.php. That way, the script kiddie would likely not try to access your script because you used a name thats unusual and probably never documented.

OR.

  1. Configure the forum so that users have to enter a security code to register or even make a post as a guest.

I am against blocking these attacking IP's because they could be IP's of a mix of good (and possibly wanted users) and bad users For example, the IP is connected to a router and to a bunch of computers and one computer is used to do malicious internet acts.

Improve this answer
-1

Using my database:

Both of these IP address ranges are subscriber lines. If you can afford to lose these users, you can block them easily.

122.169.0.0 is:

Bharti Airtel Ltd.

IP Address Range:

122.168.141.0 - 122.169.119.255

NetMask:

Block: 122.168.141.0/0
Base Address: 122.168.141.0
Broadcast Address: 255.255.255.255
Net Mask: 0.0.0.0
Host Mask: 255.255.255.255
Bits: 0
Size: 4294967296
2nd Element: 122.168.141.2
Block by IP Address Block

Apache .htaccess

RewriteCond %{REMOTE_ADDR} ^122\.(1*6*[8-9]*)\.(1*[45678901]*[1-9]*)\.([0-2]*[0-5]*[0-5]*)$ [NC]
RewriteRule .* - [F,L]

Cisco

access-list [your acl name] deny ip 122.168.141.0 255.255.255.255 any
permit ip any any

Nginx

Edit nginx.conf and insert include blockips.conf; if it does not exist. Edit blockips.conf and add the following:

deny 122.168.141.0/0;

IIS

<rule name="abort ip address 122.169.0.0" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_ADDR}" pattern="^122\.168\.141\..*$" />
  </conditions>
 <action type="AbortRequest" />
</rule>

122.179.0.0 is:

Bharti Airtel Ltd.

IP Address Range:

122.176.0.0 - 122.179.156.255

NetMask:

Block: 122.176.0.0/0
Base Address: 122.176.0.0
Broadcast Address: 255.255.255.255
Net Mask: 0.0.0.0
Host Mask: 255.255.255.255
Bits: 0
Size: 4294967296
2nd Element: 122.176.0.2
Block by IP Address Block

Apache .htaccess

RewriteCond %{REMOTE_ADDR} ^122\.(1*7*[6-9]*)\.([0-1]*[0-5]*[0-6]*)\.([0-2]*[0-5]*[0-5]*)$ [NC]
RewriteRule .* - [F,L]

Cisco

access-list [your acl name] deny ip 122.176.0.0 255.255.255.255 any
permit ip any any

Nginx

Edit nginx.conf and insert include blockips.conf; if it does not exist. Edit blockips.conf and add the following:

deny 122.176.0.0/0;

IIS

<rule name="abort ip address 122.179.0.0" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_ADDR}" pattern="^122\.176\..*$" />
  </conditions>
 <action type="AbortRequest" />
</rule>
Improve this answer
5
  • Excessively complicated, which means it'd be prone to failure and misconfiguration.
    – Kzqai
    Commented Mar 12, 2015 at 21:46
  • @Kzqai I am sorry, but I do not find your comment at all helpful. It would have been better to explain how. Are you objecting to the fact that I supplied code for 3 of the major webservers and Cisco firewalls? Or are you saying that one of the code elements in particular is complicated? If so, then how? Most of it is dead simple. I use the .htaccess code for automated security systems (as it appears taken from my systems) without issue for example. I used an IIS example from another user here which appears simple enough.
    – closetnoc
    Commented Mar 12, 2015 at 22:29
  • I'm saying that the regexes & pattern matchers could easily cause more trouble than the spam they block for the apache & IIS examples (the nginx one is pretty straightforward). RewriteCond %{HTTP_HOST} ^122\.(1*7*[6-9]*)\.([0-1]*[0-5]*[0-6]*)\.([0-2]*[0-5]*[0-5]*)$ [NC] RewriteRule .* - [F,L] for instance, if it gets modified in the wrong way or the RewriteRule ending were to get dropped, could cause a lot of trouble for legitimate user, and no-one would ever know of it.
    – Kzqai
    Commented Mar 12, 2015 at 22:41
  • @Kzqai The .htaccess code looks the way it does primarily for two reasons: one, it is an address block which can vary widely; and two, it is the reliable code method I use in automated network defense systems. While there may be more elegant ways of writing this on a one to one basis, this is the most solid and reliable method to date and has operated for many years in the wild without fail. You would be hard pressed to find a more versatile, reliable and clean way of blocking an IP address block. For answers, I use my agents to generate much of the results that I used here.
    – closetnoc
    Commented Mar 12, 2015 at 22:54
  • @Kzqai BTW- my code for single IP addresses are what you would expect. It just gets more complicated for address blocks. I will review my code again somewhere down the line.
    – closetnoc
    Commented Mar 12, 2015 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.