Archive for myfreeforum.org Before posting please check the "stickies" in the support forums.
Please ask questions in real English and not "txt". You will get a better response.
Please do not ask support questions via PMs.
 


       myfreeforum.org Forum Index -> What's new? Announcements!
myff admin

PhpBb2: Country registration bans

You can now set a ban by country code in the admin panel under:

User/ban control.

Note that this form of banning only effects registration and will only work if the IP code is recognised by our geoip location system.
Myles

IANA database - Full list of Country-Codes

The ICANN website refer to that IANA database.
myff admin

Do you think it is working?

I am not sure, technically it seems to be in tests I made, but spammers may use proxies when registering and may beat the process, or maybe there is a bug  
Myles

I don't know because my admins didn't want it implemented, yet appreciate the fact that the option is there to implement    I honestly don't know why they want to wait as we've never had any genuine members from China, yet loads of human spammers from there. I had another spammer from China this week.

I'm nearly finished implementing the modactions portal, so then i'll have time to compile stats of human spammers from China from using the log actions and hopefully get my admins approval then.

Being draconian is the last resort but sometimes the only way, like in my case.

I'm hoping we'll ban CN next week, then if a spammer from China hasn't registered after a week or two i would consider it to be working. Certainly after a month i would be 100% sure because there's no way we've ever gone that long without a human spammer from CN.

Edit: The IP addresses listed for China doesn't cover all the IP ranges because i get spammers from the 59.58.xx.xxx range and those are chinese according to whois, yet are not in the IANA database!
Bravo

Whichever system we come up with to ban nations etc, we would still need to have human backup to supervise the system.  It takes what? 30 seconds? to sort a spammer out.  Yes, they are pains in the backside, but a good moderation team soon gets it sorted.
Myles

Of course, but if banning 2-3 countries cuts the human spamming by 90-95% surely it's worth doing when those countries contribute 0% of genuine members anyway.

It's not down to being too lazy to spend a few seconds banning spammers, the problem is that the forum can't be monitored 24/7, but will come across more professional if human spammers are almost stamped out automatically regardless of the lack of 24/7 monitoring.
myff admin

But as Myles points out, there is practically never a valid registration from China.

Bravo, you know my position on this, it is almost always yours, e.g. a good moderation team beats unreliably techy methods, but in the case I think there is a sound reason for tech.
Myles

myff admin wrote:
Do you think it is working?

I am not sure, technically it seems to be in tests I made, but spammers may use proxies when registering and may beat the process, or maybe there is a bug  


We've banned China and Vietnam today as a last resort so i'll be able to give feedback on this in a month or two.
Myles

This IP address got through >> http://whois.domaintools.com/222.77.248.184
I haven't seen it on any databases for CN so i'll ban the range 222.77.0.0-222.77.255.255 after i go through the 'Register' actions on the 'Logs Actions' to make sure that IP range isn't used by any of our members outside China.

I think what would compliment the banning control would be if the 'Choose sorting method' feature in the 'Logs Actions' included IP addresses, that way an admin can view actions from an IP starting with say 222.77 to see if any genuine members have ever created an action from within that IP range so the admin would know then not to ban the whole IP range.
Bravo

^^^

Why I favour the human approach  

No matter how clever the programmer and how tightly knit the code there will always be exceptions.
Myles

No need to be smug Wink , the system still works for the majority of IP ranges in China, there's only the odd stray ranges because of the lack of standardisation at the outset of the internet. If it prevents 90+% of IP's from China it's working to a high enough standard to implement in my opinion.
Myles

Just to give feedback...

I banned CN and VN on 15th November.
In the first few weeks i was still getting about 1 human spammer per every 1.5 weeks from China which was a big improvement. I banned their inetnum ranges each time a new human spammer registered then i didn't get another human spammer for about another month, which was also from China, then i banned that inetnum range and this seems to have ceased all human spammers since.

So basically i've banned;
CN
VN
219.154.0.0-219.157.255.255
112.0.0.0-112.255.255.255
59.56.0.0-59.61.255.255
222.76.0.0-222.79.255.255
175.0.0.0-175.255.255.255

I haven't had any complaints from members, who login from mainly UK, Ireland, Italy, Eastern Europe, Australia, Central and North America.

Still needs about another month or two of monitoring, but it seems human spammers have been eradicated from China. If their is anymore i'll post the range.
myff admin

With cn,ru,ua,vn on the go I am barring over 100 per hour on the support forum  

Again it highlights that the Country Ban is an icing on the cake extra, the vast majority of attempted spamming on our phpbb3 forums is killed by other measures.
Not seen a "vn" here BTW.

I'll repeat for emphasis over 100 per hour, e.g. typically 2 per minute.

I really feel for people on phpbb3 where we leave things at the mercy of the phpbb3 developers who don't seem to have the handle on spam we do, forum admins should not have to fight spam.

I really don't want to get in the game of "forking" phpbb3 at this stage, but I do wonder if we need to make an exception here, perhaps simply making a central registry of spamming ip addresses and making all systems stop those IP addresses from registration attempts... go a bit nanny state  
myff admin

To conserve database space and speed I have flipped the system so that Country bans are more of a last line of defense.

e.g. if the spammer has failed on other grounds, then reject them on those grounds first. Otherwise logs are just going to grow exponentially.
Bravo

myff admin wrote:
I really don't want to get in the game of "forking" phpbb3 at this stage, but I do wonder if we need to make an exception here, perhaps simply making a central registry of spamming ip addresses and making all systems stop those IP addresses from registration attempts... go a bit nanny state  


I think phpbb3 has been a real let down (always seems to be the third incarnation of everything that goes wrong eh, CoD3, HOI3, phpbb3...) so I do think if you have a rabbit in the hat it would be better all round if you pulled it out.  I think the pro's do outweigh the cons in this case.
myff admin

Sad but true, as you say probably better all round.
Myles

The following IP was blocked:
Code:
5385 Banbycountry -9999   Banbycountry Carolin184 ( ) 196.219.37.201


That IP is from Egypt and it's not in the CN or VN databases, nor within the ranges that i've blocked.

Is it most likely that it was blocked because even though it's from Egypt it was detected as a spambot?

Edit: just asking so i know i'm not inadvertantly blocking humans from Egypt
myff admin

I have seen that glitch as well, it is under investigation.
Myles

The CN and VN databases that i checked were from this site >> http://www.ipaddresslocation.org/ip_ranges/get_ranges.php

Though i know from researching a few months ago that some websites have slight variations in the IP ranges for country codes, so the database that you use might be slightly different to that one that i checked.
myff admin

I think we have seen a 90% reduction in spam
Myles

I find it's great for my forum, looks a lot more professional without human spammers.
Yankale

I am banning by country and it works quite well. Today I got an IP 10.0.0.235 without a county code and it was traced as a private IP from..... IANA  

When searching the IANA datbase there were no entries that matched this IP.

Is it reasonable to ban a range of IPs like: 10.0.*.* ?





myff admin

10.0.0.235 was us during the DOS attack we suffered yesterday.

The forums were temporarily rerouted to provide access.
Yankale

DOS=γερ in Hebrew is a nickname for the ultraorthodox religious people. So I guess you had an attack
initiated by the almighty....

10X
Myles

Probably rerouting or something but just thought i'd report this anyway.

Got first human spammer in about 1.5 months today from IANA

http://whois.domaintools.com/10.0.190.188


myff admin

We still get the odd one, primarily from the US, something like one or two a week, hardly enough to keep track of.
Yankale

Since March 6 I had about 40   attempts, but only one got through: from Canada. CA was banned too.
Myles

Grand, i'll just ban 10.0.0.0-10.255.255.255
Myles

Yankale wrote:
Since March 6 I had about 40   attempts, but only one got through: from Canada. CA was banned too.


I haven't got any human spammers from Canada yet but i wouldn't ban a whole country just for one human spammer. I've banned China and Vietnam because i get a lot of human spammers from them countries and no genuine posters, and the IANA range because it doesn't belong to any country anyway. If there's even one genuine poster from a country i'd never ban it but rather do the moderating instead.
editor

Myles wrote:
Grand, i'll just ban 10.0.0.0-10.255.255.255


That would be a really bad idea, as that is a private range of addresses used internally.
Myles

Ok, in the process of unbanning that range then.
Yankale

Myles wrote:
I haven't got any human spammers from Canada yet but i wouldn't ban a whole country just for one human spammer. I've banned China and Vietnam because i get a lot of human spammers from them countries and no genuine posters, and the IANA range because it doesn't belong to any country anyway. If there's even one genuine poster from a country i'd never ban it but rather do the moderating instead.

My forum is in Hebrew so banning Canada, the US or any other country is not a problem for me.
Frankonline

http://holidaychat.myfreeforum.org

I'm having  a problem with a spammer from Poland who repeatedly registers under variations of his name, each time from a different provider. I've deleted about five incarnations over the past couple of days, when this continued I decided to ban Poland using the code PL.  For some reason this has had no effect, he registered today still with an Ip address in Poland.
I wondered whether he was using an anonymous proxy, and I discovered that anonymous proxy has a country code of A1. I entered A1 into the Ban list and this was immediately converted to the Ip adress 78.129.139.242  in the un-ban list. Is this supposed to happen ?
Frankonline

Has this post gone unnoticed or does no one know the answer ?
Bravo

All I can think of it being an old thread mate. Try a new thread and see if it gets a response that way. It's beyond my knowledge, only Admin could be of use to you here I think.
myff admin

tail ending old threads means that no alert is seen that you have posted:

What you are saying does sound like a glitch.

But in general Country and ip bans are not a 100% fix for spammers. Nothing is.
Frankonline

Thank you, he appears to have given up anyway.  

       myfreeforum.org Forum Index -> What's new? Announcements!
Page 1 of 1
Create your own free forum | Buy a domain to use with your forum