11

I've noticed more spam-type questions (and absurd profanity) here lately on Super User (this may be normal though I'm kind of new still), but I was curious if there is any type of public IP address blocking (for X number of days, etc.) for these confirmed offenders when they are identified and verified as spam and deleted for this reason?

I wasn't sure if anyone knew if this was a strategy used (or potentially could be considered in the future) as a deterrent or at least to make it a little harder for the same public IP address to keep registering for new accounts (or whatever tactic they use to gain access to keep posting more spam) if the same public IP address was recently recorded from an account that was blocked, deleted, etc.

I do realize that blocking a public IP address could potentially block all access and not just login or account creation functionality so depending on how all that works behind the scenes, doing it this way could be a problem for a website that's intended to be accessible by anyone worldwide.

7
  • meta.stackexchange.com/questions/273403/… is worth a read. I'll need to do a little more research. That said, just keep on flagging, and the system should deal with it
    – Journeyman Geek Mod
    Commented Jan 23, 2016 at 7:16
  • 2
    A spammer on even a basic residential connection can change their public address every 30 seconds or so without much effort, IP is a pretty poor flag to use.
    – Linef4ult
    Commented Jan 25, 2016 at 14:43
  • @Linef4ult I assume you're referring to web proxy or VPN proxy for web browsing or perhaps Tor. In any case, it's always worked rather well in my environments for SSH FTP brute force attacks and SMTP type spam. I know some web proxies and/or Tor can have all their address ranges blocked too as some IRC rooms don't allow Tor network connection nor some web proxy accesses. I'm more in a business environment than a web site for everyone's access so we basically block everything and open up only what's needed;if there's an attempted attack, BLOCKED and ISP IP owner notified with applicable detail.
    – Vomit IT - Chunky Mess Style
    Commented Jan 25, 2016 at 16:16
  • Meaning business environment where having a web site for everyone to access isn't real important rather... I know SE and it's communities are a business as well, so that's what I mean by that statement.
    – Vomit IT - Chunky Mess Style
    Commented Jan 25, 2016 at 16:17
  • 1
    @1Fish_2Fish_RedFish_BlueFish I was actually referring to their ISP assigned address. For cable users a MAC spoof and re-auth pulls a new IP from the pool, for others using RADIUS they can just execute a PPPoE reset.
    – Linef4ult
    Commented Jan 25, 2016 at 16:18
  • @Linef4ult Interesting... I'll read up on that for sure as soon as I get a moment; the ISP level stuff in somewhat out of my realm of knowledge. Sounds like a flaw from the ISP side in how that works but in my environment, the ISP would hear from me to correct this on their side (especially if multiple IP's they own are doing the spam or attacks) to ensure the suspected malicious attacker, spammer, etc. is blocked from further attempts. When they are in the US at least that strategy works well for the most part; otherwise, I block the entire range from the ISP if it continues.Thanks, good info
    – Vomit IT - Chunky Mess Style
    Commented Jan 25, 2016 at 16:24
  • The spamming of this site gets enormous: during my review, first I identified four questions as SPAM, then four answers, then I got an A.I. generated review as a review test, followed again by two SPAM answers. Please increase the effort, trying to hold off the SPAM.
    – Dominique
    Commented Jul 31, 2023 at 8:32

1 Answer 1

Reset to default
18

The exact implementation details are a bit of a black box, even for us mods. I'd note though, even on a busy day, there's maybe a few dozen spam flags, which is less spam than my blog gets sometimes!

Here's what I can tell you – we mods don't know the exact details of how the spam implementation works, but I can say that the last time someone showed us the results... very little actual spam gets through. What you're seeing is the very tip of the iceberg.

Some IP addresses are placed in a sort of temporary block, but I have no clue how long it's for.

That said, keep flagging stuff like that. It trains the pigeons filters and lets us mods know what is going on. It also adds IP addresses to the block list.

I'd note that, without going into specifics, spammers do seem to try to work around IP address blocks, and a permanent block wouldn't really be that effective. Blocking content is probably more effective.

1
  • 1
    (no pigeons were harmed during the implementation of said filters 🕊️)
    – Caeleste
    Commented Jul 23, 2023 at 16:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .