10

I've noticed more spam-type questions (and absurd profanity) here lately on Super User (this may be normal though I'm kind of new still), but I was curious if there is any type of public IP address blocking (for X number of days, etc.) for these confirmed offenders when they are identified and verified as spam and deleted for this reason?

I wasn't sure if anyone knew if this was a strategy used (or potentially could be considered in the future) as a deterrent or at least to make it a little harder for the same public IP address to keep registering for new accounts (or whatever tactic they use to gain access to keep posting more spam) if the same public IP address was recently recorded from an account that was blocked, deleted, etc.

I do realize that blocking a public IP address could potentially block all access and not just login or account creation functionality so depending on how all that works behind the scenes, doing it this way could be a problem for a website that's intended to be accessible by anyone worldwide.

  • meta.stackexchange.com/questions/273403/… is worth a read. I'll need to do a little more research. That said, just keep on flagging, and the system should deal with it – Journeyman Geek Jan 23 '16 at 7:16
  • 2
    A spammer on even a basic residential connection can change their public address every 30 seconds or so without much effort, IP is a pretty poor flag to use. – Linef4ult Jan 25 '16 at 14:43
  • @Linef4ult I assume you're referring to web proxy or VPN proxy for web browsing or perhaps Tor. In any case, it's always worked rather well in my environments for SSH FTP brute force attacks and SMTP type spam. I know some web proxies and/or Tor can have all their address ranges blocked too as some IRC rooms don't allow Tor network connection nor some web proxy accesses. I'm more in a business environment than a web site for everyone's access so we basically block everything and open up only what's needed;if there's an attempted attack, BLOCKED and ISP IP owner notified with applicable detail. – Pimp Juice IT Jan 25 '16 at 16:16
  • Meaning business environment where having a web site for everyone to access isn't real important rather... I know SE and it's communities are a business as well, so that's what I mean by that statement. – Pimp Juice IT Jan 25 '16 at 16:17
  • 1
    @1Fish_2Fish_RedFish_BlueFish I was actually referring to their ISP assigned address. For cable users a MAC spoof and re-auth pulls a new IP from the pool, for others using RADIUS they can just execute a PPPoE reset. – Linef4ult Jan 25 '16 at 16:18
  • @Linef4ult Interesting... I'll read up on that for sure as soon as I get a moment; the ISP level stuff in somewhat out of my realm of knowledge. Sounds like a flaw from the ISP side in how that works but in my environment, the ISP would hear from me to correct this on their side (especially if multiple IP's they own are doing the spam or attacks) to ensure the suspected malicious attacker, spammer, etc. is blocked from further attempts. When they are in the US at least that strategy works well for the most part; otherwise, I block the entire range from the ISP if it continues.Thanks, good info – Pimp Juice IT Jan 25 '16 at 16:24
  • Did it ever occur to you that someone using a malicious server would be able to either have a bot-net of infected—or simple slave machines—they can fall back on if an IP is blocked? Or past that, anyone using a basic VPN might get a different IP address on each connection. If not they could even force-request a new IP. That said, IP address bans are only good on a temporary basis. It’s why basic tools like Fail2Ban will de-ban someone after a set period of time. – JakeGould Jan 29 '16 at 7:06
  • @JakeGould Yes, those methods occurred to me for sure... 1.) bot-net slaves: just keep blocking them, 2.) VPN IP addresses: block them too, 3.) new forced IP from ISP router via DHCP assignment, yep, keep blocking if you do something malicious regardless. 4. Only Temp IP Bans: I agree here too for a website and applicable access for sure too... Any deterrent to slow down just a little to make them take some action to get in otherwise is better than sitting there cranking them in from the same one location time after time within a certain period of time. I understand and agree!! – Pimp Juice IT Jan 29 '16 at 7:16
13

The exact implementation details are a bit of a black box, even for us mods. I'd note though, even on a busy day, there's maybe a few dozen spam flags, which is less spam than my blog gets sometimes!

Here's what I can tell you – we mods don't know the exact details of how the spam implementation works, but I can say that the last time someone showed us the results... very little actual spam gets through. What you're seeing is the very tip of the iceberg.

Some IP addresses are placed in a sort of temporary block, but I have no clue how long it's for.

That said, keep flagging stuff like that. It trains the pigeons filters and lets us mods know what is going on. It also adds IP addresses to the block list.

I'd note that, without going into specifics, spammers do seem to try to work around IP address blocks, and a permanent block wouldn't really be that effective. Blocking content is probably more effective.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .