What, if anything, can anyone tell me about IP 92.48.203.116
 

What, if anything, can anyone tell me about IP 92.48.203.116

Something is very wrong with the activity at our site from this particular IP address. I can't quite describe it but something isn't right.

Have a look at this website.....Stop Forum spam
http://www.stopforumspam.com/search?q=92.48.203.116

It's definately a spammer.

Ok, thank you Allnick.

What do I do.

They got into one of our member's user accounts. They logged in as the member somehow.

ACP > vBulletin Options > User Banning Options > Add the Ip address > Save
That's all I can suggest.

They're out of the Netherlands. Somebody is mirroring or or doing what ever those people do.

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL

ReferralServer: whois://whois.ripe.net:43

NetRange: 92.0.0.0 - 92.255.255.255
CIDR: 92.0.0.0/8
NetName: 92-RIPE
NetHandle: NET-92-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: SUNIC.SUNET.SE
NameServer: NS3.NIC.FR
NameServer: NS-EXT.ISC.ORG
NameServer: NS.LACNIC.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate: 2007-03-27
Updated: 2007-04-03

# ARIN WHOIS database, last updated 2009-01-07 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

--------------- Added [DATE]1231460406[/DATE] at [TIME]1231460406[/TIME] ---------------

I've done a little bit of reading. What about blocking them at the root?

If you just insert 92.
i.e. the first two digits of the IP address(followed by .) into "User BanningOoptions" from ACP, that will block all IP addresses beginning with 92

Ok, I did as you instructed but I did it this way, 92.48.203.116*
We're a North American site, there is no reason to worry about making a mistake on any other similar IP's.

Now comes the big bad question. How do I find out exactly what this IP address was doing?

--------------- Added [DATE]1231460839[/DATE] at [TIME]1231460839[/TIME] ---------------

Sorry, posting when you were posting.

Works for me. As I said, we're a North American site and all of our members are either Canadian or American.

Thank you Allnick for a temporary quick fix so I can figure out where to go from here. Much appreciated.

Sorry I can't help further....I'm still learning too.:)

Best of luck.

Thank you.

You were here to help me real quick when I needed it so I'm most appreciative.

Your Whois information is wrong. RIPE is the European Regional Internet Registry. Here is the correct Whois.
So you'd get rid of this spammer by adding the exact IP(92.48.203.116) to your IP banned list or if you want to block all IP's from the spammers ISP, then you should add 92.48.203. to your IP ban list.

Theres no way to be certain what exactly they were doing on your site unless you have some sort of tracking script.

Thank you Alfa1 and Bellardia.

What happens if instead of banning 92.48.203., I go in and ban 92.48.?
Presumably that broadens the ban exponentially?

You could end up banning entire ISP's, or just massive amounts of people.
using one wild card should be enough to keep them away from you.

just do email verification on registration and human verification and they will increase ur verified members lol also u can ban certain email address they r registering with n ban them like @yahoo.com common n hotmail.com but this will bann everyone else too from using those emails. other then that i suggest u install anti bots or rbl proxy checking. though that will block dial up and some dsl users

If you notice spam coming from a certain country often, you can use this site and generate a list of country specific IP addresses to block for your htaccess http://blockacountry.com

Depending of the type of forum you have, you may not desire traffic from specific countries, specifically those that generate alot of spam.

Of course it broadens the ban. :) You ban all IPs in the range of 92.48.0.0 to 92.48.255.255 (92.48.0.0/16 in CIDR notation).

I use the guest tracking Mod and Is Bot Registration Mod, That stops all Spammers in their Track as well as Keeping me upto date with whats happening

https://vborg.vbsupport.ru/external/2009/01/60.png

What do you all think about blocking anonymous proxies?

What are the best sites to check out IP addresses that don't seem to be kosher?

What are your thoughts on this-
http://www.hybrid6.com/webgeek/2007/...sing-as-ie.php