What, if anything, can anyone tell me about IP 92.48.203.116

[FearlessWeeder]

What, if anything, can anyone tell me about IP 92.48.203.116

Something is very wrong with the activity at our site from this particular IP address. I can't quite describe it but something isn't right.

[Allnick]

Have a look at this website.....Stop Forum spam
http://www.stopforumspam.com/search?q=92.48.203.116

It's definately a spammer.

[FearlessWeeder]

Ok, thank you Allnick.

What do I do.

They got into one of our member's user accounts. They logged in as the member somehow.

[Allnick]

ACP > vBulletin Options > User Banning Options > Add the Ip address > Save
That's all I can suggest.

[FearlessWeeder]

They're out of the Netherlands. Somebody is mirroring or or doing what ever those people do.

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL

ReferralServer: whois://whois.ripe.net:43

NetRange: 92.0.0.0 - 92.255.255.255
CIDR: 92.0.0.0/8
NetName: 92-RIPE
NetHandle: NET-92-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: SUNIC.SUNET.SE
NameServer: NS3.NIC.FR
NameServer: NS-EXT.ISC.ORG
NameServer: NS.LACNIC.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate: 2007-03-27
Updated: 2007-04-03

# ARIN WHOIS database, last updated 2009-01-07 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

--------------- Added [DATE]1231460406[/DATE] at [TIME]1231460406[/TIME] ---------------

I've done a little bit of reading. What about blocking them at the root?

[Allnick]

If you just insert 92.
i.e. the first two digits of the IP address(followed by .) into "User BanningOoptions" from ACP, that will block all IP addresses beginning with 92

[FearlessWeeder]

Ok, I did as you instructed but I did it this way, 92.48.203.116*
We're a North American site, there is no reason to worry about making a mistake on any other similar IP's.

Now comes the big bad question. How do I find out exactly what this IP address was doing?

--------------- Added [DATE]1231460839[/DATE] at [TIME]1231460839[/TIME] ---------------

Sorry, posting when you were posting.

If you just insert 92.
i.e. the first two digits of the IP address into "User BanningOoptions" from ACP, that will block all IP addresses beginning with 92

Works for me. As I said, we're a North American site and all of our members are either Canadian or American.

Thank you Allnick for a temporary quick fix so I can figure out where to go from here. Much appreciated.

[Allnick]

Sorry I can't help further....I'm still learning too.

Best of luck.

[FearlessWeeder]

Thank you.

You were here to help me real quick when I needed it so I'm most appreciative.

[Alfa1]

Your Whois information is wrong. RIPE is the European Regional Internet Registry. Here is the correct Whois.
So you'd get rid of this spammer by adding the exact IP(92.48.203.116) to your IP banned list or if you want to block all IP's from the spammers ISP, then you should add 92.48.203. to your IP ban list.