Pest members

[jagtpf]

What do you all do with members who refuse to remain banned. They're savvy enough to know how to obtain cloned IP addresses and emails are largely free.

We have "miserable users" mod on board, but one gentleman stays below the parapet for weeks as a seemingly attentive member doing all the 'right' things and then suddenly begins causing havoc....

In one of his guises he used at least 30+ IP addresses - no doubt some could be legit - especially if he likes coffee with his wi-fi

[final kaoss]

Are you using a proxy killer? Might help in this case.

[jagtpf]

Originally Posted by final kaoss

Are you using a proxy killer? Might help in this case.

No we're not - I'll look into that.

Thank you.

[Dave]

Every time I see a new proxy registration, I always block the whole host (all IP ranges that belong to that host) and block the email domain in case it's a spam/temporary domain. Currently have a nice list of nearly 80 million blocked IP addresses from hosts which provide hosting/VPN services and such.
I don't care about traffic from such hosts, I only need legitimate traffic from users with home connection ISP's and the search engine bots.

[jagtpf]

Originally Posted by Dave

Every time I see a new proxy registration, I always block the whole host (all IP ranges that belong to that host) and block the email domain in case it's a spam/temporary domain. Currently have a nice list of nearly 80 million blocked IP addresses from hosts which provide hosting/VPN services and such.
I don't care about traffic from such hosts, I only need legitimate traffic from users with home connection ISP's and the search engine bots.

Thanks Dave, but how do you identify the proxy registration in the first instance without affecting otherwise legitimate members, say those at work where their company uses proxies. What proxy trapper would you recommend.

Geoff

[Dave]

I don't really make use of a proxy trapper, I do it all manually.

I do it like this:
1. Whenver I see a suspicious registration, I enter the IP here: https://ipinfo.io/ and check to which ISP it belongs.
2. I Google the ISP and lookup the main site and see what kind of services they provide.
3. If they provide hosting services, not for home connections, I usually block the whole thing using a custom script I wrote to generate all IP ranges that have to be blocked.
4. After I generated all the IP ranges that have to be blocked, I apply it to a tool called Peerblock (for Windows). Of course it can be applied to iptables on Linux as well.

This will not work if you use something such as Cloudflare though.

[Paul M]

I just ban them again when we come across them, no message, no fuss.

They eventually get bored of constant re-regeristing, its a lot of work for them, a single click for me.

[jagtpf]

Originally Posted by Dave

I don't really make use of a proxy trapper, I do it all manually.

I do it like this:
1. Whenver I see a suspicious registration, I enter the IP here: https://ipinfo.io/ and check to which ISP it belongs.
2. I Google the ISP and lookup the main site and see what kind of services they provide.
3. If they provide hosting services, not for home connections, I usually block the whole thing using a custom script I wrote to generate all IP ranges that have to be blocked.
4. After I generated all the IP ranges that have to be blocked, I apply it to a tool called Peerblock (for Windows). Of course it can be applied to iptables on Linux as well.

This will not work if you use something such as Cloudflare though.

Aye - we check the IP addresses and every time they come up legit - why I commented about the guy liking his coffee! Some email addresses seem odd and yet he obviously is able to route PMs etc through to his 'correct' address.

Originally Posted by Paul M

I just ban them again when we come across them, no message, no fuss.

They eventually get bored of constant re-regeristing, its a lot of work for them, a single click for me.

We keep doing that - no sign of boredom yet. We even shut the Forum down for a month around Christmas after banning his latest account, and yet he already had another one which he'd been using 'normally' for about 150 posts before he reverted to trouble ....

[Skyrider]

Why not use something like this?

https://vborg.vbsupport.ru/showthread.php?t=125871
https://vborg.vbsupport.ru/showthread.php?t=183268

Be sure to read the latest posts for vB4 compatibility.

[jagtpf]

Originally Posted by Skyrider

Why not use something like this?

https://vborg.vbsupport.ru/showthread.php?t=125871
https://vborg.vbsupport.ru/showthread.php?t=183268

Be sure to read the latest posts for vB4 compatibility.

Because they are both flagged as vB3 versions - nothing to say they were available for vB4. However can they cope with multi-accounts that don't use the same IP or email addresses?