Spam bots defeat Recaptcha.

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Glathannus
    New Member
    • Mar 2007
    • 25
    • 3.6.x

    95% of the spammer usernames/emails that people here have mentioned so far, I too have come across. I noticed in late May that the birth date was the most common factor, but I have a feeling that the more we talk about it, or the sooner we come up with an automated solution based on the birth date...

    the sooner the spambots will either stop using that birthdate, or start using random birth dates. We should assume the worst - that we can't count on this birth date red flag, for forever.

    Nearly every time a new spambot (or a revisit of an old spambot) appears on my site, I've manually ISP blocked it, which involves a WHOIS to find the complete IP range.

    I have to be very careful when I do this, because although my site is English language, it attracts legitimate users from all over the world - including a few from China. So every time I ISP block another Chinese range, I always check it against the very few legitimate Chinese members my site already has. This tactic will eventually stop another legitimate Chinese user from joining my site, but the spam is so out-of-hand right now, that I'm considering this to be a small price to pay. I don't feel comfortable with ISP blocking as a longterm solution though.

    I'm probably going to introduce a subforum for New Member Introductions. When you confirm your email address for registration, you're shifted into a phase-one custom usergroup that can only post, in the manner of starting new thread(s) in New Member Introductions. Until you've done this, you can't start threads in any other subforums, or reply to any threads other than your own. After that, if you have at least one post, eventually you get auto-promoted, and can post/reply in any subforum. However, that promotion could come real quick, so to make sure it's always at least an hour, you introduce another intermediary custom usergroup, whose sole purpose is to exist one hour before the promotions CRON triggers again.

    Once a spammer starts posting, they'll do it in waves. They aren't going to sit around and wait 1-2 hours until they can post in other subforums, and that's if they're not banned by then. What I like about the New Member Introductions idea, is that all of the spam will originate in one place, and you can safely appoint a legion of moderators solely for that board, with custom permissions so they can only move posts, and you have a trash/spam subforum that's not public, as evidence for a higher-up staff member to eventually issue a banning.

    I can understand why some vB owners here would want to block their Member Lists, because a little-talked-about problem right now, is spam across Private Messages. Though I don't know how much good it does to block the Member List, because a smart spambot could build its own index of usernames, by brute forcing all of the User ID numbers. I'm thinking of reserving the Private Messaging privilege for users who have already posted at least 10 times, and same with being able to view the Member List or any individual User Profile. That ought to solve some problems.

    Now, I'm not deeply knowledgeable about the repercussions with robots.txt, so for anyone who is more familiar with how it works, will spambots being able to access robots.txt, in any way foil any of my ideas here?

    Comment

    • ESPALPSP
      New Member
      • May 2008
      • 1
      • 3.7.x

      KaiyureGirl
      [email protected]
      222.187.239.10

      New bot

      Comment

      • Glathannus
        New Member
        • Mar 2007
        • 25
        • 3.6.x

        Here is my own personal blacklist so far (could be a lot more if I hadn't recently set up some ISP blockings):

        Username: lola1234
        Email: [email protected]
        IP: 82.128.8.78
        Join Date: January 10th, 2008
        Birthday: Unspecified
        Timezone: (GMT -8:00) Pacific Time (US & Canada)
        Receive Admin Emails: Yes

        Username: eaterrell37204
        Email: [email protected]
        IP: 89.111.164.162
        Join Date: March 27th, 2008
        Birthday: April 18th, 1973
        Timezone: (GMT) Western Europe Time, London, Lisbon, Casablanca
        Receive Admin Emails: No

        Username: michael001
        Email: [email protected]
        IP: 72.3.137.82
        Join Date: April 16th, 2008
        Birthday: Unspecified
        Receive Admin Emails: Yes

        Username: banthony551
        Email: [email protected]
        IP: 195.209.36.65
        Join Date: April 20th, 2008
        Birthday: April 18th, 1973
        Timezone: (GMT) Western Europe Time, London, Lisbon, Casablanca
        Receive Admin Emails: No

        Username: Jessie
        Email: [email protected]
        IP: 128.241.105.0
        Join Date: May 2nd, 2008
        Birthday: Unspecified
        Timezone: (GMT -8:00) Pacific Time (US & Canada)
        Receive Admin Emails: No
        Notes: Spammed across PMs about a Buddhism portal site

        Username: kwhurley160
        Email: [email protected]
        IP: 89.111.165.167
        Join Date: May 5th, 2008
        Birthday: April 18th, 1973
        Timezone: (GMT) Western Europe Time, London, Lisbon, Casablanca
        Receive Admin Emails: No

        Username: KaiyureBoy
        Email: [email protected]
        IP: 121.234.237.74
        Join Date: May 17th, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: beijmanli
        Email: [email protected]
        IP: 58.17.147.112
        Join Date: May 20th, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: klmn857
        Email: [email protected]
        IP: 59.173.226.84
        Join Date: May 20th, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: lovebeijgo
        Email: [email protected]
        IP: 222.183.122.18
        Join Date: May 20th, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: dreamath
        Email: [email protected]
        IP: 116.234.10.169
        Join Date: May 20th, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: goleveling
        Email: [email protected]
        IP: 61.191.23.238
        Join Date: May 21st, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: 080522jk
        Email: [email protected]
        IP: 218.240.13.108
        Join Date: May 23, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: kevin7901
        Email: [email protected]
        IP: 58.37.254.100
        Join Date: May 25th, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: lrdldu
        Email: [email protected]
        IP: 221.201.98.74
        Join Date: May 25th, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: joshnjob
        Email: [email protected]
        IP: 122.194.25.131
        Join Date: May 25th, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: loveumaryii
        Email: [email protected]
        IP: 222.183.121.201
        Join Date: May 26th, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: Isabella219
        Email: [email protected]
        IP: 222.92.140.249
        Join Date: May 26th, 2008
        Birthday: Unspecified
        Timezone: (GMT -8:00) Pacific Time (US & Canada)
        Receive Admin Emails: Yes
        Notes: They used the Contact Administrator form, after they were banned. It was an admittance that what they would post if I unbanned them now, would have the same problem as before - "free iPods" are not what my community is about.

        Username: KevinFlys
        Email: [email protected]
        IP: 220.178.42.42
        Join Date: May 30th, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: ultimatewarrior8888
        Email: [email protected]
        IP: 220.249.163.229
        Join Date: June 2nd, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: usagirl19735
        Email: [email protected]
        IP: 61.174.135.63
        Join Date: June 2nd, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: weiwei
        Email: [email protected]
        IP: 221.221.173.160
        Join Date: June 2nd, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Username: KaiyureGirl
        Email: [email protected]
        IP: 117.95.220.225
        Join Date: June 7, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No
        Notes: Registered while I was in the middle of previewing this post.

        Username: gprunescaper2
        Email: [email protected]
        IP: 218.106.154.107
        Join Date: June 15, 2008
        Birthday: January 1, 1980
        Timezone: (GMT +8:00) Beijing, Perth, Singapore, Hong Kong
        Receive Admin Emails: No

        Some Chinese/Russian spammers are going to slip through the cracks I've left open, because I've limited some of the ISP blocking for a few of my legitimate users, and a minority of the spammers may fall within that range.
        Last edited by Glathannus; Sun 15 Jun '08, 2:16pm.

        Comment

        • Profaders
          Member
          • Nov 2005
          • 71
          • 3.6.x

          Beijboy/girl et al

          We've had the same as described in this thread.

          Running 3.6.8. with True Type font etc etc etc... I did raise the point in another thread a while back that spammers are getting around True Type Font Captcha in Vb.

          I delete the spammer just as soon as it appears, often within a few hours (our email notifications are often date stamped around 3am UK time).
          Again, we just keep blacklisting the ISP (and its wildcard string).

          We've had the whole range of Beijboy from 1-5 and other such like. Clearly, using the username vbulletingirl/boy he appears to like vb forums - we've had those too. Thankfully, the spammer only managed to post on one occasion - they seem to like placing advertising links spread across the forum. Ours was for some pc game. I am of the belief this is a wannabe spammer - probably contracted by some US spammer.

          Yes, there is a pattern: the birthday remains the same (01 Jan 1980) as does the time zone: hong kong, singapore etc. In my experience the spambot registers, and then comes back a couple of days later to post the links.

          I think the following link is the real Beijboy from a couple of years back, username: Beijboy - a student! Are we surprised? Perhaps someone could reply to him to be his friend!



          The outcome of this is that Gmail along with the most frequently used ISPs have been blacklisted. Unfortunate, as we too see some user-traffic from China. But we can do without this. I simply put a notice below the email entry in the registration form (confirm email string) that users wishing to register using a gmail address should contact us first. A hassle, but much better than spam littering your forum.

          On some other non-forum websites I operate, I am also seeing an increase in gmail spam. It's coming from China, Vietnam and South Korea. Google have still not addressed their security issues and spammers are getting hold of email accounts far too easily. Gmail has been banned on all my other sites.

          Comment

          • Wayne Luke
            vBulletin Technical Support Lead
            • Aug 2000
            • 73981

            Originally posted by Profaders
            Google have still not addressed their security issues and spammers are getting hold of email accounts far too easily. Gmail has been banned on all my other sites.
            Free email is free email. I doubt Google does any checking on signups on their system or the emails that are sent out until someone complains about a particular account. Just not enough man-power in the world for that kind of moderation.

            I have a GMail account and it gets about 1000 spam emails a day from Chinese accounts. One of the reasons I don't like the service.
            Translations provided by Google.

            Wayne Luke
            The Rabid Badger - a vBulletin Cloud demonstration site.
            vBulletin 5 API

            Comment

            • Profaders
              Member
              • Nov 2005
              • 71
              • 3.6.x

              Thanks Wayne.

              And that's why Gmail will remained blacklisted on our site, and every other site I operate.

              Life was so much better with Compuserve in the early days - if not a tad expensive!

              Comment

              • setishock
                Senior Member
                • Jun 2005
                • 1334
                • 4.2.x

                Tcrubuyggo
                [email protected]
                222.183.121.125
                China
                Jan 1, 1980
                ...

                Comment

                • mikesz
                  Member
                  • Sep 2006
                  • 91

                  I still get a LOT of badguys using yahoo.com so its not just a gmail issue but then again I get a lot of .ru, .qawab, .info and sina. Beijboy uses sina email addresses as frequently as he does he does gmail, fyi. Many of the post in this thread act like the whole concept of "Asian Market" doesn't exist any maybe it doesn't if your are running a custom home entertainment site in St Joseph, MO but the reality is quite different. I have multiple sites that target the Asian Market so banning blocks of Asian IP address, Chinese or otherwise is not really an option. I still think that a dedicated effort by Jelsoft to find out how this particular group of badguys seem to be able to completely bypass the human verification process that doesn't see to work or is simply being hijacked by their robot code.

                  regards, mikesz
                  Last edited by mikesz; Mon 9 Jun '08, 1:29am.

                  Comment

                  • Eagle Creek
                    Senior Member
                    • Apr 2003
                    • 1206
                    • 3.6.x

                    I got a lot of gmail spammers also.. I never had those guys and now they seem to pup up every day.

                    I use a system of Captcha and questions like 1+1=, they still manage to get through.
                    And like I've said: mostly gmail, since they beat gmail and hotmail it's amazing how many accounts are being abused.
                    http://www.nucia.nl/forum/
                    The best way to kill malware; is to kill it together.

                    Comment

                    • haddockman
                      New Member
                      • Nov 2006
                      • 2

                      Does anyone have a list of Chinese Ips that can be banned?

                      Comment

                      • Glathannus
                        New Member
                        • Mar 2007
                        • 25
                        • 3.6.x

                        My blocklist currently looks like this:
                        [a few non Chinese/Russian IPs are deliberately here, but they're a minority]

                        58.17.128.
                        58.17.129.
                        58.17.130.
                        58.17.131.
                        58.17.132.
                        58.17.133.
                        58.17.134.
                        58.17.135.
                        58.17.136.
                        58.17.137.
                        58.17.138.
                        58.17.139.
                        58.17.140.
                        58.17.141.
                        58.17.142.
                        58.17.143.
                        58.17.144.
                        58.17.145.
                        58.17.146.
                        58.17.147.
                        58.17.148.
                        58.17.149.
                        58.17.150.
                        58.17.151.
                        58.17.152.
                        58.17.153.
                        58.17.154.
                        58.17.155.
                        58.17.156.
                        58.17.157.
                        58.17.158.
                        58.17.159.
                        58.17.160.
                        58.17.161.
                        58.17.162.
                        58.17.163.
                        58.17.164.
                        58.17.165.
                        58.17.166.
                        58.17.167.
                        58.17.168.
                        58.17.169.
                        58.17.170.
                        58.17.171.
                        58.17.172.
                        58.17.173.
                        58.17.174.
                        58.17.175.
                        58.17.176.
                        58.17.177.
                        58.17.178.
                        58.17.179.
                        58.17.180.
                        58.17.181.
                        58.17.182.
                        58.17.183.
                        58.17.184.
                        58.17.185.
                        58.17.186.
                        58.17.187.
                        58.17.188.
                        58.17.189.
                        58.17.190.
                        58.17.191.
                        58.17.192.
                        58.17.193.
                        58.17.194.
                        58.17.195.
                        58.17.196.
                        58.17.197.
                        58.17.198.
                        58.17.199.
                        58.17.200.
                        58.17.201.
                        58.17.202.
                        58.17.203.
                        58.17.204.
                        58.17.205.
                        58.17.206.
                        58.17.207.
                        58.17.208.
                        58.17.209.
                        58.17.210.
                        58.17.211.
                        58.17.212.
                        58.17.213.
                        58.17.214.
                        58.17.215.
                        58.17.216.
                        58.17.217.
                        58.17.218.
                        58.17.219.
                        58.17.220.
                        58.17.221.
                        58.17.222.
                        58.17.223.
                        58.17.224.
                        58.17.225.
                        58.17.226.
                        58.17.227.
                        58.17.228.
                        58.17.229.
                        58.17.230.
                        58.17.231.
                        58.17.232.
                        58.17.233.
                        58.17.234.
                        58.17.235.
                        58.17.236.
                        58.17.237.
                        58.17.238.
                        58.17.239.
                        58.17.240.
                        58.17.241.
                        58.17.242.
                        58.17.243.
                        58.17.244.
                        58.17.245.
                        58.17.246.
                        58.17.247.
                        58.17.248.
                        58.17.249.
                        58.17.251.
                        58.17.252.
                        58.17.253.
                        58.17.254.
                        58.17.255.

                        58.34.
                        58.37.

                        58.48.
                        58.49.
                        58.50.
                        58.51.
                        58.52.
                        58.53.
                        58.54.
                        58.55.

                        58.83.32.
                        58.83.33.
                        58.83.34.
                        58.83.35.
                        58.83.36.
                        58.83.37.
                        58.83.38.
                        58.83.39.
                        58.83.40.
                        58.83.41.
                        58.83.42.
                        58.83.43.
                        58.83.44.
                        58.83.45.
                        58.83.46.
                        58.83.47.
                        58.83.48.
                        58.83.49.
                        58.83.50.
                        58.83.51.
                        58.83.52.
                        58.83.53.
                        58.83.54.
                        58.83.55.
                        58.83.56.
                        58.83.57.
                        58.83.58.
                        58.83.59.
                        58.83.61.
                        58.83.62.
                        58.83.63.

                        58.216.235.240
                        58.216.235.241
                        58.216.235.242
                        58.216.235.243
                        58.216.235.244
                        58.216.235.245
                        58.216.235.246
                        58.216.235.247
                        58.216.235.248
                        58.216.235.249
                        58.216.235.250
                        58.216.235.251
                        58.216.235.252
                        58.216.235.253
                        58.216.235.254
                        58.216.235.255

                        58.240.
                        58.241.

                        58.248.
                        58.249.
                        58.250.
                        58.251.
                        58.252.
                        58.253.
                        58.254.
                        58.255.

                        59.56.
                        59.57.
                        59.58.
                        59.59.
                        59.60.
                        59.61.0.
                        59.61.1.
                        59.61.2*
                        59.61.3*
                        59.61.4*
                        59.61.5*
                        59.61.6*
                        59.61.7*
                        59.61.8*
                        59.61.9*
                        59.61.10*
                        59.61.11
                        59.61.12
                        59.61.13
                        59.61.14
                        59.61.15
                        59.61.16
                        59.61.17
                        59.61.18
                        59.61.19

                        59.172.
                        59.173.

                        60.166.
                        60.167.
                        60.168.
                        60.169.
                        60.170.
                        60.171.
                        60.172.
                        60.173.
                        60.174.
                        60.175.

                        61.169.
                        61.170.
                        61.171.

                        61.172.
                        61.173.

                        61.174.128.
                        61.174.129.
                        61.174.130.
                        61.174.131.
                        61.174.132.
                        61.174.133.
                        61.174.134.
                        61.174.135.
                        61.174.136.
                        61.174.137.
                        61.174.138.
                        61.174.139.
                        61.174.140.
                        61.174.141.
                        61.174.142.
                        61.174.143.
                        61.174.144.
                        61.174.145.
                        61.174.146.
                        61.174.147.
                        61.174.148.
                        61.174.149.
                        61.174.150.
                        61.174.151.
                        61.174.152.
                        61.174.153.
                        61.174.154.
                        61.174.155.
                        61.174.156.
                        61.174.157.
                        61.174.158.
                        61.174.159.

                        61.191.

                        66.28.

                        82.128.0.
                        82.128.1.
                        82.128.2.
                        82.128.3.
                        82.128.4.
                        82.128.5.
                        82.128.6.
                        82.128.7.
                        82.128.8.
                        82.128.9.
                        82.128.10.
                        82.128.11.
                        82.128.12.
                        82.128.13.
                        82.128.14.
                        82.128.15.
                        82.128.16.
                        82.128.17.
                        82.128.18.
                        82.128.19.
                        82.128.20.
                        82.128.21.
                        82.128.22.
                        82.128.23.0

                        85.195.123.22
                        85.195.123.23
                        85.195.123.24
                        85.195.123.25
                        85.195.123.26
                        85.195.123.27
                        85.195.123.28
                        85.195.123.29

                        89.111.128.
                        89.111.129.
                        89.111.130.
                        89.111.131.
                        89.111.132.
                        89.111.133.
                        89.111.134.
                        89.111.135.
                        89.111.136.
                        89.111.137.
                        89.111.138.
                        89.111.139.
                        89.111.140.
                        89.111.141.
                        89.111.142.
                        89.111.143.
                        89.111.144.
                        89.111.145.
                        89.111.146.
                        89.111.147.
                        89.111.148.
                        89.111.149.
                        89.111.150.
                        89.111.151.
                        89.111.152.
                        89.111.153.
                        89.111.154.
                        89.111.155.
                        89.111.156.
                        89.111.157.
                        89.111.158.
                        89.111.159.
                        89.111.160.
                        89.111.161.
                        89.111.162.
                        89.111.163.
                        89.111.164.
                        89.111.165.
                        89.111.166.
                        89.111.167.
                        89.111.168.
                        89.111.169.
                        89.111.170.
                        89.111.171.
                        89.111.172.
                        89.111.173.
                        89.111.174.
                        89.111.175.
                        89.111.176.
                        89.111.177.
                        89.111.178.
                        89.111.179.
                        89.111.180.
                        89.111.181.
                        89.111.182.
                        89.111.183.
                        89.111.184.
                        89.111.185.
                        89.111.186.
                        89.111.187.
                        89.111.188.
                        89.111.189.
                        89.111.190.
                        89.111.191.

                        116.224.
                        116.225.
                        116.226.
                        116.227.
                        116.228.
                        116.229.
                        116.230.
                        116.231.
                        116.232.
                        116.233.
                        116.234.
                        116.235.
                        116.236.
                        116.237.
                        116.238.
                        116.239.

                        117.80.
                        117.81.
                        117.82.
                        117.83.
                        117.84.
                        117.85.
                        117.86.
                        117.87.
                        117.88.
                        117.89.
                        117.90.
                        117.91.
                        117.92.
                        117.93.
                        117.94.
                        117.95.

                        121.224.
                        121.225.
                        121.226.
                        121.227.
                        121.228.
                        121.229.
                        121.230.
                        121.231.
                        121.232.
                        121.233.
                        121.234.
                        121.236.
                        121.237.
                        121.238.
                        121.239.

                        122.96.
                        122.97.

                        122.192.
                        122.193.
                        122.194.
                        122.195.

                        125.33.0.
                        125.33.1.
                        125.33.2*
                        125.33.3*
                        125.33.4*
                        125.33.5*
                        125.33.6*
                        125.33.7*
                        125.33.8*
                        125.33.9*
                        125.33.10*
                        125.33.11*
                        125.33.12*
                        125.33.13*
                        125.33.14*
                        125.33.15*
                        125.33.16*
                        125.33.17
                        125.33.18
                        125.33.19

                        125.80.
                        125.81.
                        125.82.
                        125.83.
                        125.84.
                        125.85.
                        125.86.
                        125.87.

                        193.200.150.

                        195.209.32.
                        195.209.33.
                        195.209.34.
                        195.209.35.
                        195.209.36.
                        195.209.37.
                        195.209.38.
                        195.209.39.
                        195.209.40.
                        195.209.41.
                        195.209.42.
                        195.209.43.
                        195.209.44.
                        195.209.45.
                        195.209.46.
                        195.209.47.
                        195.209.48.
                        195.209.49.
                        195.209.50.
                        195.209.51.
                        195.209.52.
                        195.209.53.
                        195.209.54.
                        195.209.55.
                        195.209.56.
                        195.209.57.
                        195.209.58.
                        195.209.59.
                        195.209.60.
                        195.209.61.
                        195.209.62.
                        195.209.63.

                        208.106.152.
                        208.106.153.
                        208.106.154.
                        208.106.155.
                        208.106.156.
                        208.106.157.
                        208.106.158.
                        208.106.159.

                        210.22.64.
                        210.22.65.
                        210.22.66.
                        210.22.67.
                        210.22.68.
                        210.22.69.
                        210.22.7*
                        210.22.8*
                        210.22.9*
                        210.22.101
                        210.22.102
                        210.22.103
                        210.22.104
                        210.22.105
                        210.22.106
                        210.22.107
                        210.22.108
                        210.22.109
                        210.22.110
                        210.22.111
                        210.22.112
                        210.22.113
                        210.22.114
                        210.22.115
                        210.22.116
                        210.22.117
                        210.22.118
                        210.22.119
                        210.22.120
                        210.22.121
                        210.22.122
                        210.22.123
                        210.22.124
                        210.22.125
                        210.22.126
                        210.22.127
                        210.22.128
                        210.22.129
                        210.22.130
                        210.22.131
                        210.22.132
                        210.22.133
                        210.22.134
                        210.22.135
                        210.22.136
                        210.22.137
                        210.22.138
                        210.22.139
                        210.22.140
                        210.22.141
                        210.22.142
                        210.22.143
                        210.22.144
                        210.22.145
                        210.22.146
                        210.22.147
                        210.22.148
                        210.22.149
                        210.22.150
                        210.22.151
                        210.22.152
                        210.22.153
                        210.22.154
                        210.22.155
                        210.22.156
                        210.22.157
                        210.22.158
                        210.22.159
                        210.22.160
                        210.22.161
                        210.22.162
                        210.22.163
                        210.22.164
                        210.22.165
                        210.22.166
                        210.22.167
                        210.22.168
                        210.22.169
                        210.22.170
                        210.22.171
                        210.22.172
                        210.22.173
                        210.22.174
                        210.22.175
                        210.22.176
                        210.22.177
                        210.22.178
                        210.22.179
                        210.22.180
                        210.22.181
                        210.22.182
                        210.22.183
                        210.22.184
                        210.22.185
                        210.22.186
                        210.22.187
                        210.22.188
                        210.22.189
                        210.22.190
                        210.22.191

                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1
                        210.22.1

                        218.56.0
                        218.56.1*
                        218.56.2*
                        218.56.3*
                        218.56.4*
                        218.56.5*
                        218.56.6*
                        218.56.7*
                        218.56.8*
                        218.56.9.
                        218.57.
                        218.58.
                        218.59.

                        218.78.
                        218.79.
                        218.80
                        218.81.
                        218.82.1.
                        218.82.2.
                        218.82.3*
                        218.82.4*
                        218.82.5*
                        218.82.6*
                        218.82.7*
                        218.82.8*
                        218.82.9*
                        218.82.10*
                        218.82.11*
                        218.82.12*
                        218.82.13*
                        218.82.14*
                        218.82.15*
                        218.82.16*
                        218.82.17*
                        218.82.18*
                        218.82.21*
                        218.82.22*
                        218.82.23*
                        218.82.24*
                        218.82.25*
                        218.82.26*
                        218.82.27*
                        218.82.28*
                        218.82.29*
                        218.82.190.
                        218.82.191.
                        218.82.192.
                        218.82.193.
                        218.82.194.
                        218.82.195.
                        218.82.196.
                        218.82.197.
                        218.82.198.
                        218.82.199.
                        218.82.200.
                        218.82.201.
                        218.82.202.
                        218.82.203.
                        218.82.204.
                        218.82.205.
                        218.82.206.
                        218.82.207.
                        218.82.208
                        218.82.209
                        218.83.

                        218.85.1*
                        218.85.2*
                        218.85.3
                        218.85.4*
                        218.85.5*
                        218.85.6*
                        218.85.7*
                        218.85.8*
                        218.85.9*
                        218.85.30
                        218.85.31
                        218.85.32
                        218.85.33
                        218.85.34
                        218.85.35
                        218.85.36
                        218.85.37
                        218.85.38
                        218.85.39
                        218.86.

                        218.104.68.128
                        218.104.68.129
                        218.104.68.130
                        218.104.68.131
                        218.104.68.132
                        218.104.68.133
                        218.104.68.134
                        218.104.68.135
                        218.104.68.136
                        218.104.68.137
                        218.104.68.138
                        218.104.68.139
                        218.104.68.140
                        218.104.68.141
                        218.104.68.142
                        218.104.68.143
                        218.104.68.144
                        218.104.68.145
                        218.104.68.146
                        218.104.68.147
                        218.104.68.148
                        218.104.68.149
                        218.104.68.150
                        218.104.68.151
                        218.104.68.152
                        218.104.68.153
                        218.104.68.154
                        218.104.68.155
                        218.104.68.156
                        218.104.68.157
                        218.104.68.158
                        218.104.68.159
                        218.104.68.160
                        218.104.68.161
                        218.104.68.162
                        218.104.68.163
                        218.104.68.164
                        218.104.68.165
                        218.104.68.166
                        218.104.68.167
                        218.104.68.168
                        218.104.68.169
                        218.104.68.170
                        218.104.68.171
                        218.104.68.172
                        218.104.68.173
                        218.104.68.174
                        218.104.68.175
                        218.104.68.176
                        218.104.68.177
                        218.104.68.178
                        218.104.68.179
                        218.104.68.180
                        218.104.68.181
                        218.104.68.182
                        218.104.68.183
                        218.104.68.184
                        218.104.68.185
                        218.104.68.186
                        218.104.68.187
                        218.104.68.188
                        218.104.68.189
                        218.104.68.190
                        218.104.68.191
                        218.104.68.192
                        218.104.68.193
                        218.104.68.194
                        218.104.68.195
                        218.104.68.196
                        218.104.68.197
                        218.104.68.198
                        218.104.68.199
                        218.104.68.201
                        218.104.68.202
                        218.104.68.203
                        218.104.68.204
                        218.104.68.205
                        218.104.68.206
                        218.104.68.207
                        218.104.68.208
                        218.104.68.209
                        218.104.68.210
                        218.104.68.211
                        218.104.68.212
                        218.104.68.213
                        218.104.68.214
                        218.104.68.215
                        218.104.68.216
                        218.104.68.217
                        218.104.68.218
                        218.104.68.219
                        218.104.68.220
                        218.104.68.221
                        218.104.68.222
                        218.104.68.223
                        218.104.68.224
                        218.104.68.225
                        218.104.68.226
                        218.104.68.227
                        218.104.68.228
                        218.104.68.229
                        218.104.68.230
                        218.104.68.231
                        218.104.68.232
                        218.104.68.233
                        218.104.68.234
                        218.104.68.235
                        218.104.68.236
                        218.104.68.237
                        218.104.68.238
                        218.104.68.239
                        218.104.68.240
                        218.104.68.241
                        218.104.68.242
                        218.104.68.243
                        218.104.68.244
                        218.104.68.245
                        218.104.68.246
                        218.104.68.247
                        218.104.68.248
                        218.104.68.249
                        218.104.68.250
                        218.104.68.251
                        218.104.68.252
                        218.104.68.253
                        218.104.68.254
                        218.104.68.255

                        218.106.90.0
                        218.106.90.1
                        218.106.90.2
                        218.106.90.3*
                        218.106.90.4*
                        218.106.90.5*
                        218.106.90.6*
                        218.106.90.7*
                        218.106.90.8*
                        218.106.90.9*
                        218.106.90.10*
                        218.106.90.11*
                        218.106.90.12
                        218.106.90.13
                        218.106.90.14
                        218.106.90.15
                        218.106.90.16
                        218.106.90.17
                        218.106.90.18
                        218.106.90.19
                        218.106.90.20
                        218.106.90.21
                        218.106.90.22
                        218.106.90.23
                        218.106.90.24
                        218.106.90.25
                        218.106.90.26
                        218.106.90.27
                        218.106.90.28
                        218.106.90.29
                        218.106.90.120
                        218.106.90.121
                        218.106.90.122
                        218.106.90.123
                        218.106.90.124
                        218.106.90.125
                        218.106.90.126
                        218.106.90.127

                        218.240.0.
                        218.240.1.
                        218.240.2.
                        218.240.3*
                        218.240.4*
                        218.240.5*
                        218.240.6*
                        218.240.7.
                        218.240.8.
                        218.240.9.
                        218.240.10.
                        218.240.11.
                        218.240.12.
                        218.240.13.
                        218.240.14.
                        218.240.15.
                        218.240.16.
                        218.240.17.
                        218.240.18.
                        218.240.19.
                        218.240.20.
                        218.240.21.
                        218.240.22.
                        218.240.23.
                        218.240.24.
                        218.240.25.
                        218.240.26.
                        218.240.27.
                        218.240.28.
                        218.240.29.

                        219.140.

                        219.146.240.
                        219.146.241.
                        219.146.242.
                        219.146.243.
                        219.146.244.
                        219.146.245.
                        219.146.246.
                        219.146.247.
                        219.146.248.
                        219.146.249.
                        219.146.250.
                        219.146.251.
                        219.146.252.
                        219.146.253.
                        219.146.254.
                        219.146.255.

                        220.178.
                        220.179.
                        220.180.

                        220.249.160.
                        220.249.161.
                        220.249.162.
                        220.249.163.
                        220.249.164.
                        220.249.165.
                        220.249.166.
                        220.249.167.
                        220.249.168.
                        220.249.169.
                        220.249.170.
                        220.249.171.
                        220.249.172.
                        220.249.173.
                        220.249.174.
                        220.249.175.
                        220.249.176.
                        220.249.177.
                        220.249.178.
                        220.249.179.
                        220.249.180.
                        220.249.181.
                        220.249.182.
                        220.249.183.
                        220.249.184.
                        220.249.185.
                        220.249.186.
                        220.249.187.
                        220.249.188.
                        220.249.189.
                        220.249.190.
                        220.249.191.

                        221.200.
                        221.201.
                        221.202.
                        221.203.

                        221.216.
                        221.217.0.
                        221.217.1*
                        221.217.2.
                        221.217.3*
                        221.217.4*
                        221.217.5*
                        221.217.6*
                        221.217.7*
                        221.217.8*
                        221.217.9*
                        221.217.20*
                        221.217.21*
                        221.217.22.
                        221.217.23.
                        221.217.24.
                        221.217.25.
                        221.217.26.
                        221.217.27.
                        221.217.28.
                        221.217.29.
                        221.218.
                        221.219.
                        221.220.
                        221.221.0.
                        221.221.1*
                        221.221.2.
                        221.221.3*
                        221.221.4*
                        221.221.5*
                        221.221.6*
                        221.221.7*
                        221.221.8*
                        221.221.9*
                        221.221.20*
                        221.221.21*
                        221.221.22*
                        221.221.23*
                        221.221.24.
                        221.221.25.
                        221.221.26.
                        221.221.27.
                        221.221.28.
                        221.221.29.
                        221.222.
                        221.223.0.
                        221.223.1*
                        221.223.2.
                        221.223.3*
                        221.223.4*
                        221.223.5*


                        221.223.6*
                        221.223.7*
                        221.223.8*
                        221.223.9*
                        221.223.20.
                        221.223.21.
                        221.223.22.
                        221.223.23.
                        221.223.24.
                        221.223.25.
                        221.223.26.
                        221.223.27.
                        221.223.28.
                        221.223.29.

                        221.236.
                        221.237.

                        222.66.235.244
                        222.66.235.245
                        222.66.235.246
                        222.66.235.247

                        222.76.
                        222.77.
                        222.78.
                        222.79.0.
                        222.79.1*
                        222.79.2.
                        222.79.3*
                        222.79.4*
                        222.79.5*
                        222.79.6*
                        222.79.7*
                        222.79.8*
                        222.79.9*
                        222.79.20*
                        222.79.21*
                        222.79.22*
                        222.79.23*
                        222.79.24.
                        222.79.25*
                        222.79.26.
                        222.79.27.
                        222.79.28.
                        222.79.29.

                        222.92.
                        222.93.
                        222.94.
                        222.95.

                        222.176.
                        222.177.
                        222.178.
                        222.179.
                        222.180.
                        222.181.
                        222.182.
                        222.183.

                        222.184.
                        222.185.
                        222.186.
                        222.187.
                        222.188.
                        222.189.
                        222.190.0.
                        222.190.1
                        222.190.2*
                        222.190.3*
                        222.190.4*
                        222.190.5*
                        222.190.6*
                        222.190.7*
                        222.190.8*
                        222.190.9*
                        222.190.10*
                        222.191.

                        222.236.0.
                        222.236.1.
                        222.236.2.
                        222.236.3*
                        222.236.4*
                        222.236.5*
                        222.236.6.
                        222.236.7.
                        222.236.8.
                        222.236.9.
                        222.236.10.
                        222.236.11.
                        222.236.12.
                        222.236.13.
                        222.236.14.
                        222.236.15.
                        222.236.16.
                        222.236.17.
                        222.236.18.
                        222.236.19.
                        222.236.20.
                        222.236.21.

                        222.236.22.
                        222.236.23.
                        222.236.24.
                        222.236.25.
                        222.236.26.
                        222.236.27.
                        222.236.28.
                        222.236.29.
                        222.236.60.
                        222.236.61.
                        222.236.62.
                        222.236.63.

                        Rather than banning all of China (and Russia) outright, I've waited until more spambots have shown up, then I blocked whatever new ISP they use, with small holes deliberately left open so my legitimate users can get through. If you don't think you'll ever have legitimate users from China, you can tweak my list a little bit, but don't go overboard on wildcards to 'optimize' it, or else you may not only be blocking ISPs that spammers have never targeted a messageboard with, but the ISPs may not even belong to China or Russia.

                        So far my ISP blocking (as is), has prevented at least three spambot registrations per day, and that seems to be all there is. I've been "Viewing Who's Online" and I know what their User Agent looks like. I've updated my list before some of them (who weren't blocked before) had gone through captcha.

                        Don't be hamfisted with the ISP blocks. Check the prefix numbers against existing users, some of whom you may not already realize are Chinese, and leave holes open where necessary. For example, if

                        221.216.
                        221.217.
                        221.218.
                        221.219.
                        221.220.
                        221.221.
                        221.222.
                        221.223.

                        represents an overall ISP that a spambot has used, and if I have legitimate members with

                        221.217.222.
                        221.217.223.
                        221.217.224.

                        and

                        221.221.244.
                        221.221.245.
                        221.221.246.
                        221.221.247.
                        221.221.248.


                        then my actual list as you know it, has very carefully used wildcards with specific suffixes to allow these two users through.

                        Never forget that a wildcard of 221.221.24*, will block 221.221.24. in addition to 221.221.240. through 221.221.249., or else in other examples you will eventually block some Australians without even knowing it. Don't use it just as a routine convenience tool to avoid typing in more numbers, and don't just automatically ban the first two-to-three numbers everytime a new spammer shows up. Always WHOIS them first, and find out what the whole IP range actually is. Sometimes even a last-suffix ban can be hamfisted, because you'll have a proxy company in the middle of Europe, surrounded by legitimate ISPs.

                        Notice the 82.128.23.0 I have on my list? If I didn't include that zero on the end, I would actually be blocking some users of another ISP, because that zero is literally where this particular company's IP range ends, instead of simply at 82.128.22.255.

                        My list isn't perfect, and more will probably be added to it eventually, but in the meantime I know it's working very well, even with the holes.
                        Last edited by Glathannus; Sat 28 Jun '08, 12:32am.

                        Comment

                        • saggerpance
                          New Member
                          • Nov 2006
                          • 6

                          Originally posted by ESPALPSP
                          KaiyureGirl
                          [email protected]
                          222.187.239.10

                          New bot
                          damnit. I was hoping she was real.

                          Comment

                          • Mike Jordan
                            New Member
                            • Dec 2007
                            • 28
                            • 3.6.x

                            Originally posted by Glathannus
                            My blocklist currently looks like this:
                            [a few non Chinese/Russian IPs are deliberately here, but they're a minority]
                            Have you noticed any performance impact with a list t his long? My list is only about 2 dozen IP's long right now, but China and Russia are big places.

                            I've got a fairly nitch forum and most of my users are going to come from the US, Canada mostly, with some from England and Northern Europe. So I'm not all that concerned about banning the rest of the world. I'm going to put up a message for the very rare IP that gets caught and tell them why it's blocked and to send me e-mail (at a throw-away e-mail address) to let me know.

                            It's too bad you can't have exceptions to a range. That way you could ban a whole sub-net and put a exception for the few that might be valid in that sub-net.

                            Since I went to 3.7.x I've been getting about 6 Chinese, a couple of Russian and one or two odd other countries every night about 10:30 pm Pacific time that I ban the IP groups on. But so far (knock on my lucky 286 chip), nobody has made it through. A lot of Registering but they never actually get registered.

                            Mike

                            Comment

                            • LCPGUY
                              Senior Member
                              • Dec 2004
                              • 129
                              • 3.0.3

                              We too see this problem increasing at an astronomical rate. However we have only been spammed twice since 3.7 came out. That was when we left the bot member in "awaiting email confirmation" status and 2 or 3 days later they came back and spammed.

                              I have now made my Super Moderators "limited" Admins so they can delete members. As soon as we see the "awaiting email confirmation" status, we delete them after 24 hours.

                              We also put some required fields in their profile screen. Funny thing thing is, they fill them all out correctly, except that they are always the same. First name = 1. Location = 1. Birthday = Jan 1, 1980. Gender = alternates between "F" and "M".

                              Captcha and ReCaptcha are USELESS!

                              I also tried the Q & A scenario. Question "twelve * three + 1 = ?" Unbelievably they either get the correct answer, or bypass it completely.

                              Some how, vBulletin must have a "huge" hole in it's whole registration process. What else could it be?

                              This whole situation is just crazy!!!
                              Last edited by LCPGUY; Tue 10 Jun '08, 7:10pm.

                              Comment

                              • Vtec44
                                Senior Member
                                • Jan 2005
                                • 1555
                                • 3.7.x

                                Originally posted by LCPGUY

                                I also tried the Q & A scenario. Question "twelve * three + 1 = ?" Unbelievably they either get the correct answer, or bypass it completely.
                                It could be that a human registered for an account, then pass it to a bot to post.
                                So Cal Sportbike forum - So Cal Moto - Kawasaki Ninja 250R Forum - Custom vinyl decals - Southern California camping forum

                                Comment

                                widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.
                                Working...