Simple Machines Community Forum

SMF Support => SMF 2.0.x Support => Topic started by: njtweb on December 01, 2020, 07:13:04 PM

Title: Same IP 2 diff locations hours apart?
Post by: njtweb on December 01, 2020, 07:13:04 PM
I have a guy whose colo is located in Ashburn Va. according to IP Sniper. The guy posts non-stop youth hockey coronavirus stories that have no bearing on anything but to make his point he wants all youth hockey stopped. He's now to the point of out of control rants laced with profanity. I don't challenge him, I just delete what he posts immediately after he posts. Then he posts again and again and again complaining about me deleting his comments. Now every day I wake up to a post directed solely at "admin" name-calling and so forth. Naturally, I delete it. He won't leave, so every post I check to make sure it's him by checking his IP, he uses 3 different IP addresses non-stop. I'm guessing all from different devices. He'll even use a proxy. I banned 4 of the IP addresses today.

Later in the day a friend of mine from here in my town tried browsing to the site and said he's banned and asked why. I told him I didn't ban him but then I remembered I banned those 4 IPs earlier in the afternoon. I deleted them from the ban log and then he said he could get to the site again. The guy lives 20 mins away from me. We live 5 states and 7 hours away from Ashburn Va. How did he wind up re-using one of the banned IP addresses? If we live here in PA is there any chance his service on his phone is being hosted from that far away? Or is it actually possible for 2 or more different people to be using the same IP address at different times while hours apart?
Title: Re: Same IP 2 diff locations hours apart?
Post by: shawnb61 on December 01, 2020, 08:37:18 PM
What's the address?  Who owns it?  Do an ip lookup.

The short answer is yes, if the provider has that coverage and the users are using dhcp.
Title: Re: Same IP 2 diff locations hours apart?
Post by: efk on December 01, 2020, 10:52:12 PM
Once I was told some wise words about problematic member and it was something like this: "don't fuel his ego" or something similar, and know what, person who told me that was right. My point is you should not go down to his level. Why is he able to post on your forum, don't you have post moderation?
See my post https://www.simplemachines.org/community/index.php?topic=575212.msg4070909#msg4070909
To sum, you are playing his mind game and it should be your game, once you are in you need to set the rules and atm your are playing by his rules. Look at you from his angle and think what he wants from you and think how would you feel on his place if all access stop, if he doesn't have public anymore. If he needs to go through multiple verification, see his pain with test account, his posts will most likely be somehow unnatural compared to normal users. Try to solve the problem without ban, reduce his post count to 1 and let him suffer to get every single post. Make the problem disappear before it become a real problem.
My best advice is do not waste your time on his IP researching, all info you need will come to you easier, just be calm and ready for game, if in some board is not relevant if you have new posts or not let it await approval, he should see that others can't see.
Title: Re: Same IP 2 diff locations hours apart?
Post by: njtweb on December 02, 2020, 06:45:05 AM
IP Addresses: All through IP Sniper, (lookup) resolve to Ashburn VA. All of them lead back to the same guy who posts non-stop "Covid, covid, covid. We're all going to die, shelter in your homes forever, kids should never be allowed to play youth sports again". Those posts lead to back and forth fighting which serves zero purpose. Every time he posts them the ones against him dog pile because they get so pissed.

172.68.65.201,
173.245.54.110,
172.69.63.174.
172.69.63.10

@efk - People will only post on my site with guest access. Nobody will register otherwise. It's been this way for 3 years, I never had a problem until this nut job showed up.
Title: Re: Same IP 2 diff locations hours apart?
Post by: Kindred on December 02, 2020, 09:23:45 AM
Banning by IP is almost always going to cause problems with real users...
Title: Re: Same IP 2 diff locations hours apart?
Post by: shawnb61 on December 02, 2020, 10:13:50 AM
Those are all cloudflare ip addresses...
Title: Re: Same IP 2 diff locations hours apart?
Post by: njtweb on December 02, 2020, 11:30:33 AM
So they could all be in different geographical areas but all coming from the same place?
Title: Re: Same IP 2 diff locations hours apart?
Post by: Sir Osis of Liver on December 02, 2020, 11:51:29 AM
Quote from: efk on December 01, 2020, 10:52:12 PM
Why is he able to post on your forum, don't you have post moderation?

Put him on post moderation.  Enable it in Admin -> Core Features.  If he re-registers, do same to new account.
Title: Re: Same IP 2 diff locations hours apart?
Post by: @rjen on December 02, 2020, 12:21:17 PM
The guy is a guest... that would require moderation for all guests...
Title: Re: Same IP 2 diff locations hours apart?
Post by: njtweb on December 02, 2020, 12:54:14 PM
I actually wouldn't mind post moderation, they can still post but the posts will be reviewed first.

EDIT: I enabled, I updated the permissions for post/reply to own/reply to all for moderation. It worked perfectly, but I don't see a notification when I'm logged in as admin which would alert me that a post has been made to moderate. Do I have this turned off? Because I made the post as a guest, I knew to look and sure enough it was pink and waiting for approval.

Thanks, this should be perfect!
Title: Re: Same IP 2 diff locations hours apart?
Post by: shawnb61 on December 02, 2020, 01:31:59 PM
Quote from: njtweb on December 02, 2020, 11:30:33 AM
So they could all be in different geographical areas but all coming from the same place?

Service providers like CloudFlare own large ranges of IP addresses, and can provide services across large geographic areas.  Most service providers utilize DHCP - dynamic IP allocation to their customers.  George in California may be using an IP address that was used by Suzie in Texas the prior day. 

CloudFlare is actually here in San Francisco.  Just lookup one of those IP addresses via a standard IP lookup tool to see who owns it:
https://www.ultratools.com/tools/ipWhoisLookup


This is why Kindred points out that banning by IP address rarely works.  Most individual user IP addresses are dynamic... 


So how does a tool like IP Sniper work?  That's actually a harder question.  They (waves hands in the air...) analyze traffic information to narrow it down... 
https://whatismyipaddress.com/geolocation


Title: Re: Same IP 2 diff locations hours apart?
Post by: njtweb on December 02, 2020, 01:45:15 PM
I don't know how IPSniper works, it just uses a map to show geographic location. I guess it just looks nicer.

Ultimately though I think the post moderation is my answer, do you know if there are alerts when posts are made when this is enabled? Or is there somewhere I should be watching in the ACP?
Title: Re: Same IP 2 diff locations hours apart?
Post by: efk on December 02, 2020, 01:53:03 PM
You get emails, default is I think on about 2-4 hours. Also you can check when you join forum in Moderate, nothing to do in ACP. I made full instructions how to do it in link in my 1st post in this topic, just apply similar system to guest in case you want to continue with allowed guest posting.
Title: Re: Same IP 2 diff locations hours apart?
Post by: njtweb on December 02, 2020, 02:02:23 PM
Quote from: efk on December 02, 2020, 01:53:03 PM
You get emails, default is I think on about 2-4 hours. Also you can check when you join forum in Moderate, nothing to do in ACP. I made full instructions how to do it in link in my 1st post in this topic, just apply similar system to guest in case you want to continue with allowed guest posting.

Thank you, I read it but now I have a different issue. I don't have post counts, karma, group names or any of that stuff on my forum. As sad as the guy is who is a PITA, it's all youth hockey parents, league officials and USA hockey officials.

I didn't get the email when I tested. I would need a notification on the board like up where new members awaiting moderation is. And I don't want to throttle anybody's comments. I'm on the board pretty much all the time via my phone. I'm always checking for nonsense.

Is ther any way to take the throttling off, allow the guests to post, because if not, I'm punishing everybody for one person. And get board notifications? Otherwise this won't actually work for me, I'll have to turn it off.
Title: Re: Same IP 2 diff locations hours apart?
Post by: njtweb on December 02, 2020, 04:56:55 PM
Would've been the best option but I need to see an alert on the site, I turned it off. If anybody knows a way to fix it so it alerts, (not by email) I'm all ears. Thank you to all as always.
Title: Re: Same IP 2 diff locations hours apart?
Post by: efk on December 02, 2020, 05:14:33 PM
Admin/Maintenance/Scheduled Tasks/Approval Notifications(Send out emails to all moderators summarizing posts awaiting approval.) - repeating every 2 hour(s) - this is how it is on my forum.

To check topics/posts that are awaiting moderation - Moderate/Unapproved Posts and Topics.

QuoteWould've been the best option but I need to see an alert on the site, I turned it off. If anybody knows a way to fix it so it alerts
If 2 clicks are too complicated to do for you then install SimplePortal mod and add Recent posts and Recent topics to portal page.
If all that is too much then install Enotify (https://custom.simplemachines.org/mods/index.php?mod=2198) mod, it will spam you all the time.
Title: Re: Same IP 2 diff locations hours apart?
Post by: a10 on December 02, 2020, 05:17:58 PM
Guest posting... am amazed there are not many, many more psychos + getting completely submerged by spam of all kinds.

Just an opinion, membership with admin approval, even if not wished for regarding some potential impact on other forum users. Puts a healthy dose of workload back onto the nutcase, having to continuously register, wait, create\monitor new email adresses as one deletes posts\accounts + bans email.
Title: Re: Same IP 2 diff locations hours apart?
Post by: njtweb on December 02, 2020, 06:44:02 PM
Quote from: efk on December 02, 2020, 05:14:33 PM
Admin/Maintenance/Scheduled Tasks/Approval Notifications(Send out emails to all moderators summarizing posts awaiting approval.) - repeating every 2 hour(s) - this is how it is on my forum.

To check topics/posts that are awaiting moderation - Moderate/Unapproved Posts and Topics.

QuoteWould've been the best option but I need to see an alert on the site, I turned it off. If anybody knows a way to fix it so it alerts
If 2 clicks are too complicated to do for you then install SimplePortal mod and add Recent posts and Recent topics to portal page.
If all that is too much then install Enotify (https://custom.simplemachines.org/mods/index.php?mod=2198) mod, it will spam you all the time.

I wasn't aware of that control. It's 2hrs can it be adjusted?

Quote from: a10 on December 02, 2020, 05:17:58 PM
Guest posting... am amazed there are not many, many more psychos + getting completely submerged by spam of all kinds.

Just an opinion, membership with admin approval, even if not wished for regarding some potential impact on other forum users. Puts a healthy dose of workload back onto the nutcase, having to continuously register, wait, create\monitor new email adresses as one deletes posts\accounts + bans email.

My traffic on my site will not register. I've tried everything imaginable including contests, and giveaways and other gimmicky stuff. People register but only to see new content. The ones who comment will not register. The only way they'll comment is as guest. It's annoying as all H... but that's the only way people will get involved. Otherwise I get a lot day to day traffic from readers.
Title: Re: Same IP 2 diff locations hours apart?
Post by: njtweb on December 02, 2020, 07:21:23 PM
I see now the posts and replies show up under Moderate>Topic posts and replies as soon as they're posted. That's refreshing, there's so man tools available that I don't think most have any idea they exist. I'm one of them.

Thank you to everybody who replied.
Title: Re: Same IP 2 diff locations hours apart?
Post by: njtweb on December 03, 2020, 09:02:48 AM
THIS WORKS GREAT!
Title: Re: Same IP 2 diff locations hours apart?
Post by: efk on December 04, 2020, 02:05:35 PM
https://www.simplemachines.org/community/index.php?topic=575852.msg4074678#msg4074678

See attachments in this post. I forgot about notification options on profile.
Title: Re: Same IP 2 diff locations hours apart?
Post by: njtweb on December 04, 2020, 05:16:07 PM
That was already apparently set. I didn't do it, I guess it was set by default.
Title: Re: Same IP 2 diff locations hours apart?
Post by: njtweb on December 05, 2020, 07:29:23 PM
FYI about ENotify. You don't get spammed at all with it enabled. In fact it's the opposite. YOu don't get notified until you approve the posts. So it's actually kind of a pointless mod in this case.
Title: Re: Same IP 2 diff locations hours apart?
Post by: efk on December 06, 2020, 11:24:55 AM
Quote from: njtweb on December 05, 2020, 07:29:23 PM
FYI about ENotify. You don't get spammed at all with it enabled. In fact it's the opposite. YOu don't get notified until you approve the posts. So it's actually kind of a pointless mod in this case.
It was about 50:50 chance. Go to ENotify topic and contact mod creator. Ask if it could be done for post moderation.