10

In my extensive experience fighting spam on Super User, I've noticed that spammers often use many different domains to evade detection. In several cases, I've found that the domains often resolve to one or a few IP addresses, which are used exclusively by a particular spammer or spam campaign. An example is 192.185.37.236.

To defeat this evasion technique, I suggest adding the ability to blacklist domains which resolve to certain IP addresses which are found to be hosting spam. This blacklist would be enforced against users with less than 10 reputation (the reputation level at which new user restrictions are lifted), where any posts which link to a domain that resolves to a blacklisted IP would be rejected. (Users with at least 10 reputation would still be allowed to make edits that add links to domains that are blacklisted in this manner.)

As I envision it, the blacklist should be manually populated, with some degree of automated assistance. Ideally, the system would examine posts that are flagged as spam, resolve linked domains to their IP addresses, and report to Stack Exchange developers the destination IPs that are most commonly spammed. The community team (or perhaps ♦moderators) can then check if the IP is used exclusively for spam using online tools such as VirusTotal to perform reverse DNS lookups (to avoid blocking legitimate shared hosts). Because IPs can and do change with time, each IP address on the blacklist will need to be reevaluated periodically to avoid blocking legitimate websites which may later use this IP address. My list of known spammers would serve as a good starting point for populating the list.

Your thoughts?

  • Like you have said, "IP based blacklisting will need to be reevaluated periodically to avoid blocking legitimate websites which may later use this IP address". Please run blacklist test on the first 5 IP's given in the answer "My list of known spammers" – HackerKarma Aug 16 '15 at 22:19
  • @HackerKarma, I did not validate those IP addresses on that site, but what are the odds that new users would want to post something related to such IP address? (Also assuming that the IP addresses would be removed from the Stack Exchange blacklist if no attempts were made to use them for some time.) – Arjan Aug 17 '15 at 1:03
  • @Arjan defeating spam is biggest problem we have today and using IP's to blacklist requires careful action or you may ending blocking legitimate visitors. I have read about Spamhaus for blacklisting IP's but I think they are more popular with e-mail service. – HackerKarma Aug 17 '15 at 3:20
  • One problem arises with this when a server uses a public hosting service... you block any legitimate websites that also reside on the same hosting. – John Dvorak Aug 17 '15 at 5:04
  • @JanDvorak I thought that too when I saw where the IPs resolved (eg EC2). But I suspect most websites on EC2 won't be asking questions or providing answers on SE sites :) – bertieb Aug 17 '15 at 8:27
  • @HackerKarma, just to be sure: note that the feature request does not ask for blocking visitors, but for blocking (or flagging) posts that contain links to domains/IP addresses that were recently used in spam posts. (And then also only for new users with less than 10 rep.) – Arjan Aug 17 '15 at 8:32

You must log in to answer this question.

Browse other questions tagged .