Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / inflammatory content, get a rise out of people, then get deleted within a few hours by an admin. Then repeat.

His IP address changes every time he creates a new account (either using a proxy or some other similar tool). The only commonality is the top level 92.x.x.x. We've tried contacting UK authorities... while they are interested, they have not provided anything actionable. Meanwhile, this harassment continues daily.

Anyone have experience on how to kill this off? I'm pretty much at my wit's end here and hoping someone who has dealt with this before can provide some guidance.

Thx in advance.

share|improve this question
    
what kind of server OS are you using? –  Patrick R Feb 23 '10 at 23:38
    
Any chance the UserAgent is identifiable or there is some sort of pattern in the web requests? –  Dscoduc Feb 23 '10 at 23:39
    
Redhat 5, LAMP stack. –  Arronsky2 Feb 24 '10 at 1:05
    
I hope that's RHEL 5 and not Red Hat 5.0, which is ancient... :P –  Avery Payne Feb 24 '10 at 2:31
    
You could try iwf.org.uk or maybe contact UK CERT ukcert.org.uk to see if they can provide better contacts at the ISP or an appropriate UK Law Enforcement contact if the posts are that bad. –  Sim Feb 24 '10 at 2:39
show 3 more comments

8 Answers

Instead of blocking it, you can employ a different approach - I think I heard it on one of the SO podcasts, and/or maybe SO use it as well.

Do not delete the account and the posts - just make them visible only to this account and noone else. The kid will continue to try while you play his game. If he sees that his comments are not deleted, he may loose interest. You can leave the comments visible for the entire 92.x.x.x subnet, with the hope that he'll never notice, and you will not offend other users.

share|improve this answer
    
I like that approach Sunny. +1 –  Patrick R Feb 24 '10 at 0:13
    
+1 Yes this is radically neat –  Oskar Duveborn Feb 24 '10 at 0:25
    
Very creative. I likey a lot. =) –  Wesley Feb 24 '10 at 0:40
1  
Nice. But how would this be implemented? Since attacks come from 92/8, do you set any post from 92/8 to be visible only in 92/8 ? What about decent people in 92/8 ? –  Paul Feb 24 '10 at 4:20
1  
Wait for him to make a new account and apply it to that account instead of banning it outright? Yes he will make a few more accounts, but chances are if he's not getting "banned" frequently he won't make too many. –  Frenchie Feb 24 '10 at 5:40
show 1 more comment

If it's available you could try having to approve new accounts or approving the first post of a newly created account.

share|improve this answer
    
Agreed. This is just the sort of reason to have moderated posts. –  John Gardeniers Feb 24 '10 at 9:03
add comment

I would try and trace back (tracert) one of the IP addresses to the provider, look up an abuse contact email/number for the provider, and report the IP address.

If the user is on a public network you're pretty much at a dead end, but if it's a company or residence then you might be able to request an inquiry into the IP Address ownership.

share|improve this answer
    
We've done this, and the ISP is (usually) carphonewarehouse. Given the vile nature of what this kid posts (think harming children, animals, and others in incredible detail), we were hoping that examples + IP addresses + times of access would be enough to get them motivated. They've acknowledged receiving the data, but in the meanwhile we continue to see him everyday. –  Arronsky2 Feb 24 '10 at 1:08
add comment

92.0.0.0 is under the authority of RIPE, so search the specific IP in the RIPE database and you'll find what network has direct control of that IP. Then you can report them to the proper channels for that range.

share|improve this answer
add comment

Blocking an entire network seems a little overkill. Could you switch your site to read-only for a week or two? If it's just a kid out to get his jollies he'll get bored and move on.

There's also the possibility that it might be caused by a piece of malware on a totally innocent person's machine. That should always be viewed as a possible source of this kind of attack. It seems a little unlikely that a human being would carry out such a sustained attack over such a period of time - daily for a full 6 months is quite extreme.

I'd vote for a strong CAPTCHA on new account creation (and on any unregistered posting facility you might have) and approval for new accounts (although it might do your head in if it happens on a continual basis). That should catch both potential possibilities.

share|improve this answer
    
The OP has already indicated that this has been happening for 6 months, so this particular person doesn't get bored too easily. More's the pity. –  John Gardeniers Feb 24 '10 at 9:04
add comment

Rather than completely blocking access to the 92/8 network it may be sufficient to block the creation of new accounts (or require administrator approval).

This would avoid the collateral damage from those people in that network who visit your site (and already have accounts).

share|improve this answer
add comment

None of the suggestions given will help you.

This kind of people runs spywares / malwares that are opening them PC's all over the planet, don't even consider blocking IP's or blocks of IP's and expect long term results.

Now you only have one of them, which is great, imagine what it would be if they were 10 or even more.

You have to change the way your application works.

Here is a few ideas :
- If the account is not at least 24 hours old
- Registered with Yahoo, Gmail, Hotmail/MSN.

Prevent replies or have them accepted by admins.

But first of all, you could probably tighten your new user regisration.
One good example is spammers often signup using cut and paste or even bots, they often do HUGE mistakes that can be seen right at the registration like :

  • Lower case first name, name, city, ...
  • Easy passwords

Look at the registration made by this guy, you should find things like that. If you do find some, enforce them at the registration. This will have him correct all this in order to signup. What was taking him 30 sec, will now take him minutes, like most people. Just make sure you dont punish every new users with this.

Optionnally you could consider having some sort of filtering against a database for all comments. If a comment is flagged, it is deleted, warn user or require admins approval.

Akismet could potentially do the job or at least a good part of it. If you don't run Wordpress, use an API for the language your application use.

You will probably have better result with many small changes than one radical solution.

Good luck.

share|improve this answer
add comment

The easiest and arguably most effective is to block 92.0.0.0/8 (0.255.255.255 in Wildcard of course). This has the disadvantage of removing about 1/200th of the usable internet space from accessing your site.

Depending on how frustrated you are - and its certainly not IT-kosher (depending on what country you are from and where you are hosted), you could use any number of vulnerabilities present in the web-browsers available today and drop rm -rf or format C: -f appropriately, Its shady and probably unethical, but its been used (anecdotally of course) by admins with somewhat humorous results.

Just as a note, Abuse contacts are a joke, Likewise with law enforcement, Unless you've lost major cash and you can show this with financial statements, Good luck with getting anything, At least that's how it works with the Feds in the US, I can't speak much towards the UK.

share|improve this answer
    
The only time I've seen abuse contacts work is when an ISP has put rubbish in their IANA records, which I found because they were spamming. I got a very swift result from their international link when I emailed them about that! –  staticsan Feb 24 '10 at 0:02
    
My point is proven. When I said 'abuse contacts' I mean in relationship to Hacking and I imagine ESPECIALLY harassment attempts, I have never, literally NEVER heard of success on the ISP level. –  zv_ Feb 24 '10 at 0:04
1  
-1 for the rm -rf (which I hope was intended as a joke). –  Jimmy Shelter Feb 24 '10 at 0:12
3  
rm -rf is never a joke. –  zv_ Feb 24 '10 at 0:37
2  
Ethics and morals aside, If he knew enough about the person to setup a targeted attack against his PC don't you think he could just block the person? Definitely not a viable option –  einstiien Feb 24 '10 at 1:27
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.