Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We got attacked by some very-bored teenagers registering in our forums and posting very explicit material using anonymous proxy websites, like http://proxify.com/

Is there a way to check the registration IP against a black list database? Has anyone experienced this and had success?


Sorry, it didn't link my account from StackOverflow to here :(

Anyway, I used Proxify.com and got an IP of 67.15.76.115, unfortunately, Spamhaus doesn't list that IP?

share|improve this question

migrated from stackoverflow.com May 15 '10 at 8:06

This question came from our site for professional and enthusiast programmers.

    
And you know these are bored teenagers because...? –  John Gardeniers May 15 '10 at 11:32
add comment

2 Answers 2

[ not tested, just some thoughts ]:

what you can try to do is to check ips of posters against couple of rbl servers [ just as it is done with e-mail ]. list of some rbls that can help you: http://spamlinks.net/filter-dnsbl-lists.htm#proxies. problem is such approach will introduce significant delay and degrade user experience. you can combine it together with local geoip database [ eg from maxmind ] and apply the check only to those who are coming from 'suspicious' directions.

there are also paid services that will keep updated list of proxies - eg killabot. if you are willing to pay there should be no problem with modifying their wordpress protection script and using for your website.

share|improve this answer
    
Its only a matter of time before you are hacked though Wordpress. –  Rook May 15 '10 at 9:01
    
@The Rook - well - i'm talking about using this mechanizm with whatever custom application mmgn has. nothing more nothing less; besides i believe if you keep things updated [ both your php ecosystem and the blog engine itself ] - you are pretty safe. sure - if you lag behind you will get owned sooner or later. –  pQd May 15 '10 at 9:10
add comment

Many proxies are tracked by the Spamhaus project. Specifically the SBL and XBL should be used for this purpose. You can use Squid to deny hosts that are on these black lists.

There are also for pay services. And you could even check the "x-forwarded-for" header, but "anonymous proxies" wont' set this variable. Further more this is an attacker controlled variable and can never really be trusted.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.