6

I have a social networking website and I want to ban a user from the website. I've added his IP address to the ban list in the .htacess file and to the php level for banning that user, but he keeps coming back with different IPs.

How can I permanently ban a user, no matter how hard he tries to re-enter the website?

7
  • 17
    Welcome to reality. In essence there is absolutely nothing you can do. No matter what measures you take, they are easily circumvented. This is for the simple fact that you have nothing absolute to identify that user with. Ban the IP address and he will get a new one. Ban the user account and he'll create a new one, etc. Aug 22, 2012 at 2:01
  • 21
    I had this problem 12 years ago. My solution was simple: I called his mom and she confiscated his modem. Problem solved. Aug 22, 2012 at 2:17
  • Is this a vBulletin forum by chance? Aug 22, 2012 at 2:22
  • 1
    The more "sophisticated" your means of blocking one user become, the more potential nuisances for many other users you will inadvertently introduce. Make sure the effort is worth this risk Aug 22, 2012 at 14:03
  • 1
    An IP ban might impact other users. Most folks do not have static IPs, so periodically they get reassigned. Blocking my IP will block me until I get a new one, then it could very well block my neighbor when he gets my old IP. What dating site are you trying to protect?
    – Freiheit
    Aug 22, 2012 at 15:44

9 Answers 9

15

I guess you're coming at this from the wrong angle. Many sites (including this one) slowly let you see more of the abilities as you prove you can be trusted.

I'd suggest making first posts have to be moderated, or some form of voting system and then none of his posts will stay visible for long.

This is a human problem really, not so much a technical one.

10

Thanks to Tor and innumerable other proxy services, you can't depend on an IP ban to block a user.

You'd need to implement some kind of other barrier - email validation requirements on sign-up, maybe, or require moderation approval for new account creations? Unless your user sign-up process requires blood samples, social security numbers, and mothers' maiden names, you'll have cracks open for illegitimate accounts.

The choice of what kind of barriers you put in place on the scale of usability versus security is an important decision - keep in mind that for everything you put in place to thwart a small segment of trolls, malicious users, or bots, you'll be inconveniencing a much larger set of legitimate users.

2
  • i have already the email ban, but he keep on creating free email accounts, and he is impersonating other users.. etc so many problems ... but i have no answer..
    – mahen3d
    Aug 22, 2012 at 2:15
  • @user1179459 Banning free email providers might work. Hardforum.com has done this for several years to limit trolls availability to rejoin the site. IF the idiot's impersonating other users, enforcing unique display names/etc would be more effective than trying to ban the troll. Aug 22, 2012 at 12:47
8

When a new user signs up, use a service like Twilio to send a text message to their phone containing a short passcode. They have to correctly enter this code to verify their account. This is similar to how Craigslist (attempts) to keep spammers out and is also frequently used by online banking as a kind of a poor man's two-factor authentication system.

4

I can't promise you "successfully, permanently" but there are certainly plenty of things you can do to make his life more difficult. Enough of these and he will give up.

You have already tried using his IP address for identification but it's easy to find free proxy servers. It's somewhat harder to find free and anonymous proxy servers. Most proxy servers send the user's IP address along in an X-Forwarded-For: header. You can use mod_security to block these.

SecRule REQUEST_HEADERS:X-Forwarded-For "@Contains 192.168.0.1"

Obviously, you should replace 192.168.0.1 with his actual IP address. You can block a larger set of proxied IPs by removing the last octet.

This will limit him now to using anonymous proxies and Tor. You can identify when he's using Tor because every request will come from a different IP address and these will probably all be on a Tor exit node list. Here are two examples of lists. There are proxy lists available too.

You can force him to bypass the proxy for just one subrequest by using either Flash or Javascript or even just an image link. This depends on how the proxy is set up in his computer (you can put it into the browser or the OS or have it as a transparent proxy on the network) but whatever type it is, it probably only proxies for port 80 and 443. Have your website cause him to connect on port 8080 or port 25 or something else and encode a unique identifier in the request. This would do the trick in PHP:

echo("<img src=\"http://example.com:25/".session_id().".jpg\" />");

The next step I would take is using EverCookies. Depending on how good he is at removing all the various storage methods, that alone might be enough to reliably identify him. He can avoid this by running a browser in a VM and reverting it to a known state every time he gets banned again or by not running javascript but you will have successfully made his life that bit more difficult. You could potentially use the fact that he's not running javascript to identify him.

It's also worth noting that Google analytics assign a unique identifier in the second "field" (separated by dots) of their __utma cookie. If you have Google analytics and he doesn't delete this cookie, you may already have enough to track him.

To log cookies (and all HTTP headers) you can use a forensic log.

Following that, browser fingerprinting is a bit more difficult and prone to both false positives (if you make it a little fuzzy) and false negatives (if you go for exact matches only) but can it be done. It would actually be more effective if he keeps reverting his VM to a known state because that will mean his fingerprint never changes. He would have to change his VM's screen resolution and time zone and the installed plugins each time he got banned.

One more method: Identify the content he posts. Just treat him like a normal spammer. Feed his data through a Bayesian learning engine and teach it to recognise him... and once it's good enough at recognising what he posts, ban anyone who posts that sort of content. This one has the nice advantage that false positives are probably people you would want to ban anyway, even if they're not the same guy.

2
  • Good suggestions here, but the point about "outing" the proxy by use of a nonstandard port request is probably well within the realm of "hurting legitimate users more than hindering malicious ones". That said, for a social networking website it may not make a huge difference as the majority of your users are probably not behind a firewall. Aug 22, 2012 at 15:41
  • @Justinᚅᚔᚈᚄᚒᚔ That idea was more about finding their true back-end IP address rather than detecting that the connecting IP is a proxy. If the back-end IP address is one you have detected earlier as undesirable, you could use that wrong-port request to set a cookie that would allow you to block just a single user behind the proxy. Good point about making sure you are not blocking your real users though. You wouldn't want to shoot yourself in the foot here.
    – Ladadadada
    Aug 22, 2012 at 16:08
4

We handle this differently. Along with temporary IP Bans (that are easily circumvented) we have a cookie that identifies him as banned. And if he comes back none the less we have a special usergroup that we will assign to him. He isn't able to notice anything unusual everything looks and works as expected on his side. But all of his actions, posts, PMs and so on are invisible for others.

Eventually he will get bored since no one is reacting to him (how should they if none of is posts is visible except for him)

4
  • 2
    This is called a hellban, and a lot of people consider it unacceptable and effectively fraud. Aug 22, 2012 at 13:17
  • Yes. But so is re-registering on a Website you have been previously banned. I should may add that I'm from germany where jurisdiction has given Website owners a virtual domestic authority. So re-registering essentially is intrusion but it's rarely really enforced by law. So "hellbanning" as last resort is in turn, if all else fails justified in my eyes. It all boils down to in what legal boundaries you have to act. Aug 22, 2012 at 13:37
  • 1
    My own position is this: If you have the administrative discipline to use a hellban only in those exceptionally extreme cases where it really is warranted, then fine. But if your honest assessment of your ability to run your site doesn't convince you that the tool won't be misused, you're much better off not having it. Aug 22, 2012 at 13:51
  • That's my philosophy too, however the main thing here is that the OP asked for ways to permanently get rid of an user. I merely told him another way, without recommending it especially. :) Aug 22, 2012 at 14:10
2

Depending on how little he knows, you could try saving a "Token of Death" as a cookie. If that cookie is found, serve the banned page. He may not think to check for something like that, particularly if you pick some kind of sneaky name (Maybe something session related?)

2
  • no way, he is network engineer, he even changes the network isp's even i dont know how he do it.. very stuff guy..
    – mahen3d
    Aug 22, 2012 at 11:44
  • Clear the browser cache and he is back on
    – Chida
    Aug 22, 2012 at 12:02
2

Report him to his ISP. Include detailed logs (IPs, actions, timestamps with timezones), copies of your site's administrative policy, and so on. If his ISP is not cooperative, ban his entire ISP. If users complain, tell them that you are very sorry, but they have an ISP that refuses to deal with abuse.

Surprisingly, if you do this correctly and responsibly, most ISPs will cooperate with you. They won't identify the user to you, but they will deal with the user.

If he connects through proxies, ban the proxies.

This may or may not work, but it's about all you have.

2
  • i don't think reporting to the ISP is a solution that will work, because he is doing it in my website, and ISP will say its your problem, he hasn't done anything wrong basically to them, and creating a impersonating accounts,money scams,treating and verbally accusing members i don't think ISP will care..
    – mahen3d
    Aug 22, 2012 at 11:47
  • 1
    So that means you didn't try it. I have tried it many times, and I can tell you from personal experience, it works. And, like I said, if it doesn't work, ban his entire ISP and explain why. See what the ISP does when their customers start complaining. Aug 22, 2012 at 12:57
1

You can't, really.

My first suggestion, is if you have his original IP logged, to report him to his ISP for abuse, and try to get his service yanked, or suspended. This will vary based on the ISP, but they can be very helpful. Failing that...

You can use cookies, Flash cookies or browser fingerprinting to try to remember him no matter his IP, but those are fairly easy to bypass. A more advanced, but equally easy to bypass ban (provided he knows what to look for) is to capture his MAC address and ban that.

You also might want to look into banning the IPs of free, publicly available proxy servers and prohibit signing up with a list of known free webmail providers to cut down on his options, but even then, a cheap account with a VPN provider and/or an obscure webmail provider can bypass those.

Doing all of the above is somewhat effective, but a determined troll will get through those blocks, and in my experience, the only thing that really works is moderating new user sign ups, and that causes issues with driving off legitimate new users. You could just keep banning him until he tires and finds something else to capture his interest (like a shiny object).

If he's truly that big a problem, you can use cookies and/or browser fingerprinting to ID him, and redirect him to a copy of the site that only he can see or make his posts and activities only readable to him - so he can troll away until he gets bored, thinking he's bypassing the ban, but in actuality, you've created a private little sandbox just for him, and no one else is impacted by his crap. I've done that in the past with some more troublesome forum trolls, but unless they're really, really persistent and really, really vile, it's more effort than it's worth, IMHO.

9
  • Good theory but in many (most?) countries an ISP which removes a client's access based on nothing more than an allegation subjects itself to legal action, as many have learned the hard way. Aug 22, 2012 at 2:59
  • @JohnGardeniers Someone should tell the MPAA and RIAA that, huh? Or the European governments with various "3 strikes" laws, and so on. Aug 22, 2012 at 3:01
  • The MPAA and RIAA already know it. Actions be taken those governments are a completely different issue and still require evidence. Aug 22, 2012 at 3:04
  • 3
    How are you going to capture his MAC address? If he's close enough for you to be able to get his MAC, you can just go and punch him in the nose.
    – womble
    Aug 22, 2012 at 9:35
  • 2
    @user1179459 Most ISPs are better about "abuse" reports than you think. Honestly, I've worked with a few before when I was in your position and was pleasantly surprised usually.
    – Chris S
    Aug 22, 2012 at 12:54
1

Read http://www.codinghorror.com/blog/2011/06/suspension-ban-or-hellban.html.

You could try hellbanning the user by IP.

A hellbanned user is invisible to all other users, but crucially, not himself. From their perspective, they are participating normally in the community but nobody ever responds to them. They can no longer disrupt the community because they are effectively a ghost. It's a clever way of enforcing the "don't feed the troll" rule in the community. When nothing they post ever gets a response, a hellbanned user is likely to get bored or frustrated and leave. I believe it, too; if I learned anything from reading The Great Brain as a child, it's that the silent treatment is the cruelest punishment of them all.

The idea is that he won't know he is actually banned and won't bother changing his IP again.

You could also try to implement a flash-based "cookie". These are different than regular HTTP cookies in that some browsers do not delete them when their browser cookies are deleted. (more info: http://en.wikipedia.org/wiki/Local_shared_object)

Not the answer you're looking for? Browse other questions tagged .