Comments on: Spammer Techniques: Are You a Zombie? Part I

By: Dave Rathbun

Dave Rathbun — Fri, 31 Oct 2008 16:45:59 +0000

That is an interesting thought!

/me goes off to run some queries…

By: Dog Cow

Dog Cow — Fri, 31 Oct 2008 16:19:18 +0000

Ok, well here’s the rest of my idea which popped into my brain after I had clicked Submit yesterday:
A minimum post count, or minimum registration period! Everyone loves those! Where the first post you make, you have to make 10 more posts in that range before you can globe hop, else the first post you make, you have to wait X amount of days before you can globe-hop.

By: Dave Rathbun

Dave Rathbun — Fri, 31 Oct 2008 13:45:43 +0000

It's an interesting idea, but it would catch some legitimate users. For example, I have personally posted on my board from all four time zones in the US. I have also posted from London and Berlin. I don't think I posted from Moscow while I was there, but I might have. Altogether I have posted from 234 different IP addresses in six+ years. If I drop the last octet of the IP address (so I only count 0.0.0.x as unique) the number only drops to 216. If I drop the last two octets I still have posted from 123 different IP ranges. Even checking only the first octet I have posted from 41 completely different locations. And I have users that travel even more than I do. Here is a list of the first octet of any IP address that I have posted from:

+----+----------+
| ip | count(*) |
+----+----------+
| 03 |        3 |
| 0c |      707 |
| 18 |     1369 |
| 3e |        3 |
| 3f |       40 |
| 40 |        9 |
| 41 |      940 |
| 42 |       11 |
| 43 |      634 |
| 44 |        3 |
| 48 |        2 |
| 4b |        7 |
| 4c |     1759 |
| 50 |        3 |
| 52 |        8 |
| 58 |        6 |
| 63 |        1 |
| 84 |        1 |
| 86 |       25 |
| 8f |       11 |
| 94 |        1 |
| 95 |       25 |
| 97 |        5 |
| 98 |        1 |
| 9c |       11 |
| a1 |        1 |
| a2 |        4 |
| a5 |       21 |
| a8 |      465 |
| a9 |        3 |
| ac |      367 |
| c0 |       25 |
| c6 |     3534 |
| c7 |      228 |
| cc |      277 |
| cd |        1 |
| ce |       22 |
| cf |        3 |
| d0 |      148 |
| d8 |      179 |
| d9 |       12 |
+----+----------+

By: Dog Cow

Dog Cow — Thu, 30 Oct 2008 23:24:13 +0000

So, I think I see a potential solution… and that is to prevent users from posting from insanely different IP addresses: either range-wise, or geo-location-wise.

By: Dave Rathbun

Dave Rathbun — Thu, 30 Oct 2008 19:51:00 +0000

I should have credited the source for the smiley with a link. I will fix that now:

http://www.sml-world.com/

By: Dog Cow

Dog Cow — Thu, 30 Oct 2008 15:52:42 +0000

I liked the zombie animation. That was the best part of it all.

By: dogs and things

dogs and things — Thu, 30 Oct 2008 07:55:57 +0000

Hi Dave,

Another nice post, I like your analytical approach, you do seem to find the important points.

Lookin’ forward to the next post…