4 ms·

Yep, shadow ban was in place as well. The thing is, the people that weren't the ones posting the content. It appeared their computer was affected by some type

Yep, shadow ban was in place as well. The thing is, the people that weren't the ones posting the content. It appeared their computer was affected by some type of malicious file to be part of a bigger network. (botnet?) I could see from the thousands of different IPs in different countries around the globe, that it could be affected personal computers. Very few of them were computers from hosting companies, the rest were normal people computers. I'm sure these machines were doing the job, someone else would have tests the result. When we did the shadow banning it didn't made a dent in their effort. The way they changed email, changed username, tried to be unique was completely prepared specifically for our platform (I would guess so) Whenever we counter their attack, they would be silent for a while and then attack again. They would adjust. Shadow ban is effective when the attacker themselves will not be aware it, in our case it was tricky to know who was the observer.

jart 5y ago
Did they map to ISP ASNs? Country geolocation doesn't say much anymore since there's so many VPN providers whose business is to buy a CIDR in every country and resell access.
- Alir3z4 5y ago
  Yes, almost all of them mapped to ISP ASNs. Very few of them were from AWS, OVH and other hosting providers, very very few. We ran each IP towards black lists ips, paid IP reputation checkers. Majority of the IPs were clean. Back then we had IP reputation check, but it was a headache to maintain, so we disabled it later, however that time very very few them got stopped at IP reputation checks.
  - kbenson 5y ago
    As someone that's used IP proxying services that provide millions of IPs for scraping purposes, that is a very mature industry, and they advertise (and I believe them) "millions" or IPS, even for what you might consider hard to supply ones, like mobile IPs, and they let you slice and dice them however you want? Datacenter IPs? Residential IPs? Mobile IPs?[1] What state or city would you like them in? Would you like the site you're hitting to not have been accessed by this IP (through proxying at least), and if so how many days? Do you want some mix of that? Make your own configurations and set them up as proxy endpoints, etc. Fighting against abuse at the level of IP address attributes seems like a losing game to me. Honestly, the best I saw at this (3-5 years ago at least) for traffic was Distil networks, where they put a proxy device in front and examine your traffic and captcha or block based on that. Since you have content being submitted, there's a lot more you can use to classify, such as how you used ML, so that's good. Part of me worries that this is all sort of reminiscent of infections and antibiotics though. The continual back-and-forth of you finding a block them finding a workaround feels kind of like you were training the spammers (even if you were training yourself at the same time). At some point maybe we'll find that most the forum spam is ML generated low information content posts that also happen to be astroturfing that is hard to distinguish from real people's opinions. 1: Fun fact, to my knowledge anonymous mobile IPs are provided by a bunch of apps opting into an SDK (like an advertising/metrics SDK) which while their app is open (at least I hope that's a requirement) registers itself to the proxying service so it can be handed out for use by paying proxy customers. Think about that next time you play your free "ad-supported" mobile game.
bryan_w 5y ago
Yup they utilize "residential proxies" to hide their behavior which makes the situation worse because sometimes it will affect your legit users
- 0xcde4c3db 5y ago
  I wasn't familiar with the term, so I just searched the phrase "residential proxies", and the space seems even more sketchy than the usual VPN peddlers who promise the world and more. Are they using malware-infected PCs, or what?
  - viraptor 5y ago
    Some of them use the endpoints using their app. Which means a lot of people become the spammers just by joining the network. Of course it's mentioned in the middle of their T&C, but who reads that...
  - cmeacham98 5y ago
    The most legit ones use their own users (to access the residential proxy you have to agree to become an endpoint yourself). More shady but probably legal ones use JavaScript and Apps that typically hide the fact you are becoming an endpoint in the T&Vs. Straight up illegal ones use compromised computers and routers like you'd think.
- zxcvbn4038 5y ago
  I’ve always been curious how the residential proxies work. Is someone going around paying people to run proxies in their home? Are these compromised devices being exploited? Are there a bunch of storage units someplace with cable service? The mind runs wild.
nebula8804 5y ago
This seems like a lot of effort? What do you think was the motivation for something like this on your site?
- morenoh149 5y ago
  The cynical answer is backlinks haha

jart 5y ago

Did they map to ISP ASNs? Country geolocation doesn't say much anymore since there's so many VPN providers whose business is to buy a CIDR in every country and resell access.

Alir3z4 5y ago
Yes, almost all of them mapped to ISP ASNs. Very few of them were from AWS, OVH and other hosting providers, very very few. We ran each IP towards black lists ips, paid IP reputation checkers. Majority of the IPs were clean. Back then we had IP reputation check, but it was a headache to maintain, so we disabled it later, however that time very very few them got stopped at IP reputation checks.
- kbenson 5y ago
  As someone that's used IP proxying services that provide millions of IPs for scraping purposes, that is a very mature industry, and they advertise (and I believe them) "millions" or IPS, even for what you might consider hard to supply ones, like mobile IPs, and they let you slice and dice them however you want? Datacenter IPs? Residential IPs? Mobile IPs?[1] What state or city would you like them in? Would you like the site you're hitting to not have been accessed by this IP (through proxying at least), and if so how many days? Do you want some mix of that? Make your own configurations and set them up as proxy endpoints, etc. Fighting against abuse at the level of IP address attributes seems like a losing game to me. Honestly, the best I saw at this (3-5 years ago at least) for traffic was Distil networks, where they put a proxy device in front and examine your traffic and captcha or block based on that. Since you have content being submitted, there's a lot more you can use to classify, such as how you used ML, so that's good. Part of me worries that this is all sort of reminiscent of infections and antibiotics though. The continual back-and-forth of you finding a block them finding a workaround feels kind of like you were training the spammers (even if you were training yourself at the same time). At some point maybe we'll find that most the forum spam is ML generated low information content posts that also happen to be astroturfing that is hard to distinguish from real people's opinions. 1: Fun fact, to my knowledge anonymous mobile IPs are provided by a bunch of apps opting into an SDK (like an advertising/metrics SDK) which while their app is open (at least I hope that's a requirement) registers itself to the proxying service so it can be handed out for use by paying proxy customers. Think about that next time you play your free "ad-supported" mobile game.

bryan_w 5y ago

Yup they utilize "residential proxies" to hide their behavior which makes the situation worse because sometimes it will affect your legit users

0xcde4c3db 5y ago
I wasn't familiar with the term, so I just searched the phrase "residential proxies", and the space seems even more sketchy than the usual VPN peddlers who promise the world and more. Are they using malware-infected PCs, or what?
- viraptor 5y ago
  Some of them use the endpoints using their app. Which means a lot of people become the spammers just by joining the network. Of course it's mentioned in the middle of their T&C, but who reads that...
- cmeacham98 5y ago
  The most legit ones use their own users (to access the residential proxy you have to agree to become an endpoint yourself). More shady but probably legal ones use JavaScript and Apps that typically hide the fact you are becoming an endpoint in the T&Vs. Straight up illegal ones use compromised computers and routers like you'd think.
zxcvbn4038 5y ago
I’ve always been curious how the residential proxies work. Is someone going around paying people to run proxies in their home? Are these compromised devices being exploited? Are there a bunch of storage units someplace with cable service? The mind runs wild.

nebula8804 5y ago

This seems like a lot of effort? What do you think was the motivation for something like this on your site?

morenoh149 5y ago
The cynical answer is backlinks haha