7

I run a large bulletin board and I get spammers every now and again. My moderation team does a good job filtering them out but every time I IP ban them they seem to come back (I'm pretty sure it's the same person on some occasions, as the post patterns are exactly the same as are the usernames) but I'm afraid to ban them by IP address every time.

If they are on a dynamic IP address, I could be banning innocent users later down the line when they try to get to my forum through SERPs, but if I ban only via static IPs I know that I'm only banning that one person.

So, is there a way to properly determine if an IP address is static or dynamic?

Thanks.

6 Answers6

10

static vs. dynamic is a policy applied by the owner of the IP block. There's no way to determine this reliably unless you have physical access to the IP owner network and can query their DHCP server.

Franci Penov
  • 1,148
  • 7
  • 7
  • 1
    Sure you can. DNS blocking lists have been gathering data on netblocks with dynamically-assigned addresses for years. See my answer below. – Gerald Combs May 18 '10 at 20:27
  • Those lists give you a "most probably" type of answer. But the owner of the IP block is free to change their policy at any given moment in time. Just because today an IP address was dynamic, does not mean tomorrow it won't change to static. – Franci Penov Jun 24 '10 at 11:26
4

You could use one of the many DULs (Dialup User Lists). For example,

$ host -t a 1.247.246.70.dul.dnsbl.sorbs.net
1.247.246.70.dul.dnsbl.sorbs.net has address 127.0.0.10

indicates that 70.246.247.1 is in a dynamically-assigned range.

Gerald Combs
  • 6,331
  • 23
  • 35
  • I could've sworn that one of MaxMind's GeoIP databases (http://www.maxmind.com/app/geolocation) had a "dynamically assigned" field but that doesn't appear to be the case. – Gerald Combs May 18 '10 at 20:26
2

No, you can't tell if an IP address is static or dynamic. Any time you IP ban a user, you run the risk of banning legitimate users.

If the IP addresses are from out of country, especially from a region that you aren't targeting demographically, I say block away.

If you can prevent automation, that will help a lot in fighting spam, at least enough for your moderators to keep up.

Make sure that you are using the nofollow link attribute when displaying user posted links. This will prevent the spammers from improving their SEO scores in the time it takes to delete the messages.

Many BBs allow you to specify that the user can't post any links until they've posted a minimum number of messages.

Marcus Adams
  • 150
  • 4
0

You can try to do DNS resolve the ip address and see if it match some terms which identify the IP as a dynamic (adsl, cable, dialup, dyn) or static (static, server, biz).

Pipe
  • 191
  • 3
0

You cannot actually be sure that the IP is dynamic or not, but normally your board engine will unban an IP after a certain period of time, to allow innocent person.

So you can ban an IP without fear, the function is there only to slow down the spammer. If he cannot post in 24 hour he will normally not coming back.

Gopoi
  • 547
  • 5
  • 21
-2

Just use PsEXec.exe tool inside your CMD. Here's how:

PsExec.exe \\remotecomputer ipconfig /all

Once IPConfig /all is returned inside your CMD it'll tell you if DHCP Enabled is set to Yes or No on that remote PC. Easy as 1.2.3.

Cory Knutson
  • 1,866
  • 12
  • 20
NileS
  • 1
  • 1
    That only works for machines on the local network which you have admin rights on -- which clearly isn't the case in the situation the OP described. –  Jun 22 '17 at 20:53