0

I have a growing list of blocked IP addresses on my Drupal 7 site. I've installed the following modules: Honeypot, Captcha questions, Captcha, reCaptcha, and Hidden Captcha. They all work fine and there are no more bogus users or posts created but there are still a lot of bots that try to intrude with scripts. Is there something I can do with the collected IP addresses from this path: admin/config/people/ip-blocking to help perhaps others or the community as well?

  • I know your intentions are good, but how can one trust a random person over the internet with an IP list? It's ok, don't worry about it, others will block the them, should they be attacked by those same IPs, with their own Captcha or whatever. – No Sssweat Feb 11 at 23:47
  • @NoSssweat I agree that it's difficult to trust people that have a list of IPs that they claim to be spam bots. Would there be a way to prevent them to try to access certain paths by adding a few lines in the robots.txt files? Looking at admin/reports/dblog it appears that they usually post things like example.com/user/register/…. So I was thinking that perhaps it can keep my site safer AND prevent them to put any load on my site. Do you think that would be possible? – BassPlaya Feb 12 at 0:08
  • 1
    Robots.txt is only for those good bots that choose to follow it, bad bots can easily choose to ignore it and not follow it. You could look into using the Restrict IP module if you really want to block them from loading pages. – No Sssweat Feb 12 at 6:19
  • What to do with that list? Maybe feed them to some server-side blocking like Apache's mod_security or similar so that they get blocked before they even hit Drupal at all. – leymannx Feb 12 at 10:47
1

We've all been there and felt that.

This is time consuming. You could report the abuse to the abuse@domain.xyz email by looking up the Whois record for each IP. This email address and investigation are required by ...

The 2013 Registrar Accreditation Agreement (RAA) requires ICANN-Accredited registrars to provide abuse contact information and take steps to investigate reports of abuse. This includes:

Maintaining an abuse contact to receive abuse reports involving domain names sponsored by the registrar, including reports of illegal activity, and publishing an email address to receive reports on the home page of the registrar's website;

Taking reasonable and prompt steps to investigate and respond appropriately to any reports of abuse;

Establishing and maintaining a dedicated abuse point of contact to receive reports of illegal activity filed by law enforcement or other similar authorities designated by the government of the jurisdiction in which the Registrar is established or maintains a physical office. The registrar should review such reports within 24 hours of submission. This includes a dedicated email address and telephone number that is monitored 24 hours a day, seven days a week;

Publishing on the registrar's website a description of its procedures for the receipt, handling, and tracking of abuse reports; and

Providing an abuse email address and telephone number in Whois results.

The full abuse contact requirements are provided in Section 3.18 the 2013 RAA.

CleanTalk.org and abuseipdb.com will accept the IPs and emails you find as spam. One at a time though so start with the biggest offenders.

When you sent a report, the IP or Email address with malicious activity will be added in our blacklist database with status "Suspicious". If we will receive other abuse reports so the status will be changed to BlackListed.

Spamcop.net will take spam emails you find then sends "warning information to the internet service provider responsible for hosting the services used by the spammer (web sites and email sending sites)."

Rather than "a growing list of blocked IP addresses", have you considered blocking by country or region or IP range? You can do that through the .htaccess file or Drupal modules.

I hope this gets you started in your crusade for a better world.

| improve this answer | |
  • Wow! Thorough! Much apperciated, @Saj ! I actually don't want to block IPs by country because I believe that anyone should be able to use my services but it's something I should definitely consider. – BassPlaya Feb 13 at 22:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.