"Manually approve registration if user shares IP used by a banned or rejected user in last" not always working

[420]

Affected version

2.2

We have the following setting set to 30 days:

Manually approve registration if user shares IP used by a banned or rejected user in last: 30 days



All of the IP addresses logged in the admin panel have timestamps before the ban.

As you can see, spammers are still signing up and they aren't going into the Approval Queue.

We use the spam cleaner to ban these spammers.

Spam trigger log shows that there are some spam accounts being moved to the approval queue:

Action: Moderated Shared IP with banned users (XXXXXXXXXX)

But some (like in the screenshot above) are slipping through.

 

[Chris D]

What were the registration dates of each of these users, and the dates that each of them were banned?

 

[420]

What were the registration dates of each of these users, and the dates that each of them were banned?

dlkaponz
Joined Jul 8, 2022
Ban started: Jul 8, 2022

lslmabzm
Joined Jul 19, 2022
Ban started: Jul 19, 2022

wnakwns
Joined Jun 27, 2022
Ban started: Jun 27, 2022

 

[420]

@Chris D any update?

Thanks

 

[420]

A year later, any update on this guys?

 

[Dragonfruit]

A year later, any update on this guys?

I know this may not be the most ideal solution, but @Xon 's addon seems like it could solve this:

Signup abuse detection and blocking

From (simple) multiple accounts detection to isp/connection fingerprinting with score-based moderating/rejecting logic. These are very effective low-hanging fruit at reducing spam. Supports migration configuration from the following XF1 add-ons...

xenforo.com

It has an option set Multi-Account detections to Moderate.

 

[Xon]

I know this may not be the most ideal solution, but @Xon 's addon seems like it could solve this:

Signup abuse detection and blocking

From (simple) multiple accounts detection to isp/connection fingerprinting with score-based moderating/rejecting logic. These are very effective low-hanging fruit at reducing spam. Supports migration configuration from the following XF1 add-ons...

xenforo.com

It has an option set Multi-Account detections to Moderate.

You want to avoid using only ip matching for the multi-account detection as it'll spam logs because shared IPs are very common.

But some (like in the screenshot above) are slipping through.

They probably used a separate IP on signup and then the same IP when viewing the page. So they didn't really slip through the registration checks, but in practice they did.