The discussion revolves around implementing IP-based spam checks during user signup to combat spam, particularly from Tor exit nodes and known malicious IPs. brodock suggests using Project Honeypot for distributed, effective checks, while codinghorror supports signup-time checks as an inexpensive and effective measure. geek agrees, noting that for a tech forum, Tor usage is generally unnecessary. codinghorror provides a list of services to check IPs against, including Spamhaus, Spamcop, Project Honeypot, Stop Forum Spam, and Tor status databases. He also highlights a potential issue: users signing up via email providers like Facebook or Google gain immediate access, bypassing approval. The thread includes a template for logging lookup results, with examples showing various IP addresses and their status across the listed services. codinghorror clarifies that PBL (Policy Block List) hits are not relevant for this context, as they indicate home IPs, not spam activity.
Why do that, when you can use “Project Honeypot”, that does it in a much better, distributed way.
We can also check IP address during the registration, to require admin approval:
The best part is that you do all the checks with simple DNS requests that will be cached by your DNS provider.
I’m sorry for not suggesting this first (I just came around it a few days ago). @codinghorror, do you think this can be added?
Checks at the time of account creation I am definitely in favor of, that is a very inexpensive time to do checks.
edit: I don’t know if this would help with the original problem, which was about spam accounts created using Tor exit point IPs, but I think it is a good idea in general.
Love it. That would definitely solve the problem for just about everybody.
I would not expect account creation checks to be a silver bullet, but it might reduce some signups that are questionable. It’s a game of percentages.
For a tech forum there’s virtually no reason for anybody to be using Tor anyway.
I understand the reason for needing Tor and allowing people to exercise their free speech in oppressive countries and speak out without getting persecuted… it just doesn’t apply to a lot of forums, and anybody signing up for my forum using Tor is probably trying to do something they shouldn’t.
Just throwing in some more signup time ip checks that @downey recommended
I guess reaching a threshold with account signup checks would force the account into manual approval queue, which we already have. Might be kind of annoying to have several of these accounts appear every day in your queue though, when you don’t normally approve new accounts.
Just summarizing for @techapj who is going to experiment with doing these checks and logging the results, here are the services to check new user signup IPs against:
Interestingly, this may present a problem.. if a user logs in from a validated email service, say, Facebook or Google, they don’t have to wait for an email with a link to have a valid account, they have a valid account immediately after signing up and can begin posting – subject to standard new user sandbox rate limits, of course.
It’s almost like you can’t really approve someone’s account until you hear back from these ~5 different services, to know if the user account should be put in a manual approval queue first.
Well, anyway, @techapj will experiment with doing these checks at signup time, see how long they take, and log the results behind the scenes. No user-facing UI or outcome yet.
(The other potential problem is users who sign up for a new user account from a “good” IP and then switch to an “evil” IP later. Not sure how realistic that is, though..)
edit: we are putting this on hold for a bit as the last few live spammer IPs we checked against these 5 lists had basically zero hits across all lists 
. We’ll continue to spot check live spammer IPs against the 5 lists above, but it isn’t looking so good as a “magic bullet” to prevent spammers from signing up at this point.
This wiki reply will contain the result of manual spammer lookups by IP against the above lists.
Copy this template as you do lookups and edit the results.
Don’t list PBL hits.. that’s meaningless. It just means the IP is a “home” computer and shouldn’t be running a mail server or sending mail. But posting a message on Discourse is not sending an email, that’s just using a web browser, which a home IP address can definitely be doing.
http://www.spamhaus.org/pbl/query/PBL1546707
This IP address range has been identified by Spamhaus as not meeting our policy for IP addresses permitted to deliver unauthenticated ‘direct-to-mx’ email to PBL users.