We’ve got a deranged person who is using proxies, fake emails etc. to bomb our site with the products of his paranoia. He’s clearly getting a lot of gratification out of being deleted for “censorship” and coming back with a new sock-puppet ID within a day or less. And he has escalated to making violent threats against moderators in personal messages. We’ve tried most of the obvious things, but they aren’t that hard to get around if you’re determined and motivated by misplaced revenge fantasies.
He’s using various IPs, but one commonality is that they all map to something called “HERN Labs AB” in the Netherlands. So far as we can determine, no other users are associated with that IP. Most of them are in a range around this IP 2001:67c:198c:906:2::256.
Is there a way to blacklist HERN Labs AB by name?
I tried using a wildcard (*) to block the range of IPs rather than the specific one he’s using (which always changes). I’ve read that it’s possible to do this in Discourse, but when I’ve tried it, it doesn’t seem to work. Similarly with trying to search on the suspect IP in the users list using a wildcard, to see if there are any other similar accounts lurking—that doesn’t seem to work either.
We’ve alerted our legit users that they can instantly hide his posts by flagging them as Spam, which seems to be helping a bit.
We’re keeping an eye on the New Users list and silencing any suspicious looking accounts that pop up, but we’re volunteers, so tightening up the automated solutions would be preferable.
Any other suggestions? I assume he’ll get bored eventually but it could be a long time as he really seems to be getting off on the whole whackamole game. Makes him feel clever. And the violent threats indicate a level of demented determination that he isn’t easily going to give up on. We’d appreciate answers to any of the above or suggestions of things we may not have thought of.
In Admin / Logs / Screened IPs you can make a Block rule for 2001:67c:198c:906::/64 - that’ll block anything on the local network he’s using.
If you want to block HERN Labs entirely, you could instead block 2001:67c:198c::/48, but the wider you get the more chance you have of hitting a legitimate user.
○ → whois 2001:67c:198c:906:2::256
% This is the RIPE Database query service.
% The objects are in RPSL format.
…
inet6num: 2001:67c:198c::/48
netname: HERNLABS
…
I may not be much help because I’m only familiar with IPv4 not IPv6. Anyway, AFAIK the header search finds IPs as a substring match but the Admin User searches use “subnet masks”. You can still search by wildcard in a way, but by bits. eg. 123.123.123.0/24 will match IPs 123.123.123.0 to 123.123.123.255
Yes, that’s why we’re also considering maybe a more social-engineering approach to hopefully deprive him of some of the emotional payoff he’s seeking as well. His great claim is that we’re “censoring” him by this treatment because we don’t want to hear what he’s saying (apparently we’re an astroturf op for Big Pharma, who knew?). Whereas in reality LOTS of members bring up the exact issues he’s exercised about, but they discuss them intelligently rather than scream and shout and break things. And the community easily sees through the sock-puppet accounts to realize it’s obviously the same guy. But he’s using this behavior to cast himself as the hero of his own fantasy epic. So one thought I had was to just freeze one of his posts, lock out further comments and silence the account, but leave the post visible, with one single comment from admin explaining the situation. Here’s what the guy has to say, so read it and be impressed—or not—and understand that the reason he keeps getting banned is because of sockpuppeting, abuse, threats against staff and the rest. My thought is to PIN that post at the top of the forum for a week so he knows everyone can see it, undermining his claim about censorship and depriving him of the hero role he craves.
But meanwhile, if we could also narrow his access to the forum by technical means that would help too.
That’s really helpful, @JimPas. We’ll try contacting their abuse line. Trolling is one thing, but this guy is making physical threats, and he’s been consistently running his junk through Hern Labs.
قد يتطلب الأمر بعض التعديلات لتعمل، لكن يمكنك أيضًا تجربة إضافة الحظر الظلي. بهذه الطريقة، لن يكون لديه أي رد فعل بشأن حظره حتى يدرك أنه لا يتلقى أي ردود، مما يجعل الفترات بين عمليات التسجيل أطول.
لنكن واقعيين، لا يبدو من الممكن منع شخص ما تمامًا من التسجيل مرة أخرى في منتداك باستخدام اسم مستخدم أو معلومات أو عنوان IP أو متصفح مختلف، وربما حتى جهاز مختلف.
قد يعمل الحظر الظلي لفترة قصيرة، لكن عاجلاً أم آجلاً، سيكتشف على الأرجح ما يحدث. وعندها، سيفقد فاعليته، إذ سيصبح على علم بالأمر.
الأفضل الذي أراه هو التحدث معه فعليًا وإيجاد حل معه. على سبيل المثال، لماذا لا نمنحه حق الوصول إلى موضوع واحد فقط (موضوعه الشخصي)، بحيث يمكن لأي شخص بعد ذلك كتمه بسهولة إذا أراد (أو ربما لا. الخيار لهم. بل يمكنهم متابعة الموضوع والتفاعل معه إذا رغبوا). قد يكون هذا حلاً مقبولًا للطرفين، وسينهي الأمر معه إلى الأبد، وفي الوقت نفسه لن يكون قد خُضع للرقابة ولن يتمكن عمليًا من الادعاء بذلك بعد الآن.
(لا أعرف ما إذا كان من السهل تقييد شخص ما بموضوع واحد فقط. آمل أن يكون ذلك ممكنًا)
هذا يتوافق مع نهج الهندسة الاجتماعية الذي كنت أفكر فيه، نعم. لم ينجح التعامل معه مباشرةً—فهو لا يفرغ سوى السم ويهدد بالعنف الجسدي. لكننا نسمح لمنشور واحد منه بأن يكون ممثلاً للنقطة التي يريد إيصالها، دون السماح بمناقشته لأنه لا يؤدي إلا إلى المواجهة والإساءة إلى الأعضاء الآخرين.
في الوقت الحالي، هو صامت. هناك احتمال (بناءً على ما نشره عن نمط حياته وظروفه الحالية) أنه قد سُجن. وهذا سيكون مقبولاً بالنسبة لنا.
