# Spammers signing up from "blocked" IP addresses
**URL:** https://meta.discourse.org/t/spammers-signing-up-from-blocked-ip-addresses/29258
**Category:** Support
**Created:** [May 26, 2015, 10:39am UTC](https://meta.discourse.org/t/spammers-signing-up-from-blocked-ip-addresses/29258 "2015-05-26T10:39:32Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@TechnoBear](https://meta.discourse.org/u/TechnoBear)
#### Post date: [May 26, 2015, 10:39am UTC](https://meta.discourse.org/t/spammers-signing-up-from-blocked-ip-addresses/29258/1 "2015-05-26T10:39:32Z")
I’m not sure if this is a 🐛, or simply me being confused, so I’ve posted here for now.
We have this in our “screened IPs” log:
But yesterday we had around 10 Spammers sign up and post from addresses in that block - 61.249.128.161, 61.249.128.51, etc.
So who has the problem - me or the system?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 26, 2015, 10:11pm UTC](https://meta.discourse.org/t/spammers-signing-up-from-blocked-ip-addresses/29258/2 "2015-05-26T22:11:45Z")
Via SSO? Possibly, @eviltrout can you ensure no regressions here?
Also what version of the code are you on?
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [May 26, 2015, 10:29pm UTC](https://meta.discourse.org/t/spammers-signing-up-from-blocked-ip-addresses/29258/3 "2015-05-26T22:29:16Z")
Doubtful, to my knowledge we do not have SSO implemented. ping @santouras, @jasmine, @ophelie
---
### Author:  [@TechnoBear](https://meta.discourse.org/u/TechnoBear)
#### Post date: [May 27, 2015, 9:29am UTC](https://meta.discourse.org/t/spammers-signing-up-from-blocked-ip-addresses/29258/4 "2015-05-27T09:29:44Z")
> [@codinghorror](#):
>
> Also what version of the code are you on?
1.3.0.beta7 (which answers the question but isn’t 20 characters).
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [May 27, 2015, 2:53pm UTC](https://meta.discourse.org/t/spammers-signing-up-from-blocked-ip-addresses/29258/5 "2015-05-27T14:53:44Z")
I tested that the blocking code is matching that IP:
```ruby
ScreenedIpAddress.should_block?('61.249.128.161')
=> true
```
Also I blocked my own IP using the same range (/24) and was not allowed to create an account or sign up.
They have clearly found a way to create accounts that is not following the same flow. I’m still investigating.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [May 27, 2015, 3:02pm UTC](https://meta.discourse.org/t/spammers-signing-up-from-blocked-ip-addresses/29258/6 "2015-05-27T15:02:58Z")
> [@TechnoBear](#):
>
> But yesterday we had around 10 Spammers sign up and post
I found all the users but it looks like none of them posted. Can you perhaps PM me the username of one of them who posted?
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [May 27, 2015, 3:12pm UTC](https://meta.discourse.org/t/spammers-signing-up-from-blocked-ip-addresses/29258/7 "2015-05-27T15:12:04Z")
PM sent. (and more characters to meet the threshold)
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [May 27, 2015, 5:06pm UTC](https://meta.discourse.org/t/spammers-signing-up-from-blocked-ip-addresses/29258/8 "2015-05-27T17:06:07Z")
Wow, that was tedious but I figured out what happened!
The good news is blocking is indeed working as expected. I checked the server logs for the users who created accounts and they just used the normal flow. I reviewed the code and tested it myself and the blocking is working.
So how did they get in?
Well that rule you found is actually an automatic roll up. Our server runs a background job that identifies many banned ips from the same subnet. If it reaches a threshold `min_ban_entries_for_roll_up`, it will automatically ban the subnet.
I found a log that this exact operation happened on May 25th. So Discourse was smart enough to ban them from coming back, but it wasn’t clear that the rule was a rolled up rule that was added _after_ they signed up.
---
### Author:  [@TechnoBear](https://meta.discourse.org/u/TechnoBear)
#### Post date: [May 27, 2015, 5:07pm UTC](https://meta.discourse.org/t/spammers-signing-up-from-blocked-ip-addresses/29258/9 "2015-05-27T17:07:16Z")
Thanks, @eviltrout - that makes sense.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [May 27, 2015, 5:09pm UTC](https://meta.discourse.org/t/spammers-signing-up-from-blocked-ip-addresses/29258/10 "2015-05-27T17:09:48Z")