New to the community? Start here

Anti-Splog – Feature Request – Could it be so much more?

0

A harsh step to take but I would like to see some geo IP blocking, banning, suspending, etc….

Most of our spam comes from China, I have no business in China, if all of their traffic was dropped it would stop a lot of spam and save some bandwidth.

There are various methods to achieve this I know.

I saw a recent plugin which helps control content per country: http://pranavrastogi.com/projects/plugins/gt-geotargeting/ Perhaps something similar can be achieved on a global scale?

Another interesting link: http://www.howtodowebmarketing.com/2011/02/08/geo-targeting-for-wordpress-part-1-of-3/

I’d also like to recommend you take a look at a plugin which I use on ImpressCMS, just for some ideas, it helps handle some attacks as to strengthen security:

http://xoops.peak.ne.jp/md/mydownloads/singlefile.php?lid=105&cid=1&easiestml_lang=xlang%3Aen

Anti splog could be so much more!

Protects from various kind of attacks like:

– DoS

– Bad Crawlers (like bots collecting e-mails…:wink:

– SQL Injection

– XSS (not all though)

– System globals pollution

– Session hi-jacking

– Null-bytes

– Directory Traversal

– Some kind of CSRF (fatal in XOOPS <= 2.0.9.2)

– Brute Force

– Camouflaged Image File Uploading (== IE Content-Type XSS)

– Executable File Uploading Attack

– XMLRPC’s eval() and SQL Injection Attacks

– SPAMs for comment, trackback etc.

It records into its log.

This could help defend against poorly coded themes and plugins, F5 attacks (bruteforce), etc, etc.

As a side question, what do all you guys do? Tolerate it? Block it? Something else?

Yeah so as a feature request, could Anti-Splog be more?

Mon, 4 Apr 2011 23:59:12
  • Aaron
    • Ex Staff

    geo IP blocking

    That is one I plan to implement in the API, optional of course.

    There are also a number of other behind the scenes API checks i’m currently testing. The goal is to improve our accuracy at the signup point before they even get to posting (which is already very effective).

    All that other stuff is security related and would belong in the domain of a different plugin. Though i’m in the camp that those are more webserver level checks.

  • Timothy
    • Chief Pigeon

    I just saw at least the brute force, f5, DOS a as way to prevent inhuman activity on a site which is not only a trait of a hacker but also a spammer/software.

    I know some of the other stuff can be server related (if the user has some control over that aspect) and it could also be another plugin. I was merely asking if anti-splog could be more. I see this isn’t what you envisage.

    Some of the other stuff could have potentially helped against insecure plugings and themes. I understand though.