IP block 216.255.183.236-216.255.183.238

dotSilver Network Partner Support Forum / Protection from scam / IP block 216.255.183.236-216.255.183.238

Author	Message
DiegoGarcia Member	Posted: 25 Dec 2006 01:20:01 Block this ip block. This is an HTTP proxy server set up and used by Russian scammers to send emails from free email servers. E.g. if they send an email from a yahoo account you may get this in the Received field: Received: from unknown (HELO 10.123.1.4) (scannersaccount@216.255.183.236 with plain) Ironically, I was born in Ukraine and got into this scam.
.silver Admin	Posted: 25 Dec 2006 23:58:45 Hi DiegoGarcia, How exactly should these IPs be blocked? At registration, at login or at site entrance? These are the USA IPs. Regards
DiegoGarcia Member	Posted: 26 Dec 2006 13:01:54 Hi! Actually, the block is a bit larger. 216.255.183.234-216.255.183.238 If you block at registration, the existing accounts will still be able to scam other users. So I'd block them from logging in. However, if they got a victim email address, there is almost nothing you can do to stop them (except using an extensive email filter that looks through all email headers - I don't know any though, but I believe they exist). > These are the USA IPs. That's right. They did it so that their emails would look like they are coming from within the USA. This gang does use 'The Bat!'. Also I should mention this. This block hosts not only HTTP proxy, but also SOCKS4 and SOCKS5 proxy servers that are used to send emails. All proxy servers and an HTTP server are using port 80. If you try to access one of these IPs, they will return WIN1251 encoding, which is obviously one of Russian encodings, not to mention a bunch of russian counters. I also should warn that this may be not only InterCage block with proxies. - DG
.silver Admin	Posted: 28 Dec 2006 05:10:24 Hello DiegoGarcia, If we block these IPs, most of the USA members will not be able to login. But we look through carefully all profiles and scam profiles are eliminated from our site. That's why we will not block these IPs now. But anyway thank you, DiegoGarcia, for your assistance and cooperation! Happy New Year!
DiegoGarcia Member	Posted: 28 Dec 2006 10:56:39 - Edited by: DiegoGarcia .silver, If we block these IPs, most of the USA members will not be able to login. But we look through carefully all profiles and scam profiles are eliminated from our site. Are you saying that most of your USA members going through this farm of proxies ?? The probability of the fact that most of users of the country with 300M residents will login through a proxy server farm with 5 IP addresses is extremely low. If you get your registrations mostly from these IPs, you are getting scammers, who pretend they are from the USA. For example, This nice lady states she is from the US http://www.dotsilver.com/dating-scam/2006-december/7127.html The fact is she is from Russia. She sends her emails and browses the Internet through these IPs. I have a proof. Whether to block this IP range or not to block is absolutely your call. I truly believe, that users registered from these IPs are scammers. Regular users have no point to hide their identity behind a proxy server. Happy holidays! - Diego