Bitcoin Forum
May 08, 2024, 08:09:42 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: « 1 2 3 4 5 6 7 8 9 10 11 [12] 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 »
  Print  
Author Topic: [Updated 19/Jul/2016] Faucet Owners Against Scammers and Bots  (Read 36626 times)
akela11
Newbie
*
Offline Offline

Activity: 15
Merit: 0


View Profile
October 19, 2015, 01:11:30 AM
 #221

Thanks a Lot @misterbit  Code added.





Friend I think that you should raise the degree of difficulty of funcaptcha, and also cancel the enter this key.

Code:
<form method="POST">

change to
Code:
<form method="POST" onkeypress="if(event.keyCode == 13) return false;">

and put in the <body> in the footer for example
Code:
<script type="text/javascript">function disableEnterKey(e){
var key;
if(window.event){
key = window.event.keyCode; //IE
}else{
key = e.which; //firefox
}
if(key==13){
return false;
}else{
return true;
}
}</script>

Now tell me how many visitors does your website?
Thus you could calculate the amount of satoshi, for example 400 satoshi by 3000 would be 1200000 satoshi


Sad  Ii happen again

My faucet was dried in two times in two days, (.01 Btc each) and te earnings in adSense are too slow Sad

I'm not skiled in programming but i'm thinking how to reduce damage from that bots without blocking Smiley

I'think we can analize IP's and wallet adresses from the FoucetBox DB, and see all that you guys commented before and when some of those adresses came we can modify the amount of satoshis they get to 1 each time, same to referrals...

please tell me if this is a good idea.

thanls in advance,
The trust scores you see are subjective; they will change depending on who you have in your trust list.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
1715198982
Hero Member
*
Offline Offline

Posts: 1715198982

View Profile Personal Message (Offline)

Ignore
1715198982
Reply with quote  #2

1715198982
Report to moderator
Alric01
Newbie
*
Offline Offline

Activity: 1
Merit: 0


View Profile
October 19, 2015, 06:45:28 AM
 #222

Hi its no more easy only blocked all ips from vps and dedicate server. beceause all scammer use vps and dedicated server???
NeedIfFindIt
Full Member
***
Offline Offline

Activity: 500
Merit: 100



View Profile
October 19, 2015, 09:31:35 AM
 #223

@NeedIfFindIt

Hello dude, my faucet was removed from his rotator. I do not understand why.

I just write an email.

My faucet is: http://freebtsocean.com/

Sorry, yesterday I responded to over 120 messages.

For some reason the anti-proxy code blocks also non-proxies that have open ports.
http://getipintel.net/ actually tracks IPs with multiple open ports.
Just think about simple IM like Skype opens 2 ports (one of them is port 80) if you have 3 PCs at home = 4 open ports by Skype. If you add one or two torrent clients and a VNC = 8 open ports in total. And you are already in the 0.99+ club.

For now I would suggest using
Code:
$banOnProability=0.99999;

instead of

Code:
$banOnProability=0.99;

I tested with free proxy list and it still works for 95%+ of the addresses.

Also find a way to cache the IPs since getipintel.net allows up to 1000 requests/day.

Code:
<?php
//if(@fsockopen($_SERVER['REMOTE_ADDR'], 80, $errstr, $errno, 1))
//die("It would apprear you're using a proxy, so please, go f* yourself!");

function checkProxy($ip){
/*
                /// Uncomment to allow bit.makejar.com autochecker
if ($ip=='188.166.12.134') {
                  return false;
                }
                //
*/
$contactEmail="EMAIL";
$timeout=3
// $banOnProability=0.99;
                
$banOnProability=0.99999;// <---------------------------------------------------

$ch curl_init();
curl_setopt($chCURLOPT_RETURNTRANSFER1);
 
curl_setopt($chCURLOPT_TIMEOUT$timeout);
curl_setopt($chCURLOPT_URL"http://check.getipintel.net/check.php?ip=$ip");
$response=curl_exec($ch);

curl_close($ch);


if ($response $banOnProability) {
return true;
} else {
if ($response || strcmp($response"") == ) {
//The server returned an error, you might want to do something
//like write to a log file or email yourself
//This could be true due to an invalid input or you've exceeded
//the number of allowed queries. Figure out why this is happening
//because you aren't protected by the system anymore
//Leaving this section blank is dangerous because you assume
//that you're still protected, which is incorrect
//and you might think GetIPIntel isn't accurate anymore
//which is also incorrect.
//failure to implement error handling is bad for the both of us
}
return false;
}
}
$ip=$_SERVER['REMOTE_ADDR'];
if (
checkProxy($ip)) {
echo "It would apprear you're using a proxy, so please, go f* yourself! <br />";
}
?>

Aratrok
Newbie
*
Offline Offline

Activity: 42
Merit: 0


View Profile
October 19, 2015, 01:21:56 PM
 #224

Greetings.

I just add the code and see how it goes.

One question, I have to erase this // $ banOnProability = 0.99;

And leave alone this? $ banOnProability = 0.99999;

Code:
<?php
//if(@fsockopen($_SERVER['REMOTE_ADDR'], 80, $errstr, $errno, 1))
//die("It would apprear you're using a proxy, so please, contact us: support@freebtsocean.com!");

function checkProxy($ip){
/*
                /// Uncomment to allow bit.makejar.com autochecker
if ($ip=='188.166.12.134') {
                  return false;
                }
                //
*/
$contactEmail="support@freebtsocean.com";
$timeout=3
// $banOnProability=0.99;
                
$banOnProability=0.99999;// <---------------------------------------------------

$ch curl_init();
curl_setopt($chCURLOPT_RETURNTRANSFER1);
 
curl_setopt($chCURLOPT_TIMEOUT$timeout);
curl_setopt($chCURLOPT_URL"http[Suspicious link removed]c($ch);

curl_close(
$ch);


if (
$response > $banOnProability) {
return true;
} else {
if (
$response < 0 || strcmp($response, "") == 0 ) {
//The server returned an error, you might want to do something
//like write to a log file or email yourself
//This could be true due to an invalid input or you've exceeded
//the number of allowed queries. Figure out why this is happening
//because you aren't protected by the system anymore
//Leaving this section blank is dangerous because you assume
//that you're still protected, which is incorrect
//and you might think GetIPIntel isn't accurate anymore
//which is also incorrect.
//failure to implement error handling is bad for the both of us
}
return false;
}
}
$ip=$_SERVER['REMOTE_ADDR'];
if (checkProxy(
$ip)) {
echo "
It would apprear you're using a proxy, so please, contact us: support@freebtsocean.com! <br />";
}
?>
rkandrades (OP)
Sr. Member
****
Offline Offline

Activity: 392
Merit: 251


Bitcoin Faucet & Blog


View Profile
October 19, 2015, 02:04:04 PM
 #225

Greetings.

I just add the code and see how it goes.

One question, I have to erase this // $ banOnProability = 0.99;

And leave alone this? $ banOnProability = 0.99999;

Code:
<?php
//if(@fsockopen($_SERVER['REMOTE_ADDR'], 80, $errstr, $errno, 1))
//die("It would apprear you're using a proxy, so please, contact us: support@freebtsocean.com!");

function checkProxy($ip){
/*
                /// Uncomment to allow bit.makejar.com autochecker
if ($ip=='188.166.12.134') {
                  return false;
                }
                //
*/
$contactEmail="support@freebtsocean.com";
$timeout=3
// $banOnProability=0.99;
                
$banOnProability=0.99999;// <---------------------------------------------------

$ch curl_init();
curl_setopt($chCURLOPT_RETURNTRANSFER1);
 
curl_setopt($chCURLOPT_TIMEOUT$timeout);
curl_setopt($chCURLOPT_URL"http[Suspicious link removed]c($ch);

curl_close(
$ch);


if (
$response > $banOnProability) {
return true;
} else {
if (
$response < 0 || strcmp($response, "") == 0 ) {
//The server returned an error, you might want to do something
//like write to a log file or email yourself
//This could be true due to an invalid input or you've exceeded
//the number of allowed queries. Figure out why this is happening
//because you aren't protected by the system anymore
//Leaving this section blank is dangerous because you assume
//that you're still protected, which is incorrect
//and you might think GetIPIntel isn't accurate anymore
//which is also incorrect.
//failure to implement error handling is bad for the both of us
}
return false;
}
}
$ip=$_SERVER['REMOTE_ADDR'];
if (checkProxy(
$ip)) {
echo "
It would apprear you're using a proxy, so please, contact us: support@freebtsocean.com! <br />";
}
?>

An other alternative way is to set the parameter &flags=m in the getipintel URL query. In this case you will turn off the algorithm which indentify not listed proxyes.

The GetIPIntel owner tolds me that algorithm gives about to 10% of your incoming traffic as false positives. Turning it off and just using the blacklisted proxies, He tolds me the false positives index decreases to 1%.

I'm using this way and getting good results. See an example of the code:

Code:
http: //check.getipintel.net/check.php?ip=$ip&contact=$contactEmail&flags=m

Bitcoin█████████████████████████
█████████████████████████████
███████████████████████████████
█████████████████████████████████
██████████████████████████████████
███████████████████████████████████
███████████████████████████████████
█████████████████████████████████████
█████████████████████████████████████
█████████████████████████████████████
████████████████████████████████████
███████████████████████████████████
███████████████████████████████████
██████████████████████████████████
████████████████████████████████
██████████████████████████████
████████████████████████████
██████████████████████████
atcher.
███
███
███
███
███
███
███
███
███
███
███
███
███
███

══════════════════════════════════════════════════════════════
  FaucetFREE BTCitcoin RewardsBlogLearn about Finance, Economics and Bitcoin
══════════════════════════════════════════════════════════════

███
███
███
███
███
███
███
███
███
███
███
███
███
███

NeedIfFindIt
Full Member
***
Offline Offline

Activity: 500
Merit: 100



View Profile
October 19, 2015, 03:19:23 PM
 #226

Code:
// ABC

and

Code:
/*
ABC
*/

means commented out (non-active).

I've made non active the:
Code:
//if(@fsockopen($_SERVER['REMOTE_ADDR'], 80, $errstr, $errno, 1))
//die("It would apprear you're using a proxy, so please, contact us: support@freebtsocean.com!");
because it is plainly wrong.

I've copied and edited:
Code:
$banOnProability=0.99;

to

Code:
$banOnProability=0.99999;

But also left the original (for comparison).

Also added commented-out (inactive) example how to "whitelist" someone.
btcsharehub
Sr. Member
****
Offline Offline

Activity: 455
Merit: 250

EarnBitcoins.INFO


View Profile WWW
October 19, 2015, 04:50:38 PM
 #227

o..k..
Am I the only one who doesn't understand a word that's being written here?

misterbit
Sr. Member
****
Offline Offline

Activity: 350
Merit: 250



View Profile
October 19, 2015, 05:14:30 PM
 #228


Code:
// ABC

and

Code:
/*
ABC
*/

means commented out (non-active).

I've made non active the:
Code:
//if(@fsockopen($_SERVER['REMOTE_ADDR'], 80, $errstr, $errno, 1))
//die("It would apprear you're using a proxy, so please, contact us: support@freebtsocean.com!");
because it is plainly wrong.

I've copied and edited:
Code:
$banOnProability=0.99;

to

Code:
$banOnProability=0.99999;

But also left the original (for comparison).

Also added commented-out (inactive) example how to "whitelist" someone.

Friend thank you for your help, is there any way to do it without getIPIntel?
that to my it has stopped me working, does not block any proxy?
LosingAlpha
Full Member
***
Offline Offline

Activity: 189
Merit: 100


View Profile WWW
October 19, 2015, 05:28:03 PM
 #229

Quote
I've copied and edited:
Code:
$banOnProability=0.99;

to

Code:
$banOnProability=0.99999;

It would be a good idea to do a find and replace on that variable name to fix the typo everywhere it's used.

tth
Newbie
*
Offline Offline

Activity: 2
Merit: 0


View Profile
October 19, 2015, 10:51:33 PM
 #230

Howdy Y'all,

Since y'all are interested in the bitcoin addresses of bots, here are three who tried to drain my faucet not long ago:
Code:
1LwLykjvdtwNUWVF9SMdK1eCh5LwYSobqB
1CXRDtZBctuysUsSkhpasDxhCmWeyVXrYe
16iJyf6zW1U1Lq6xVHVS6gzp6Y1HPWUv5n

Fortunately for my users they didn't get very far, thanks to the countermeasures I have in place.

I noticed y'all have this one in your list also, but AFAICT it corresponds to ifaucet.net's rotator, and is definitely not a bot.
Code:
1K2vpdMxkFpCG9sJzUpPCkQr9uBdUdkudk

Enjoy!
thefaucetrunner
Sr. Member
****
Offline Offline

Activity: 714
Merit: 250


Defend Bitcoin and its PoW: bitcoincleanup.com


View Profile
October 19, 2015, 11:06:50 PM
 #231

You guys need to be very careful with the referrals you are banning. Lots of users send traffic from their iFaucet referral link (similar to how LandofBitcoin used to work) so many users have 50-100 referrals just from their iFaucet referrals.

You aren't going to ban bots by simply looking at the addresses, you need to find patterns in claims, patterns in referral trees and also you need to make sure that your sites feature good enough anti-bot security (honeypot forms, etc)

I actively promote faucets - as do many other users. You have no idea who is a user who has spent 0.02 on advertising for those referees and a botter.

I'm not convinced that the OP, or indeed several of the other admins here are actually finding bots. Some of you saying you've lost 0.01 in a day - that's not really proof of botting. I lost 0.2 when I got botted.

1. How do you guys know you're not banning active referrers/advertisers?
2. How do you guys know you're not banning iFaucet users with a large number of referrals?

These are important issues.

I have 1000+ iFaucet referrals as well as individually on larger faucets. I pay good money for these and would hate to be banned by an overzealous admin simply because he suspects I'm a bot.

▄▄▄███████▄▄▄
▄█████████████████▄▄
▄██
█████████▀██▀████████
████████▀
░░░░▀░░██████████
███████████▌░░▄▄▄░░░▀████████
███████
█████░░░███▌░░░█████████
███
████████░░░░░░░░░░▄█████████
█████████▀░░░▄████░░░░█████████
███
████▄▄░░░░▀▀▀░░░░▄████████
█████
███▌▄█░░▄▄▄▄█████████
▀████
██████▄██
██████████▀
▀▀█████████████████▀▀
▀▀▀███████▀▀
.
BitcoinCleanUp.com


















































████████████████████████████████████████████████████████████████████████████████
.
.
████████████████████████████████████████████████████████████████████████████████
███████████████████████████████████████
███████████████████████████████
███████████████████████████████
███████▀█████████▀▀▀▀█▀████████
███████▌░▀▀████▀░░░░░░░▄███████
███████▀░░░░░░░░░░░░░░▐████████
████████▄░░░░░░░░░░░░░█████████
████████▄░░░░░░░░░░░▄██████████
███████▀▀▀░░░░░░░▄▄████████████
█████████▄▄▄▄▄▄████████████████
███████████████████████████████
███████████████████████████████
███████████████████████████████████████
████████████████████████████████████████████████████████████████████████████████
.
#EndTheFUD
.

████████████████████████████████████████████████████████████████████████████████
██████████
██
██
██
██
██
██
██
██
██
██
██
██████████
examplens
Legendary
*
Offline Offline

Activity: 3276
Merit: 3169


Crypto Swap Exchange


View Profile WWW
October 19, 2015, 11:15:23 PM
 #232

You guys need to be very careful with the referrals you are banning. Lots of users send traffic from their iFaucet referral link (similar to how LandofBitcoin used to work) so many users have 50-100 referrals just from their iFaucet referrals.

You aren't going to ban bots by simply looking at the addresses, you need to find patterns in claims, patterns in referral trees and also you need to make sure that your sites feature good enough anti-bot security (honeypot forms, etc)

I actively promote faucets - as do many other users. You have no idea who is a user who has spent 0.02 on advertising for those referees and a botter.

I'm not convinced that the OP, or indeed several of the other admins here are actually finding bots. Some of you saying you've lost 0.01 in a day - that's not really proof of botting. I lost 0.2 when I got botted.

1. How do you guys know you're not banning active referrers/advertisers?
2. How do you guys know you're not banning iFaucet users with a large number of referrals?

These are important issues.

I have 1000+ iFaucet referrals as well as individually on larger faucets. I pay good money for these and would hate to be banned by an overzealous admin simply because he suspects I'm a bot.

yes, is very complicated. but not exactly luck when looking at your faucet balance disappear, and click on ads not move  Shocked
i mean that is time for change faucetbox script with another one

█▀▀▀











█▄▄▄
▀▀▀▀▀▀▀▀▀▀▀
e
▄▄▄▄▄▄▄▄▄▄▄
█████████████
████████████▄███
██▐███████▄█████▀
█████████▄████▀
███▐████▄███▀
████▐██████▀
█████▀█████
███████████▄
████████████▄
██▄█████▀█████▄
▄█████████▀█████▀
███████████▀██▀
████▀█████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
c.h.
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀█











▄▄▄█
▄██████▄▄▄
█████████████▄▄
███████████████
███████████████
███████████████
███████████████
███░░█████████
███▌▐█████████
█████████████
███████████▀
██████████▀
████████▀
▀██▀▀
thefaucetrunner
Sr. Member
****
Offline Offline

Activity: 714
Merit: 250


Defend Bitcoin and its PoW: bitcoincleanup.com


View Profile
October 19, 2015, 11:23:41 PM
 #233

I suggest you guys update your script or add some sort of email verification for users. I have reduced my botting almost completely since I implemented this change - in fact, I predict that most large faucets will need to implement such features if they are to survive.

The Faucetbox script as standard suits small-medium faucets, anyone offering more than 500 satoshi per hour is at risk.

You need to surgically remove bots and not delete large referral trees.

▄▄▄███████▄▄▄
▄█████████████████▄▄
▄██
█████████▀██▀████████
████████▀
░░░░▀░░██████████
███████████▌░░▄▄▄░░░▀████████
███████
█████░░░███▌░░░█████████
███
████████░░░░░░░░░░▄█████████
█████████▀░░░▄████░░░░█████████
███
████▄▄░░░░▀▀▀░░░░▄████████
█████
███▌▄█░░▄▄▄▄█████████
▀████
██████▄██
██████████▀
▀▀█████████████████▀▀
▀▀▀███████▀▀
.
BitcoinCleanUp.com


















































████████████████████████████████████████████████████████████████████████████████
.
.
████████████████████████████████████████████████████████████████████████████████
███████████████████████████████████████
███████████████████████████████
███████████████████████████████
███████▀█████████▀▀▀▀█▀████████
███████▌░▀▀████▀░░░░░░░▄███████
███████▀░░░░░░░░░░░░░░▐████████
████████▄░░░░░░░░░░░░░█████████
████████▄░░░░░░░░░░░▄██████████
███████▀▀▀░░░░░░░▄▄████████████
█████████▄▄▄▄▄▄████████████████
███████████████████████████████
███████████████████████████████
███████████████████████████████████████
████████████████████████████████████████████████████████████████████████████████
.
#EndTheFUD
.

████████████████████████████████████████████████████████████████████████████████
██████████
██
██
██
██
██
██
██
██
██
██
██
██████████
tth
Newbie
*
Offline Offline

Activity: 2
Merit: 0


View Profile
October 19, 2015, 11:27:46 PM
 #234

You guys need to be very careful with the referrals you are banning. Lots of users send traffic from their iFaucet referral link (similar to how LandofBitcoin used to work) so many users have 50-100 referrals just from their iFaucet referrals.

You aren't going to ban bots by simply looking at the addresses, you need to find patterns in claims, patterns in referral trees and also you need to make sure that your sites feature good enough anti-bot security (honeypot forms, etc)

FWIW, banning addresses won't make a damn bit of difference in the long run. They're too damn easy to generate.

I actively promote faucets - as do many other users. You have no idea who is a user who has spent 0.02 on advertising for those referees and a botter.

Without which, many faucets simply wouldn't exist, and I think people forget that in their haste.

1. How do you guys know you're not banning active referrers/advertisers?
2. How do you guys know you're not banning iFaucet users with a large number of referrals?

These are important issues.

Indeed.

In order for someone to really make a profit ripping off a faucet, they have to have a large number of machines to carry out attacks. Hence, why a lot of attacking hosts are on IP addresses registered to hosting / VPS providers.

Fortunately, the bots that grace my faucet aren't too sophisticated. But when you get a 1000% increase in sessions coming primarily from various hosting providers, all using the same referral address, I'd say that's a pretty good indication that you're dealing with a bot, and not someone trying to advertise on your behalf. Wink
thefaucetrunner
Sr. Member
****
Offline Offline

Activity: 714
Merit: 250


Defend Bitcoin and its PoW: bitcoincleanup.com


View Profile
October 19, 2015, 11:35:55 PM
 #235

You guys need to be very careful with the referrals you are banning. Lots of users send traffic from their iFaucet referral link (similar to how LandofBitcoin used to work) so many users have 50-100 referrals just from their iFaucet referrals.

You aren't going to ban bots by simply looking at the addresses, you need to find patterns in claims, patterns in referral trees and also you need to make sure that your sites feature good enough anti-bot security (honeypot forms, etc)

FWIW, banning addresses won't make a damn bit of difference in the long run. They're too damn easy to generate.

I actively promote faucets - as do many other users. You have no idea who is a user who has spent 0.02 on advertising for those referees and a botter.

Without which, many faucets simply wouldn't exist, and I think people forget that in their haste.

1. How do you guys know you're not banning active referrers/advertisers?
2. How do you guys know you're not banning iFaucet users with a large number of referrals?

These are important issues.

Indeed.

In order for someone to really make a profit ripping off a faucet, they have to have a large number of machines to carry out attacks. Hence, why a lot of attacking hosts are on IP addresses registered to hosting / VPS providers.

Fortunately, the bots that grace my faucet aren't too sophisticated. But when you get a 1000% increase in sessions coming primarily from various hosting providers, all using the same referral address, I'd say that's a pretty good indication that you're dealing with a bot, and not someone trying to advertise on your behalf. Wink

Precisely! You seem to have a good feel for the bots you are receiving.

Botters are either of the following:

1. Members of a large botting network that funds itself using referral incomes
2. Individuals with large amounts of captcha-solves in an Rucaptcha account and a proxy list
3. Individuals who make individual bots and then release them to a small number of referrals, typically on small forums such as TheBot.net etc

The single largest attack I had came from the first type, a large network with over 1000 active users running custom designed bots. Little to no technical expertise required, just some rubles and a Bitcoin address. Profit is around 100% on some faucets and can be more.

Unless your faucet is supremely popular I doubt you'll find many attacks from individuals - your faucet would need to be exceptional in some way; high referral commission, high reward, etc.

Do not go banning addresses randomly without being 100% sure. As important as this list of 'bad' addresses is we also need a certified list of good addresses in order to make sure legitimate traffic sources aren't penalized.

▄▄▄███████▄▄▄
▄█████████████████▄▄
▄██
█████████▀██▀████████
████████▀
░░░░▀░░██████████
███████████▌░░▄▄▄░░░▀████████
███████
█████░░░███▌░░░█████████
███
████████░░░░░░░░░░▄█████████
█████████▀░░░▄████░░░░█████████
███
████▄▄░░░░▀▀▀░░░░▄████████
█████
███▌▄█░░▄▄▄▄█████████
▀████
██████▄██
██████████▀
▀▀█████████████████▀▀
▀▀▀███████▀▀
.
BitcoinCleanUp.com


















































████████████████████████████████████████████████████████████████████████████████
.
.
████████████████████████████████████████████████████████████████████████████████
███████████████████████████████████████
███████████████████████████████
███████████████████████████████
███████▀█████████▀▀▀▀█▀████████
███████▌░▀▀████▀░░░░░░░▄███████
███████▀░░░░░░░░░░░░░░▐████████
████████▄░░░░░░░░░░░░░█████████
████████▄░░░░░░░░░░░▄██████████
███████▀▀▀░░░░░░░▄▄████████████
█████████▄▄▄▄▄▄████████████████
███████████████████████████████
███████████████████████████████
███████████████████████████████████████
████████████████████████████████████████████████████████████████████████████████
.
#EndTheFUD
.

████████████████████████████████████████████████████████████████████████████████
██████████
██
██
██
██
██
██
██
██
██
██
██
██████████
rkandrades (OP)
Sr. Member
****
Offline Offline

Activity: 392
Merit: 251


Bitcoin Faucet & Blog


View Profile
October 20, 2015, 03:02:54 AM
 #236

Howdy Y'all,

Since y'all are interested in the bitcoin addresses of bots, here are three who tried to drain my faucet not long ago:
Code:
1LwLykjvdtwNUWVF9SMdK1eCh5LwYSobqB
1CXRDtZBctuysUsSkhpasDxhCmWeyVXrYe
16iJyf6zW1U1Lq6xVHVS6gzp6Y1HPWUv5n

Fortunately for my users they didn't get very far, thanks to the countermeasures I have in place.

I noticed y'all have this one in your list also, but AFAICT it corresponds to ifaucet.net's rotator, and is definitely not a bot.
Code:
1K2vpdMxkFpCG9sJzUpPCkQr9uBdUdkudk

Enjoy!

The 1K2vpdMxkFpCG9sJzUpPCkQr9uBdUdkudk address was removed from the list. A note was added also asking to unblock this address.

Thank you.

Bitcoin█████████████████████████
█████████████████████████████
███████████████████████████████
█████████████████████████████████
██████████████████████████████████
███████████████████████████████████
███████████████████████████████████
█████████████████████████████████████
█████████████████████████████████████
█████████████████████████████████████
████████████████████████████████████
███████████████████████████████████
███████████████████████████████████
██████████████████████████████████
████████████████████████████████
██████████████████████████████
████████████████████████████
██████████████████████████
atcher.
███
███
███
███
███
███
███
███
███
███
███
███
███
███

══════════════════════════════════════════════════════════════
  FaucetFREE BTCitcoin RewardsBlogLearn about Finance, Economics and Bitcoin
══════════════════════════════════════════════════════════════

███
███
███
███
███
███
███
███
███
███
███
███
███
███

rkandrades (OP)
Sr. Member
****
Offline Offline

Activity: 392
Merit: 251


Bitcoin Faucet & Blog


View Profile
October 20, 2015, 03:04:24 AM
 #237

You guys need to be very careful with the referrals you are banning. Lots of users send traffic from their iFaucet referral link (similar to how LandofBitcoin used to work) so many users have 50-100 referrals just from their iFaucet referrals.

You aren't going to ban bots by simply looking at the addresses, you need to find patterns in claims, patterns in referral trees and also you need to make sure that your sites feature good enough anti-bot security (honeypot forms, etc)

FWIW, banning addresses won't make a damn bit of difference in the long run. They're too damn easy to generate.

I actively promote faucets - as do many other users. You have no idea who is a user who has spent 0.02 on advertising for those referees and a botter.

Without which, many faucets simply wouldn't exist, and I think people forget that in their haste.

1. How do you guys know you're not banning active referrers/advertisers?
2. How do you guys know you're not banning iFaucet users with a large number of referrals?

These are important issues.

Indeed.

In order for someone to really make a profit ripping off a faucet, they have to have a large number of machines to carry out attacks. Hence, why a lot of attacking hosts are on IP addresses registered to hosting / VPS providers.

Fortunately, the bots that grace my faucet aren't too sophisticated. But when you get a 1000% increase in sessions coming primarily from various hosting providers, all using the same referral address, I'd say that's a pretty good indication that you're dealing with a bot, and not someone trying to advertise on your behalf. Wink

Precisely! You seem to have a good feel for the bots you are receiving.

Botters are either of the following:

1. Members of a large botting network that funds itself using referral incomes
2. Individuals with large amounts of captcha-solves in an Rucaptcha account and a proxy list
3. Individuals who make individual bots and then release them to a small number of referrals, typically on small forums such as TheBot.net etc

The single largest attack I had came from the first type, a large network with over 1000 active users running custom designed bots. Little to no technical expertise required, just some rubles and a Bitcoin address. Profit is around 100% on some faucets and can be more.

Unless your faucet is supremely popular I doubt you'll find many attacks from individuals - your faucet would need to be exceptional in some way; high referral commission, high reward, etc.

Do not go banning addresses randomly without being 100% sure. As important as this list of 'bad' addresses is we also need a certified list of good addresses in order to make sure legitimate traffic sources aren't penalized.

I fully agree with you all. Then I won't add suggested addresses anymore.

But I will keep the address wich I did pick up. I'm very carefull in analyzing scammer's addresses.

Anyways we could keep this topic bringging new defense techniques and advices.

Bitcoin█████████████████████████
█████████████████████████████
███████████████████████████████
█████████████████████████████████
██████████████████████████████████
███████████████████████████████████
███████████████████████████████████
█████████████████████████████████████
█████████████████████████████████████
█████████████████████████████████████
████████████████████████████████████
███████████████████████████████████
███████████████████████████████████
██████████████████████████████████
████████████████████████████████
██████████████████████████████
████████████████████████████
██████████████████████████
atcher.
███
███
███
███
███
███
███
███
███
███
███
███
███
███

══════════════════════════════════════════════════════════════
  FaucetFREE BTCitcoin RewardsBlogLearn about Finance, Economics and Bitcoin
══════════════════════════════════════════════════════════════

███
███
███
███
███
███
███
███
███
███
███
███
███
███

FaucetRank.com
Hero Member
*****
Offline Offline

Activity: 868
Merit: 500



View Profile WWW
October 20, 2015, 03:12:33 AM
 #238

You guys need to be very careful with the referrals you are banning. Lots of users send traffic from their iFaucet referral link (similar to how LandofBitcoin used to work) so many users have 50-100 referrals just from their iFaucet referrals.

You aren't going to ban bots by simply looking at the addresses, you need to find patterns in claims, patterns in referral trees and also you need to make sure that your sites feature good enough anti-bot security (honeypot forms, etc)

I actively promote faucets - as do many other users. You have no idea who is a user who has spent 0.02 on advertising for those referees and a botter.

I'm not convinced that the OP, or indeed several of the other admins here are actually finding bots. Some of you saying you've lost 0.01 in a day - that's not really proof of botting. I lost 0.2 when I got botted.

1. How do you guys know you're not banning active referrers/advertisers?
2. How do you guys know you're not banning iFaucet users with a large number of referrals?

These are important issues.

I have 1000+ iFaucet referrals as well as individually on larger faucets. I pay good money for these and would hate to be banned by an overzealous admin simply because he suspects I'm a bot.

Detecting a legit user is not so hard OP blindly blocking keys because he doubt they're bots.

In my opinion bots should not be more then 5-10 % of your traffic.

I use state counter which shows me referral traffic so I can identify real and bot more accuracy.

  ████
█ ████
█ ████
█ ████
█ ████ █
█ ████ █
█ ████ █
█ ████ █
█ ████ █
  ████ █
  ████ █
  ████ █
  ████
  ████
█ ████
█ ████
█ ████
█ ████ █
█ ████ █
█ ████ █
█ ████ █
█ ████ █
  ████ █
  ████ █
  ████ █
  ████
  .SCAMMERS.
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
  .EXPOSED.
.
▄▄▄▄▄▄▄▄
  ████
█ ████
█ ████
█ ████
█ ████ █
█ ████ █
█ ████ █
█ ████ █
█ ████ █
  ████ █
  ████ █
  ████ █
  ████
Gifted
Hero Member
*****
Offline Offline

Activity: 504
Merit: 501



View Profile
October 20, 2015, 05:48:03 AM
 #239

You guys need to be very careful with the referrals you are banning. Lots of users send traffic from their iFaucet referral link (similar to how LandofBitcoin used to work) so many users have 50-100 referrals just from their iFaucet referrals.

You aren't going to ban bots by simply looking at the addresses, you need to find patterns in claims, patterns in referral trees and also you need to make sure that your sites feature good enough anti-bot security (honeypot forms, etc)

I actively promote faucets - as do many other users. You have no idea who is a user who has spent 0.02 on advertising for those referees and a botter.

I'm not convinced that the OP, or indeed several of the other admins here are actually finding bots. Some of you saying you've lost 0.01 in a day - that's not really proof of botting. I lost 0.2 when I got botted.

1. How do you guys know you're not banning active referrers/advertisers?
2. How do you guys know you're not banning iFaucet users with a large number of referrals?

These are important issues.

I have 1000+ iFaucet referrals as well as individually on larger faucets. I pay good money for these and would hate to be banned by an overzealous admin simply because he suspects I'm a bot.
i have been banned from many faucets saying im on a proxy and im not  and i own a list page as well
tresh
Newbie
*
Offline Offline

Activity: 17
Merit: 0


View Profile
October 20, 2015, 12:12:52 PM
 #240

Good work man! However as mentioned above you people, must be carefull when you ban BTC address and its referrals. I have collect this addresses from rotator/lists:

1JSoW6FXrrhjMFLyfwC3PL9tJBhMwyLuRB --- faucetsfree.com
1LB8EJsDQZQt5X2EPHvKgHw1F66xLUUCj1 --- btcfaucetlist.net
1PioCZa8nzmzH6eXDtDG7xLsFANuAHQkrB --- freebitcoinhome.com
1Po9cWPPqfykFG1Zdrba7bkEcnkbq98BVD --- bit.makejar.com
15gZFZMaz1MtEKm9Z1HGroTtuU8Sr9oi3z --- zonebitcoin.com
1vn6x8oFQwuHvVdCKkkWv8BPCe7WmNyZ5  --- rotator . impaktoweb . com
17A3sR66WEH86wjYJv2ns4nTv1BmGBRm6G --- bitcoinsblue.com
1KAZ3b7EbWxwkXm28AEG17zRzY7ZKM9yHP --- smellikecoins
12xAgyn7bjEfjaK2rGtWJfrakDAXLHLDQN --- bitcoin-gator.com/?p=rotator
1PhRCPKyM5CCiNC8yP5krGG1UNsjk2iQgz --- coinator.net
17A3sR66WEH86wjYJv2ns4nTv1BmGBRm6G --- bitcoinsblue.com

if you have them banned, you should remove cause they are legit.

Keep it good work Smiley
Pages: « 1 2 3 4 5 6 7 8 9 10 11 [12] 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 »
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!