Researching the types of account blocks (help from the staff is needed)

[esmanthra]

Someone asked the related question in our local board, so I started to search and found these reasons why the account could be locked (not banned) on bitcointalk.org. Unfortunetely, I just can't find the exect description of time and process for some cases (and also the confirmation if I made the whole list), so I thought that somebody from the staff can assist me.


1. Proxyban.

The hello-nice-to-meet-you-you're-locked-message looks like this:

You are unable to post. How to enable posting.

Bitcoin Forum > Remove Proxyban
Your IP address has previously been used for evil on this forum, or it is a known proxy/VPN/Tor exit node, so you are required to pay a small fee before you are able to post messages or send PMs. You can still use all of the read-only features without paying.

Your account contains XXX units of evil. To atone, you must pay a total of XXX bitcoins (XXX mBTC; XXX satoshi). Pay to the address XXX. Once you have paid the full amount, wait a few seconds and then reload this page. If the fee is so small that your wallet is unable to send it, you can send any larger amount, though you will not be refunded the difference.

Alternatively, any forum staff member and some other notable members can manually whitelist you. Paying the fee is probably easier/quicker, though.

If you don't have any bitcoins, you can get small amounts of free bitcoins using the sites listed here. It is recommended that you give the free bitcoin sites the address listed above. Do not collect money in your own wallet and then send the bitcoins to the forum -- this will likely result in significant network fees.

If you find any bugs in this system, email pbbugs-...@.... For example, send email here if your payment is not registered an hour after sending it. You will be permanently banned if you send email here requesting free whitelisting.

Examples: threadone, threadtwo, threadthree.
WTH?! A measure implemented basically to prevent the ban evasion and spam.
The process: someone tries to register with TOR/proxy/VPN/IP that was previously used by some violator - and recieves the automatic block.
Possible solution for innocents: use the "white" IP to register or pay a fee.


2. Secret question block.

The hello-nice-to-meet-you-you're-locked-message looks like this:

Sorry Guest, you are banned from using this forum!
For security, your account has been locked. Email acctcomp15@theymos.e4ward.com

Examples: threadone, threadtwo, threadthree.
WTH?! The aftermath of forum database leak'2015. Was implemented for security reasons (so someone who gained the access to the compromised answers couldn't use them).
The process: someone tries to reset his/her password with secret question and receives the automatic block. The result is displayed on seclog page as "password reset via secret question".
Possible solution for innocents: forget about secret questions and/or try to restore the account according to procedure described in official topic (or create a thread in Meta providing the signed message so Global Mods could help).


3. Block on suspicion of being hacked or due to the long period of inactivity.

Can be of two types:

 - when user him/herself blocks the account via e-mail:

Sorry XXX, you are banned from using this forum!
For security, your account has been locked. Email acctcomp15@theymos.e4ward.com

WTH?! Someone obviously hacked the account.
The process: account owner detected invasion in time and applied the link which was sent to his/her e-mail.
Possible solution for innocents: try to restore the account according to procedure described in official topic.

 - [???] (see the questions below):

Sorry Guest, you are banned from using this forum!
For security, your account has been locked. Email acctcomp15@theymos.e4ward.com

Sorry XXX, you are banned from using this forum!
Your account looks like it may have been hacked, so it was locked for safety. Email hacked-hw9521c@theymos.e4ward.com

Sorry Guest, you are banned from using this forum!
Your account is locked because it sat inactive for years after the password hashes were leaked in 2015, and was therefore at high risk of being hacked. Email react-vdnp8@theymos.e4ward.com to get it unlocked.

Examples: threadone, threadtwo, threadthree, threadfour, threadfive.
WTH?! The aftermath of forum database leak'2015.
The process: Account was suspended for years and then someone comes and tries to log in.
Possible solution for innocents: try to restore the account according to procedure described in official topic (or create a thread in Meta providing the signed message so Global Mods could help).


Questions:

Regarding the one noted with question marks:
- Are they actually auto blocks or somebody (I mean the staff) still pushs the button?
- For how long the account should be inactive to be locked (or what curcumstances lead it to be locked)?
- Which message corresponds to which case?
- It looks like some message shows up for someone who appeared to fall into certain list of potentially hacked users (in other words was manually added to some group by mods and thus received the security block) - is that so?
- Seclog page often displays the "woke up" lines - are they connected with blocks somehow?

Also do we have any other blocks?..

[mdayonliner]

I might be wrong to my answer however I will try the answers from the basics I understand.

Sorry Guest, you are banned from using this forum!
For security, your account has been locked. Email acctcomp15@theymos.e4ward.com

- Are they actually auto blocks or somebody (I mean the staff) still pushs the button?
- For how long the account should be inactive to be locked (or what curcumstances lead it to be locked)?
a.  I guess it might be an automated process and there must be a default time period. Also looking at the email "acctcomp15", it has something to do with the 2015 hack.

Sorry XXX, you are banned from using this forum!
Your account looks like it may have been hacked, so it was locked for safety. Email hacked-hw9521c@theymos.e4ward.com

- Are they actually auto blocks or somebody (I mean the staff) still pushs the button?
a.  In this case, the original account owner might locked the account when they learnt that the account got hacked or it could be any mod or staff manually pushed a button after learning the account got hacked

Sorry Guest, you are banned from using this forum!
Your account is locked because it sat inactive for years after the password hashes were leaked in 2015, and was therefore at high risk of being hacked. Email react-vdnp8@theymos.e4ward.com to get it unlocked.

- Are they actually auto blocks or somebody (I mean the staff) still pushs the button?
a.  This one is self explaining. So I have no doubt that this is automated

- It looks like some message shows up for someone who appeared to fall into certain list of potentially hacked users (in other words was manually added to some group by mods and thus received the security block) - is that so?
a. Mod could have some special features to make their judgements so they may have a dedicated page to view a report.
- Modlog page often displays the "woke up" lines - are they connected with blocks somehow?
a. "Woke up" might be simply for just logging in after certain amount of time. I guess it works in general.

[pugman]

Few things:

Modlog is different than seclog.

Accounts that were created before 2015 and were inactive, if they wake up suddenly and try to make password/email changes,those accounts get locked(its automated IIRC).

Global mods(or at least Hilariousandco)/admins can lock and unlock accounts,when required.

Also do we have any other blocks?..

In terms of ban, yes: Perma ban, temp ban and nuke(only applies for newbies).

There were shadowbans for newbies,I don't think they still exist though.

All the 3 cases apply when the original user/ hacker tries to change the password and email, the time of when the last account was used is what makes the messages differ.

[esmanthra]

the original account owner might locked the account when they learnt that the account got hacked

If it was the original owner, he/she might use an e-mail for that and we'd talk of the e-mail block (and people in example threads at least would know what's going on).

"Woke up" might be simply for just logging in after certain amount of time. I guess it works in general

That's likely to be true (considering how often that line appears). I just ponder if that page displays the logs for suspended and suddenly returned accounts as well as it does that for accounts restored with secret questions.

Modlog is different than seclog

You're right. Fixed it.

In terms of ban, yes

No, not that. Bans mean to be applied for the forum rules violation, and I want to find the blocks which are not connected to the rules.

There were shadowbans for newbies,I don't think they still exist though

Accounts that were created before 2015 and were inactive, if they wake up suddenly and try to make password/email changes,those accounts get locked

All the 3 cases apply when the original user/ hacker tries to change the password and email, the time of when the last account was used is what makes the messages differ

Is there some official source where I can read about it?


Anyway thanks for the replies. Though I hope to get an answer of someone from the staff.

[Husna QA]

...
1. Proxyban.
...
Possible solution for innocents: use the "white" IP to register or pay a fee. ...

To find out whether your IP is blacklisted or not e.g.: https://www.blacklistmaster.com/
(Edit: You can use other sites to check whether the IP address is blacklisted).
In the "Blacklist check" section, the IP or domain name will be automatically filled in with your IP, then click "Test".

[pugman]

Shadow bans: They only(used to) apply to newbies. It was called newbie jail. People had to be logged in like for 4 hours(continously(?)), and get automatically/manually whitelisted by mods. [I might be confusing 2 different things here, my memory is fading away. ]

Anyhow, that doesn't exist anymore. So no use on reading up on that.

Also, when seclog mentions wake up, it may or may not be related to account "block".

Nowadays accounts don't get autolocked anymore, as in if someone becomes inactive now, they don't get their accounts auto-locked,only accounts that became inactive prior to the 2015 hack, got their accounts autolocked, although a few accounts got manually locked by theymos(satoshi and Hal Finney's accounts come to mind).

Read this, its related to proxy ban: https://bitcointalk.org/index.php?topic=4101785.msg38095782#msg38095782

And good luck with understanding it, cause I didn't.

[Thirdspace]

To find out whether your IP is blacklisted or not:
https://www.blacklistmaster.com/

are you sure that is the list theymos used for proxyban? is it confirmed?
I think theymos made his own list based on a few external lists and added some more

When someone is banned, their IP and some of their neighboring IPs receive evil points.

this shows how he is adding new IPs to the list regularly based on previous banned account's IP
so eventhough an IP isn't listed on any of those blacklist (RBL, DNSBL), it may be listed on this forum's proxyban list

[esmanthra]

no use on reading up on that

Why not? Out of curiosity. But I think I'll find it on my own later.

Read this, its related to proxy ban: https://bitcointalk.org/index.php?topic=4101785.msg38095782#msg38095782

Thanks, though I don't need the info about proxyban (all the more so that link rather describes the points of evil - how "thoroughly" different IP-addresses accumulated them). But I need some official sources to verify the other statements if I provide them to the others. In other words you narrate the interesting things but I hardly can use them since they're not confirmed by any quotations.

To find out whether your IP is blacklisted or not:
https://www.blacklistmaster.com/

In fact I would also like to know why are you sure that bitcointalk blacklist is related to this one.

[Husna QA]

... is it confirmed?

No, it is not confirmed.
The first time I registered in this forum, I immediately got a proxy ban. Then I tried to register at another place (computer rental) I got a proxy ban too.
So when "IP address" is included in the blacklist (I use that site to check my IP), my conclusion is that the registered new account will also get a proxy ban too.

so eventhough an IP isn't listed on any of those blacklist (RBL, DNSBL), it may be listed on this forum's proxyban list

Maybe Theymos can explain in more detail.

I have not found "White" IP.
Because I don't want to cheat the system by registering using illegal methods, so I pay a fee (BTC) to release proxy ban.
See screenshot (I pay more than the specified fee).

...
In fact I would also like to know why are you sure that bitcointalk blacklist is related to this one.

That's just one example of the site that I use.
You can use other sites to check whether the IP address is blacklisted.
After checking the IP through that site, please try creating a new account. Look, what is the result if the "IP" is in a blacklist.

[joniboini]

... is it confirmed?

No, it is not confirmed.
The first time I registered in this forum, I immediately got a proxy ban. Then I tried to register at another place (computer rental) I got a proxy ban too.
So when "IP address" is included in the blacklist (I use that site for check my IP), my conclusion is that the registered new account will also get a proxy ban too.

I doubt that list shows the proxy ban list used here. DNSBL is used to combat email spam and not directly related to evil points.[1] Probably the same IP address that you used to register was used by spammer/bot to send spam emails, and then a member using that IP address was banned or his neighboring IP address was banned, thus they have evil points.

Well, only theymos can answer.

[1] https://en.wikipedia.org/wiki/DNSBL

[xtraelv]

The evil score is explained here: https://bitcointalk.org/index.php?topic=1215937.0

When someone is banned, their IP and some of their neighboring IPs receive evil points. The thought occurred to me recently that you could create a map of the Internet according to evil points, and I couldn't resist doing this right away. The result is pretty cool-looking IMO. It also seems to show that the evil score system is working as expected: the vast majority of the Internet is not being forced to pay, and in the isolated sections where a registration fee is required, prohibitively-large fees are very rare.

Here's the image (zoom in):
https://bitcointalk.org/banmap201510.png

Each pixel is a /24 address block (ie. each pixel represents 256 IP addresses). The colors are:
█ Zero or nearly zero evil
█ A small amount of evil
█ More
█ More
█ At this point you actually have to pay if you register an account in this block
█ More
█ More
█ More
█ Pretty high
█ A ton of evil, more than anyone is likely to pay

This is per block, so a single IP address could have an evil score requiring payment while its block still shows up as black here. A colored pixel indicates the evil score of a typical IP in that block.

Addresses are laid out in the standard way. So you can for example cross-reference with these maps: https://ant.isi.edu/address/

A /24 should almost never uniquely identify someone, but to be safe I randomly added, removed, and modified some of this data for plausible deniability.

You can follow this wise advise:

IP Ban: Someone from that IP was Banned or you are using IP that is Blacklisted by Bitcointalk.org Server.
You Need to pay a dust of bitcoins to get enable to your account , i guess the fine is not more than few days faucet earning.
If your account is at-least Jr.Member i consider , you should Pay the Fine , else just head away and change your IP and make a new Fresh account.

[pugman]

You might find this a little helpful: https://bitcointalk.org/index.php?topic=1273656.msg13131013#msg13131013 (emphasis on the Manual block part).

And this is newbie restriction thing I was talking about: https://bitcointalk.org/index.php?topic=15958.msg209292#msg209292

Were you asking for something else too?

[esmanthra]

You might find this a little helpful: https://bitcointalk.org/index.php?topic=1273656.msg13131013#msg13131013 (emphasis on the Manual block part)

Thanks, but I saw that post already. It's related to bans, not to (auto?) blocks I'm interested in.

Were you asking for something else too?

All the questions are listed in original post. I just hope to receive some kind of official reply, if it's possible. Also some of the points obviously could be confirmed/refuted by global moderators and admins only (since only them have an access to certain forum features) - other answers most probably would be just suppositions.