Access Blocker Support Thread

[ink]

Hi, so this you recommended to me a while ago. Is this just for stopping spammers sending mail or can you use it to deny access to the whole website based on IP. I know there are flaws, but its a good start to stop these spamming b@st@rdos

[lat9]

Hi, so this you recommended to me a while ago. Is this just for stopping spammers sending mail or can you use it to deny access to the whole website based on IP. I know there are flaws, but its a good start to stop these spamming b@st@rdos

In its current form, the plugin's intent is specifically to stop the generation of spam e-mail. The same settings and basic program-flow could also be used to deny access, but that's outside of the scope of this plugin.

[ink]

OK thank you for confirming

[angst]

Ink,
This plugin can help you to a degree. It helped me immensely. You need to come at blocking from a few different angles at the same time. Here are a few of the things I have done to knock the fake users down. For me the creation of fake users was the reason I set about blocking certain ip addresses.

1. this plugin. With this plugin you can block certain users from using “contact us” and create account”
You can block by country. Keep an eye on your administration/tools/who's online and every time you see a user on your page /index.php?main_page=contact_us&action=success click the ip address and whois.domaintools.com will tell you the ip location.

In this plugin settings at administration/configuration/access blocker settings there is a block by country section. You use the two character abbreviation for the country code. Here is what my list looks like. Feel free to just copy this into your configuration.
IS,NL,SG,ZW,MK,RU,CN,TW,IN,BE,PE,BR,CZ,RO,ZW,TH,UA,DE,BR,VN,SG,BG,AT,FI,IR,PK,KR ,GA,SE,LT,FR,TR,CH,NO,AR,ZA

While you are in the settings I would suggest adding to the block by create account company filter the name of the famous search engine we all use daily.

Set enable debug to true. With this on you will have a log created that you can look at in FTP that will give you insight on what ipdata.co is blocking

2. in your administration locations/taxes/countries toggle off all the obscure non english language or non European countries that will realistically never order from your site. This will result in it getting rejected when they create a customer with one of these chosen countries. There are a couple countries in particular that the spam bots have chosen for the country ( you may already know what you want to turn off first. It starts with Z and we don't say it out loud here cause the spammers may find this conversation)


3. get a free tier Cloudflare.com account. This will give you a firewall with 5 blocking rules. Block Russia, Ukrane, and China. Then after a few days in cloudflare go under analytics and look at the map of web traffic by country. Block wherever you are getting crazy traffic that wouldn't normally be on your site.

4. Block address by using your .htaccess file. I was using this method for some time and while it is satisfying to catch an ip address in the act and block it or its range it is a game of whack a mole that you will never win. The bots are running 24/7. My .htaccess page is hopelessly long now too. That has to load every time the page loads theoretically slowing the site down.

[DrByte]

For me the creation of fake users was the reason I set about blocking certain ip addresses.

@angst,
This change to core files (and any overrides you may have of those files) will stop a lot of fake account creation, on all Zen Cart versions before v157b:
https://github.com/zencart/zencart/c...0846a49ffe7398

[swguy]

A great new change that's coming in 1.5.8 is recording the IP that creates an account - this will make it easy to identify the troublemakers and block them using Access Blocker.

I will publish instructions on backporting this change to earlier versions soon.

[davewest]

I block IP's from scriptkiddies that can't hide and ones wasting resources SQL scans... however, there have been many that can hide... I never use my true IP, even through I'm not hiding, signed in through my own firewall.
Insert from a website I wont list...

There are many reasons why you would want a random IP address, as it:

Lets you change your IP location at any time.
Protects you from an IP ban.
Offers you a scalable way to screen scrape any site.

Be careful you don't block yourself.. If you do, use a proxy network to get back in...

[lat9]

I've just submitted v1.2.0 of the Access Blocker for the Zen Cart moderators' review. I'll post back here when it's available for download.

This release provides an integration with the One-Page Checkout, disabling its Guest Checkout mode if a blocked IP is in effect. See GitHub issue #9 for additional information.

Supported on an unsuffixed zc157 installation if and only if all current bugfixes have been applied (but it is better if you're using v1.5.7b already).

[lat9]

I've just submitted v1.2.0 of the Access Blocker for the Zen Cart moderators' review. I'll post back here when it's available for download.

This release provides an integration with the One-Page Checkout, disabling its Guest Checkout mode if a blocked IP is in effect. See GitHub issue #9 for additional information.

Supported on an unsuffixed zc157 installation if and only if all current bugfixes have been applied (but it is better if you're using v1.5.7b already).

Now available for download: https://www.zen-cart.com/downloads.php?do=file&id=2237

[lat9]

v1.3.0 of Access Blocker is now available for download.

This version adds the zc157+ version of ask_a_question to the list of pages protected; see GitHub issue #10 for additional information.