On one of my sites, I just happened to notice that the #2 visitor in the Top Visitors report was the same IP as the author of the most recent spam. The obvious thing to do was to ban that IP address, but it occurs to me that there is a reporting opportunity here ... something like Top Spammers which would show top down by IP address the sources of the most spam. A ban link would be lovely. Best would be to include a reverse DNS lookup on the IP address.

I confess to being a bit puzzled by the existing blocked IP list on the Spam Logs page since IPs don't seem to stick around there.

Comments

jeremy’s picture

jeremy commented

How is that different than what is found by going to Administer >> Reports >> Spam logs >> Blocked IPs?

The spam module tries to only block IPs for a limited amount of time. The way this is implemented is: once spam content is deleted, the IP is unblocked.

jeremy’s picture

jeremy commented
Status: Active » Postponed (maintainer needs more info)
tamhas’s picture

tamhas commented

Well, it is different because we almost never have anything in Blocked IPs. I guess, based on another thread, that this is because we delete spam. Peculiar, I know, but practical.

naught101’s picture

naught101 commented

Yeah, this is a bit different to blocked IPs, because it would include IPs that aren't blocked, but have posted spam recently. It looks like it might be possible to get that list from the spam log ( _spam_log_trace > Hostname ), and then sum them up and make a report based on that. It might make sense to just include the top 5 or 10 on the "statistics page".

A "block IP" link might be possible with #470962: manually block IP addresses / detect IP floods

gnassar’s picture

gnassar commented
Status: Postponed (maintainer needs more info) » Active

I almost marked this a duplicate. I'll leave it to Jeremy's judgment, since the question he posed has technically been answered, but I don't know that I see a lot of use to a "Top Spammers" page that doesn't have a "ban this (IP/URL/whatever)" link attached. What good is that list if you can't do something about it?

So then this reduces to the "should IP banning be included?" conversation, which has been (is being) discussed in detail over in #470962: manually block IP addresses / detect IP floods.

Recommending mark as duplicate.

jeremy’s picture

jeremy commented
Status: Active » Closed (duplicate)

Agreed -- this is a duplicate.
#470962: manually block IP addresses / detect IP floods