IP address changing software.

[Minh Thanh]

IP address changing software.

I don't know why I'm blocked from accessing the forum, even though the Admin has helped unblock me (twice in two days), maybe it's due to the firewall...
Has anyone here ever used IP address changing software? Which program did you use? What was your experience?...

Thank you !

[AdeV]

OK... let me explain what's going on.

If you look at the forum stats - specifically, scroll down to the bottom of the page, and look at the "Most Online" column. You'll see it was pretty steady until around 2022 (excluding the Covid-blip in 2020), rose a bit in 2024 then went nuts in 2025 - although that was just in September, when were were under a sustained attack from somewhere in SE Asia.

However, for pretty much the whole of 2026, we've been seeing ludicrous numbers of guest visitors. As much as I'd love it if this forum really were that popular - you can be sure that most of that activity is AI scrapers, attempts to hack the forum, and so on. And it's not just us - Listerengine.com (another forum on the same server) was being blitzed, and Eric's forum madmodder.net was also being hammered at the same time.

So... I started looking at the traffic patterns as best I could (essentially, number of guests visiting from a given subnet (e.g. 14.15.x.x) where there was also zero registered members online. And I started adding those subnets to the firewall.  I may have gone a little bit OTT one day, I think I added a batch of 2000-odd new rules in one fell swoop - and whilst at the time none of those ranges had any active members accessing the forum - and all had 3-4 or more IPs in their range(s) accessing as "guest"... clearly that was taking it a bit too far.

Now - that was on the OLD server. And it was a pure firewall, so essentially ALL traffic that hit the server from an IP address subject to the rules, was junked. Thus, legit users would see nothing (just some kind of "not available" screen, as created by your browser). Since I knew that wasn't acceptable long-term, I (and my new AI buddy Claude) wrote a "softer" firewall system. Essentially it looks at your IP address, and if it's in one of the block rules, it diverts you to the "Your IP address is blocked" page. That then allows you to contact me, in order to have your IP address de-listed. And I'm using a free service from Cloudflare to verify that you're a real person & not a 'bot. When you fill out that form, I get an e-mail including the IP address you accessed us with, which lets me find & remove (or alter) the appropriate rule in the firewall to let you back in.

We're still being hit by lots of traffic... but now, an awful lot of it is being stopped before it even gets to the forum. I've also implemented an endpoint check - so if you hit an obviously fake URL (e.g. mem.com/.well-known/passkey-endpoints is the most recent, mem.com/xmlrpc.php is one of the most popular), the system immediately blocks you from accessing the forum. And I can review the endpoints being hit & add new ones as they appear. The goal will be to have a firewall that automatically excludes hackers and scanners, but lets real people through every time.

I'm not quite there yet... but I'm working on it.


Also - I'm going to send a version of this message out as an emailed announcement, since there may well be people who have been blocked for a while before we moved to this new "soft firewall" (warmwall?) who may have given up trying altogether, thinking we've gone offline...  Plus it's always a good way of finding broken/disabled user accounts.

Anyway, if anyone's been wondering what's going on, that's what's been going on. And yes, it's a daily struggle against the machines. Let's just be thankful they haven't figured out nukes yet...!

[AdeV]

And just for fun, a couple of screen-grabs from the system.

First one shows the number of blocked/allowed IPs/endpoints, the number of rules hit. It also allows me to look at the endpoints hit by IP, or or IPs that hit the system & what endpoints.  Within the 421 IP addresses that were allowed in, is every single one of you reading this (or any) message... Actually, something I'll do is get Claude to analyse the table to tell me how many legitimate IPs there are vs. illegitimate ones - I reckon there'll be between 2 and 5 times as many "dodgy" IPs as real ones.

The second screen grab shows some of the IP addresses that were auto-blocked today, and the endpoints they tried to reach. So far there are 297 entries, that part of the system has been running for just over a week.  Considering how small and niche a corner of the internet we are.... that's a disturbingly large number (note there is some duplication, as typically a scammer will hit multiple endpoints so quickly, the system doesn't have time to block all the subsequent ones after it detects the first; so it detects and records the same IP blocked multiple times.

Anyway - I'm fairly sure it's working, a the number of visitors has dropped back to something closer to normal. It's still a bit on the high-side, but I've not yet culled all of the scrapers and spiders...

[Minh Thanh]

 Hi Ade !
Thanks for the explanation and effort...to maintain the forum !!

I'm just looking for the simplest way to make things easier...I'm testing an IP changing software that can change my IP to a country without being blocked by the forum - It's official software.

I appreciate the notification that appears when someone is blocked, allowing for feedback to the forum, and your quick problem-solving 

[crueby]

Amazing how many hack attacks on a forum full of centuries old technology... 
Very interesting stuff Ade, thanks for sharing!

[Vixen]

Hello Ade,

Have you ever analysed which threads are getting hacked (or scraped) more than others? Is it limited to the 'top tens' or all across the board?

Mike

[AdeV]

I'm just looking for the simplest way to make things easier...I'm testing an IP changing software that can change my IP to a country without being blocked by the forum - It's official software.

VPNs are actually the bane of my life... and also essential! (I had to use a VPN when visiting China to be able to access even a fraction of the rest of the world's internet! Although I did notice on my most recent visit, that my 'phone internet was unrestricted, so I guess they've figured out a way of allowing roaming users (foreign visitors) to not be restricted, whilst still restricting their domestic users.

I tried accessing the forum via my own VPN provider - and the IP it assigned me came up with a "99" fraud score (out of 99), and was marked as "SCANNER".... so you might find that VPNs get blocked over time, especially if someone really does use it with scanner software and hits one of my attack vector patterns...

There's still quite a few internal (Forum software level) bans in place, but I hope eventually to replace the majority of them with non-forum bans; that way banned entities don't even get to affect the forum stats

[AdeV]

Have you ever analysed which threads are getting hacked (or scraped) more than others? Is it limited to the 'top tens' or all across the board?

Hi Mike,

I haven't done an in-depth analysis - but it appears to be a pretty random mixture of topics and profiles. The top "blocked" range (visible on the first screenshot above) hit us over 50,000 times on 45,000 endpoints using 1280 IP addresses over the course of 3 days... that claimed to be a search engine spider; the IP range is in a UK data centre and belongs to a French internet provider. There's also a lot of activity from various Google and Facebook IP addresses too.

[Thor]

Hi Minh,

 To answer a few of your original questions, I use Proton VPN and that was blocked earlier. Ade fixed that so now I can access the forum using my VPN, whether I can use all Proton servers and access the forum I don't know - I have only tried a couple of Proton servers.
 For other Internet use my Proton VPN account has worked OK, it seems to me that even downloads are not much affected.

Thor

[Dave Otto]

I use Proton VPN and haven’t had any issues.

Dave

[Minh Thanh]

Thanks for your feedback !
   

[gerritv]

I recently had to add Cloudflare OneClient (previouslly known as Warp) using both traffic and DNS to get access to a specific site in Netherlands from Canada. Free and since it is Cloudflare should be reputable: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/
Not a VPN but does the job I needed it to.