# Why can't socks be easily detected? **URL:** \ **Category:** About This Message Board\ **Created:** [June 20, 2013, 9:28pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509 "2013-06-20T21:28:50Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![Doug\_K](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Doug\_K](https://boards.straightdope.com/u/Doug_K)\ **Post date:** [June 22, 2013, 10:13pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/41 "2013-06-22T22:13:54Z")
> [@Crazyhorse](#): > > I’m glad that is the case. My ISP is the only internet provider available in the area that I live and they only offer internet by proxy - all of their customers appear to be using the same IP to the outside world, and there is no choice in the matter. > > So if anyone appears to be posting from my IP address but their comments aren’t on-spot, witty, and informative they are probably not my sock but just another customer of the same ISP. That’s not necessarily a proxy. It’s more likely to be [NAT](https://en.wikipedia.org/wiki/Network_address_translation). At the school I work at we use no proxies, but every machine on the network (except a handful of public servers) appears to have the same IP. ---
**Author:** ![samclem](https://avatars.discourse-cdn.com/v4/letter/s/a9a28c/32.png) [@samclem](https://boards.straightdope.com/u/samclem)\ **Post date:** [June 22, 2013, 11:35pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/42 "2013-06-22T23:35:42Z")
> [@Telemark](#): > > For most of us, IP addresses are assigned by your ISP to your computer each time you connect to the internet. You don’t get the same one twice; your ISP has big blocks of numbers and you get one each time you connect. True in some cases. I use Roadrunner for example. I have had that as my ISP for 13 years. In that time, I possibly have had 200+ different IP addresses. Do the math. My four number IP might be the same for weeks at a time. Maybe months. > [@telemark](#): > > You can ban IP addresses, or even ranges of IPs. On the site I run we’ve done that since we know there’s no legitimate traffic from the Ukraine, for example. But if you connect to the net from a major ISP in the US there’s no way to ban an block of IPs without blocking lots of valid users. Actually, there are posters in the Ukraine that are legitimate(not many, I know). Currently, our biggest headache is India. There are two carriers in India that are the equivalent of AOL in the US. We can’t ban those IPs without disenfranchising tens of legitimate posters/readers in India. I’d say 80+ % of our current spammers are from India. So it goes. ---
**Author:** ![Telemark](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/telemark/32/372_2.png) [@Telemark](https://boards.straightdope.com/u/Telemark)\ **Post date:** [June 23, 2013, 12:30am UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/43 "2013-06-23T00:30:13Z")
> [@samclem](#): > > Actually, there are posters in the Ukraine that are legitimate(not many, I know). This is for the website I run, which doesn’t have any legitimate posters from the Ukraine. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [June 23, 2013, 12:38am UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/44 "2013-06-23T00:38:18Z")
> [@samclem](#): > > We can’t ban those IPs without disenfranchising tens of legitimate posters/readers in India. And if you did, the Indian spammers would simply start using proxies in other countries. They deliberately choose proxies from the same pool used by legitimate posters who are trying to avoid local censorship or monitoring. ---
**Author:** ![CairoCarol](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cairocarol/32/3825_2.png) [@CairoCarol](https://boards.straightdope.com/u/CairoCarol)\ **Post date:** [June 23, 2013, 1:02am UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/45 "2013-06-23T01:02:35Z")
> [@tellyworth](#): > > Brazil, **Indonesia** , Bangladesh, Pakistan, Iran, Vietnam, off the top of my head. I suppose you could call that millions. Huh? I live in Jakarta. Proxies are not the “normal” or “only way” to access the internet in Indonesia. In fact the Indonesian message board I moderate bans the use of proxies. ---
**Author:** ![asterion](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@asterion](https://boards.straightdope.com/u/asterion)\ **Post date:** [June 23, 2013, 10:55am UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/46 "2013-06-23T10:55:33Z")
As a data point, I was just running Tunnelbear into the UK. When I tried to get into this board with it on, I got a “banned IP” message. So the software will stop at least some proxies. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [June 23, 2013, 11:17am UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/47 "2013-06-23T11:17:03Z")
> [@CairoCarol](#): > > Proxies are not the “normal” or “only way” to access the internet in Indonesia. I checked my data, and yes, you’re right. Proxies are more common than the US, but not that much more. I suspect they were more common a few years back, when several large web sites were blocked by some Indonesian ISPs. ---
**Author:** ![bldysabba](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@bldysabba](https://boards.straightdope.com/u/bldysabba)\ **Post date:** [July 3, 2013, 1:50pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/48 "2013-07-03T13:50:38Z")
> [@samclem](#): > > Currently, our biggest headache is India. There are two carriers in India that are the equivalent of AOL in the US. We can’t ban those IPs without disenfranchising tens of legitimate posters/readers in India. I’d say 80+ % of our current spammers are from India. So it goes. I presume much of your trouble is with Airtel. I’ve temporarily moved to my parent’s place. They use it, and I have to use Google’s cache to be able to even view the site, because pretty much any IP address I get is blocked by the SDMB. This is the first time I’ve been able to post in a month. What confuses me is why the IPs that are banned can’t even view the site. I mean, sure spammers may be a problem, but why not just prevent them from posting? ---
**Author:** ![elmwood](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/elmwood/32/3060_2.png) [@elmwood](https://boards.straightdope.com/u/elmwood)\ **Post date:** [July 3, 2013, 2:09pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/49 "2013-07-03T14:09:24Z")
> [@Blaster\_Master](#): > > Also, there are plenty of legitimate dopers who may share the same IP address for other reasons, like living together or working at the same place. Also, the SDMB has a large enough membership where Dopers might unintentionally share an IP address – public hotspots, hotels, rest areas, etc – at some time in their travels. Even on my small-ish message board, it happens. It’s a lot easier to detect a sock on a smaller board. Still, I’m surprised some socks haven’t been detected earlier, especially when they have a writing style that is unusual, but very similar to another user. Consider **vanilla** ; her socks should have been obvious early on. If I see someone who’s posting in the same style of a banned user, I’d check the IP addresses. If they’re in the same general location, it’s almost certainly a match. ---
**Author:** ![elmwood](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/elmwood/32/3060_2.png) [@elmwood](https://boards.straightdope.com/u/elmwood)\ **Post date:** [July 3, 2013, 2:23pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/50 "2013-07-03T14:23:56Z")
> [@bldysabba](#): > > I presume much of your trouble is with Airtel. I’ve temporarily moved to my parent’s place. They use it, and I have to use Google’s cache to be able to even view the site, because pretty much any IP address I get is blocked by the SDMB. This is the first time I’ve been able to post in a month. > > What confuses me is why the IPs that are banned can’t even view the site. I mean, sure spammers may be a problem, but why not just prevent them from posting? Airtel and Reliance are major headaches on my site, too. Say “Airtel Broadband” to any message board operator in the US, and the response will often be a shrug and a sigh, followed by a long rant. Most spammers from India are human “link builders”, and they have obvious tells. For example, many will enter the (often misspelled) name of an iconic city in the US, or just “usa” alone, as their location; or use the name of a Bollywood actor or actress for their username. Many are often not yet in the Stop Forum Spam database, so they’re not blocked when they try to register. I have a plugin that bumps new members from certain spam-prone countries into a mod queue. (China, Vietnam, Poland, Russia, Ukraine, and Belarus are outright blocked, since the ratio of spammer/hacker traffic to legitimate users is outrageously high.) When I check the queue, I’ll Google “[username] vbulletin” or [email prefix] vbulletin", and if there’s a bunch of hits, I delete the account. It’s not just India. The ratio of human spammers to legitimate users is quite high from all subcontinental countries , Pakistan, Bangladesh, Nepal and Sri Lanka included. ---
**Author:** ![elmwood](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/elmwood/32/3060_2.png) [@elmwood](https://boards.straightdope.com/u/elmwood)\ **Post date:** [July 3, 2013, 2:48pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/51 "2013-07-03T14:48:22Z")
> [@bldysabba](#): > > What confuses me is why the IPs that are banned can’t even view the site. I mean, sure spammers may be a problem, but why not just prevent them from posting? Speaking as just one message board operator, I have two different levels of country blocking: 1. Those countries where almost all of the traffic is malicious - Russia, Ukraine, China, etc. It’s not just spammers, but also hackers, scrapers, and so on. The vast majority of spammers are bots, and they’ll often hammer away for hours at a time. This has a measurable impact on bandwidth and server performance. There might be some legitimate users there, but it’s just not worth it. 2. Those countries where there’s a large number of spammers, but a somewhat higher ratio of legitimate users among them. Among those countries are India, Bangladesh, Israel, and Turkey. Those countries tend not to be the source of bots or scrapers. Users from those countries are allowed to register, but they’re placed in a queue (if they’re not blacklisted by Stop Forum Spam) for moderator investigation and manual approval. When I look at “disenfranchising” countries, I have to consider the Pareto principle. 20% of legitimate users make 80% of the posts. The vast majority of new users will only post a few times. So, let’s consider someplace like Russia. 100,000 new users registering from Russian IPs. 99,990 will be spammers (usually bots) or hackers. 10 will be legitimate. 0nly a few of them will post. One will post more than twice. It’s just not worth the hassle. Now, India. 100 new users registering from Indian IPs. 90 will be spammers (humans, that aren’t caught by Stop Forum Spam). 10 will be legitimate. Only a few will post. One will post more than twice. Even then, Indian users tend not to be as “sticky” in the long term as those from the Anglosphere. The ratio of inactive to active legitimate users from India is much higher than for US/Canada/UKoGBaNI/Ireland/Australia/New Zealand/South Africa. ---
**Author:** ![bldysabba](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@bldysabba](https://boards.straightdope.com/u/bldysabba)\ **Post date:** [July 3, 2013, 3:47pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/52 "2013-07-03T15:47:33Z")
> [@elmwood](#): > > Even then, Indian users tend not to be as “sticky” in the long term as those from the Anglosphere. The ratio of inactive to active legitimate users from India is much higher than for US/Canada/UKoGBaNI/Ireland/Australia/New Zealand/South Africa. Thanks for the extensive behind the scenes look into the spam world, but my question was a bit different. When I happen to be assigned an IP address that has been blacklisted by the SDMB(presumably for spamming), then I can’t even _view_ pages/threads/posts and have to resort to using Google’s cache. My question was why the system is like this. Why can’t it be so that banned IP addresses can’t sign in to make posts/threads of their own, but can still look at the innumerable witty and well reasoned contributions made to human thought by the teeming millions? Not that banning IP addresses when they’re dynamically assigned should make a difference anyway, but that’s a different issue. ---
**Author:** ![FXMastermind](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fxmastermind/32/7289_2.png) [@FXMastermind](https://boards.straightdope.com/u/FXMastermind)\ **Post date:** [July 3, 2013, 5:01pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/53 "2013-07-03T17:01:32Z")
> [@bldysabba](#): > > Why can’t it be so that banned IP addresses can’t sign in to make posts/threads of their own, but can still look at the innumerable witty and well reasoned contributions made to human thought by the teeming millions? On another system, the controls for banning (which means user name, email or IP numbers) let the Admin decide which it will be. Even for suspensions. They have to pick the option that says “this IP can no longer view anything”, rather than just not be able to sign up, post, or otherwise annoy the Gods. ---
**Author:** ![BrainGlutton](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@BrainGlutton](https://boards.straightdope.com/u/BrainGlutton)\ **Post date:** [July 3, 2013, 5:34pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/54 "2013-07-03T17:34:46Z")
> [@Shakes](#): > > Why can’t socks be easily detected? Because the dryer must have its occasional snack. (Where do you think the lint in the filter comes from?) ---
**Author:** ![FXMastermind](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fxmastermind/32/7289_2.png) [@FXMastermind](https://boards.straightdope.com/u/FXMastermind)\ **Post date:** [July 3, 2013, 5:56pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/55 "2013-07-03T17:56:59Z")
That was funnier in the other thread ---
**Author:** ![GrandWino](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/grandwino/32/67_2.png) [@GrandWino](https://boards.straightdope.com/u/GrandWino)\ **Post date:** [July 3, 2013, 6:01pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/56 "2013-07-03T18:01:48Z")
Socks are detected here all the time. Whether or not the mods can find proof and actually do anything about them is another story. ---
**Author:** ![elmwood](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/elmwood/32/3060_2.png) [@elmwood](https://boards.straightdope.com/u/elmwood)\ **Post date:** [July 3, 2013, 6:07pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/57 "2013-07-03T18:07:14Z")
> [@bldysabba](#): > > When I happen to be assigned an IP address that has been blacklisted by the SDMB(presumably for spamming), then I can’t even _view_ pages/threads/posts and have to resort to using Google’s cache. My question was why the system is like this. Why can’t it be so that banned IP addresses can’t sign in to make posts/threads of their own, but can still look at the innumerable witty and well reasoned contributions made to human thought by the teeming millions? Not that banning IP addresses when they’re dynamically assigned should make a difference anyway, but that’s a different issue. It’s easy to outright block an IP address or range; at the server level (through an .htaccess file or a firewall), or in the case of vBulletin, in the administrator control panel. Where it gets more difficult is determining the intent of a visitor from a certain IP. From what I understand, the SDMB is running on a mostly stock version of vBulletin, with few or no tweaks or plugins. There are plugins to allow somewhat more granular control. For example, there are a few plugins that query the Stop Forum Spam when someone tries to register. There’s also a plugin that sends new users from certain IP ranges or countries to s moderation queue for manual approval. Without those plugins, IP blocking is generally brute force; all or nothing. These are viable solutions for traffic from a country like India or Indonesia, where there’s usually some legitimate users among the link builders, and there’s not much bot or scraper traffic. The activities of Indian spammers won’t noticeably impact the server; they’ll just be a nuisance for the administrators and moderators. It gets more difficult when you’re looking at countries where almost all the traffic is malicious, from the perspective of US-based message boards. Spammers in places like Russia, Ukraine and China tend to use bots to register, and they often hammer away endlessly for hours. There’s also content scrapers, aggressive search engines, and hackers galore. Most have user agent fields that spoof popular Web browsers; the server will think it’s just Firefox, and not xRumer or a scraper. Most aren’t throttled, and they’ll chew up CPU cycles and driving up server loads. (If I want to stress-test my server, all I have to do is remove the China and CIS IP blocks, and the load will begin to climb almost immediately.) It’s much harder to tell whether a visit from an IP address in Russia is just a visiting American tourist, or a registration bot. Also, there’s a much higher ratio of malicious traffic to legitimate users. Why would some IPs in a country be blocked, and not others? A message board operator may find they get no legitimate traffic from a certain Airtel block, which may be in a city where there’s a lot of link building activity. However, there may be an Airtel block that’s trouble-free, so its left alone. ---
**Author:** ![elmwood](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/elmwood/32/3060_2.png) [@elmwood](https://boards.straightdope.com/u/elmwood)\ **Post date:** [July 3, 2013, 6:16pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/58 "2013-07-03T18:16:28Z")
> [@FXMastermind](#): > > On another system, the controls for banning (which means user name, email or IP numbers) let the Admin decide which it will be. Even for suspensions. They have to pick the option that says “this IP can no longer view anything”, rather than just not be able to sign up, post, or otherwise annoy the Gods. On stock vBulletin, there’s no different levels of permissions for certain IPs or ranges; it’s just brute force blocking. An IP is blocked or it isn’t. There’s granular permissions at the usergroup level. ---
**Author:** ![FXMastermind](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fxmastermind/32/7289_2.png) [@FXMastermind](https://boards.straightdope.com/u/FXMastermind)\ **Post date:** [July 3, 2013, 6:33pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/59 "2013-07-03T18:33:56Z")
Well, in that case blocking entire countries is going to be beast for the board, in terms of stopping the above mentioned malicious traffic. Sure nobody in those countries can read, register or post. But who cares? ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [July 3, 2013, 6:43pm UTC](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509/60 "2013-07-03T18:43:41Z")
> [@bobot](#): > > I once put an entire load of socks into the washing machine. When the cycle was complete, half of them were missing. I put the remaining socks into the dryer, and when that cycle was complete, the machine was empty. 😕 You’ve heard of Chupacabra, the Goat Sucker? You have been a victim of the Sock Sucker. [Previous page](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509.md?page=2) [Next page](https://boards.straightdope.com/t/why-cant-socks-be-easily-detected/661509.md?page=4)