An IP blocklist is a list of internet addresses known for sending spam or bot traffic. When a visitor arrives, their address is checked against the list, and a listed address is turned away.
That worked when bots ran from a handful of servers. A server keeps the same address for months, so once it was caught, it stayed caught.
Bots now borrow home connections
Today, anyone running bots can rent ordinary home internet connections, paid by the gigabyte, for very little. Each visit can come from a different household, and the address changes every few minutes.
On one small website, a single group of bots used 281 different home addresses in one afternoon. Checked against a well-known IP reputation service at the moment they visited, about 92% of those addresses weren't on its list.
Why the lists can't catch up
- An address is only listed after it has sent spam, and by then the bot has moved on to the next one.
- The rest of the time, that address belongs to a real household. Blocking it blocks them too.
- New addresses come into use every day, faster than any list can check them.
The address changes every few minutes. The bot doesn't.
What works better
Look at the whole visit, not just the address. Rabbitproof checks each visit and blocks it only when something about it doesn't add up, or when that device has been caught before. A real person on a shared or changing address still gets through.
An address is still a useful clue. It just can't be the whole answer.
Filter spam bots without losing customers
Rabbitproof filters spam bots and bot traffic on WordPress and any other website.
RabbitproofBot and spam protection for small websites.
