Paysite owners: What's your IP threshold? - GoFuckYourself.com

CheeseFrog · 09-12-2004, 06:03 PM

Those of you who run IP tracking software like Pennywize or whatever, what do you set your unique IP limit to before the user is suspended? Just curious. I have mine set to 10 and was wondering if that might be too high. And do you explicitly tell the surfer that "You have X number of unique logins"?

james_clickmemedia · 09-12-2004, 06:19 PM

beleive ours is set to 5

chupacabra · 09-12-2004, 06:20 PM

5 here as well, but no Pennywise... we use PWSentry..!

Dawgy · 09-12-2004, 06:33 PM

proxypass... its set to 5 i believe, and has caught more shit than pwsentry or pennywise ever caught. bandwidth usage is down & joins are up.

Jace · 09-12-2004, 06:34 PM

stevo · 09-12-2004, 06:38 PM

15, if i had it set at 5 about 25% of my subscribers would be blocked.

Even with pennywize im having trouble with people hacking accounts, even my own personal user/pass was hacked. Everythings chmodded correctly so i dont know whats up or what else to do.

xclusive · 09-12-2004, 06:41 PM

I've got it set at 10

CheeseFrog · 09-12-2004, 06:50 PM

Quote:

Originally posted by Dawgy
proxypass... its set to 5 i believe, and has caught more shit than pwsentry or pennywise ever caught. bandwidth usage is down & joins are up.

What is special about proxypass that makes it that much more effective than Pennywize or PasswordSentry? Don't they all just keep track of unique IP's that are associated with a given login/pw?

Dawgy · 09-12-2004, 07:22 PM

Quote:

Originally posted by CheeseFrog
What is special about proxypass that makes it that much more effective than Pennywize or PasswordSentry? Don't they all just keep track of unique IP's that are associated with a given login/pw?

i have no idea. all i know is its catching more from day one...

ShaneRyale · 09-12-2004, 07:50 PM

I use ProxyPass. It was set to 7, but I've lower it to 5 and it seems to be working well there.

PR_Dave · 09-12-2004, 08:10 PM

I have mine between 10-20.

keyboard warrior · 09-12-2004, 08:14 PM

raymor · 09-12-2004, 10:16 PM

If only it were that simple.
With Strongbox we set parameters for the number
of unique ip _RANGES_ in a two hour period if none
of the ips are proxies,
the number of unique ip ranges in a 48 hour period if none
are proxies, the number of different countries those IPs
can be from in a 2 hour period and a 48 hour period, and then
ll of those same settings if any of the IPs are open proxies,
then again the same settings if some are AOL proxies.

I don't think it's possible to come up with a single number
tjhat would be at all effective with a system like Pennydumb
and indeed when we install Strongbox to replace Pennydumb
on a site we generally see about 10-20 usernames
get busted that Pennydumb hadn't detected within the first 48 hours.

angelsofporn · 09-12-2004, 10:35 PM

I had ours set to 10 a long time ago for about 3 days and i was getting 50 emails a day from AOL users saying they are blocked.
AOL users get a different ip every time they login. Hardcore porn surfers might login to your site 20-30 times in a day...you will lose money with that setting i think.

puremember · 09-13-2004, 06:34 AM

Quote:

Originally posted by stevo
Even with pennywize im having trouble with people hacking accounts, even my own personal user/pass was hacked. Everythings chmodded correctly so i dont know whats up or what else to do.

Pennywize does the job detecting who's gotten in, but it doesn't do as well preventing them from getting in. Its brute force attack protection algorithm is rather simplistic. In this age of open proxy servers counting an IPs 401 requests against a threshold just doesn't cut it.

Quote:

Originally posted by CheeseFrog
What is special about proxypass that makes it that much more effective than Pennywize or PasswordSentry? Don't they all just keep track of unique IP's that are associated with a given login/pw?

That about sums it up, however, different systems track different IP ranges. Pennywize, for example, tracks Class C subnets (ie. 1.1.1.*). Since many larger ISPs own multiple Class C IP blocks unless you set your thresholds rather high, you'll get false positives.

Our own system, PureMember, tracks slightly larger IP ranges so we've set our default threshold to 2 without any problems.

Shinjin
puremember.com

sirrobin · 09-13-2004, 08:00 AM

On Iprotect we ban when more than 3 different Class C IP try the same username

09-12-2004, 06:03 PM	#1
CheeseFrog Confirmed User Industry Role: Join Date: Dec 2003 Location: AZ Posts: 1,724	Paysite owners: What's your IP threshold? Those of you who run IP tracking software like Pennywize or whatever, what do you set your unique IP limit to before the user is suspended? Just curious. I have mine set to 10 and was wondering if that might be too high. And do you explicitly tell the surfer that "You have X number of unique logins"? __________________ Cary \| AIM: cheesefrog \| ICQ: 4287002

09-12-2004, 06:19 PM	#2
james_clickmemedia Confirmed User Join Date: Apr 2003 Location: Texas / London Posts: 2,204	beleive ours is set to 5 __________________ $ CLICKMEMEDIA.COM $ CONVERTING ETHNIC TRAFFIC SINCE 1998 ~ $30+PPS BLACK-X.COM - NEW BLACK EX-GF SITE CLICKMEMEDIA.COM ~ ICQ - 8788771

09-12-2004, 06:41 PM	#7
xclusive Too lazy to set a custom title Join Date: Apr 2004 Location: Buffalo, NY Posts: 35,218	I've got it set at 10 __________________ I support MediumPimpin.com / Shemp's Outlawtgp.com /

09-12-2004, 07:50 PM	#10
ShaneRyale Confirmed User Join Date: Mar 2004 Posts: 961	I use ProxyPass. It was set to 7, but I've lower it to 5 and it seems to be working well there. __________________ Shane - Affiliate Manager [email protected] ICQ: 170164556 See Who I Am At AdultWhosWho.com!

09-12-2004, 08:14 PM	#12
keyboard warrior Confirmed User Join Date: Jul 2004 Posts: 1,435	10 __________________ - nothing here -

09-12-2004, 06:20 PM	#3
chupacabra Confirmed User Join Date: Sep 2002 Posts: 3,626	5 here as well, but no Pennywise... we use PWSentry..!

09-12-2004, 06:33 PM	#4
Dawgy Confirmed User Join Date: Jul 2001 Posts: 5,856	proxypass... its set to 5 i believe, and has caught more shit than pwsentry or pennywise ever caught. bandwidth usage is down & joins are up.

09-12-2004, 06:34 PM	#5
Jace FBOP Class Of 2013 Industry Role: Join Date: Jan 2004 Location: bumfuck, ky Posts: 35,562	5

09-12-2004, 06:38 PM	#6
stevo Confirmed User Join Date: Aug 2002 Location: Orlando, Florida Posts: 2,051	15, if i had it set at 5 about 25% of my subscribers would be blocked. Even with pennywize im having trouble with people hacking accounts, even my own personal user/pass was hacked. Everythings chmodded correctly so i dont know whats up or what else to do.

09-12-2004, 08:10 PM	#11
PR_Dave Confirmed User Industry Role: Join Date: Jul 2003 Location: Italy Posts: 2,792	I have mine between 10-20.

09-12-2004, 10:16 PM	#13
raymor Confirmed User Join Date: Oct 2002 Posts: 3,745	If only it were that simple. With Strongbox we set parameters for the number of unique ip _RANGES_ in a two hour period if none of the ips are proxies, the number of unique ip ranges in a 48 hour period if none are proxies, the number of different countries those IPs can be from in a 2 hour period and a 48 hour period, and then ll of those same settings if any of the IPs are open proxies, then again the same settings if some are AOL proxies. I don't think it's possible to come up with a single number tjhat would be at all effective with a system like Pennydumb and indeed when we install Strongbox to replace Pennydumb on a site we generally see about 10-20 usernames get busted that Pennydumb hadn't detected within the first 48 hours. __________________ For historical display only. This information is not current: support@bettercgi.com ICQ 7208627 Strongbox - The next generation in site security Throttlebox - The next generation in bandwidth control Clonebox - Backup and disaster recovery on steroids

09-12-2004, 10:35 PM	#14
angelsofporn Confirmed User Join Date: Mar 2002 Location: CA Posts: 3,218	I had ours set to 10 a long time ago for about 3 days and i was getting 50 emails a day from AOL users saying they are blocked. AOL users get a different ip every time they login. Hardcore porn surfers might login to your site 20-30 times in a day...you will lose money with that setting i think.

09-13-2004, 08:00 AM	#16
sirrobin Confirmed User Join Date: Jun 2003 Posts: 453	On Iprotect we ban when more than 3 different Class C IP try the same username