I suspect a spam a-comin'

[edshuck]

I need to know that as well. I just dumped him/her. A couple of years ago, during one of these that was really crazed, the theory was to edit the user masks to deny all posting rights.

I wonder what that would do to a bot? Anyone know?

Soon to find out. bart224 just registered and is awaiting eMail confirmation with the standard ip and the lightblondvagina.biz and the mid pacific time zone.

Later.

[bglynn]

I have had the same things on my board. They started registering a couple weeks ago but I didn't notice - I get dozens of registrations a day. A username cought my eye yesterday and I investigated to find 20 or so of these .biz registrations, one that had posted a couple test messages. I then deleted all the registrations and turned image verification back on. I don't like using it because SO many of my users are so utterly stupid, that it prompts emails and phone calls for troubleshooting. Anyway, it did no good. I had two more registrations and the same canned spam, posted. So much for image verification being any kind of help.

I banned all .biz emails, since I only have 2 of 7500 users actually using one. The IP and domains are the same as listed above. luckily so far they are all very easy to filter. Funny, they are probably reading these forums right now to gain insights and adapt. I expect non .biz domains next.

[ManagerJosh]

Apparently that guy has no limits...

He struck my forum today...

[email protected]

200.73.174.183


Edit: O, and I traced the IP, and it goes back to Argentina.....near a town called "Moron"

Edit 2: Everyone submit a complaint about the bakedpotato guy over at http://www.enom.com/help/abusepolicy.asp

It's his domain registrar....and hopefully they'll make his life miserable.

[HexOnxOnx]

I had one of these on my all but dead forum yesterday and I now had another register all with the same email. The one yesterday got in a post identical to the one posted on this forum here. I did ban the users and the IP.

[biggazillakilla]

Just my opinion, Ed, but I think it would be a good idea to edit out some of the details, as posting the entire message helps get the word out for this spammer.

I don't mean this in the wrong way, of course, but I assume you know that and remember me.

Yep, it started. Sure as KFC fries chicken. Here is the one i got.

Got to go clean forum.

ed

eMail [email protected]

ip 200.73.174.183


Hello,norberto492 has just posted in the Federal Politics forum of Noe Valley Forums under the title of Hi Guys. First Time Poster.This thread is located at http://www.noevalley.com/forum/showthread.php?threadid=658Here is the message that has just been posted:***************Hi guys. First time poster long time reader.Just wanted to say "Hi" On a side note my Hubby is REAL excited aboutthis new IPO stock XX. They just started tradingthis one like 2 days ago. It's already almostdoubled in just 2 days! My Husband is reallyexcited about this stock. Say's it could make us some really BIG money. You guys should check it out.Just spreading the wealth Go to http://www. X X.com and check symbol : X X you will see how big thegrowth is Let me know what you guys think ***************

[ManagerJosh]

I'm really wondering if it is a BOT. Because the IP matches the Server IP.

[mbaskett]

I'm really wondering if it is a BOT. Because the IP matches the Server IP.

I believe you are correct on this one. I have seen two registrations in the past two days that use this very same IP address. Both passed e-mail and image verification, and both seem to have the similar username makeup... semi-common name followed by 3 digits. Both came from the .biz domain, but the most interesting thing about the accounts they both registered at EXACTLY noon.

As for me, my site doent' get alot of traffic, so both accounts were immediately banned, and '.biz' added to the banned e-mail addresses. Hopeflully that will put it at bay, but I fear that if this is a bot or automated script, that it can be sold/shared with other spammers, and further developed to be much more of a PITA to hold at bay...

[ManagerJosh]

I'm going to put a bug ticket in this and get a dev to follow up on this to see what's going on. Because this is starting to become a progressive problem.

I've counted two usernames:

enrique249
[email protected]
DOB: Jan 1 1969
IP:200.73.174.183


marcelino894
[email protected]
DOB: Jan 1 1969
200.73.174.183


Bug Submitted: http://www.vbulletin.com/forum/bugs....iew&bugid=3926

[bplinson]

I've got him also with different username but same IP and b-day

gonzalo226
[email protected]

reinaldo962
[email protected]

I blocked IP and .biz email registration. I only have one legit user with .biz

[digitalhome]

I'm getting 4 or 5 a day now.

I only want users from Canada and US so I've put 200.73 in the banned IP. Hope I haven't lost some people!

[sydude]

I just got two registrations with that IP address, but from the bagelandccreamcheese.biz address. They posted one of those stock pick posts. Time to ban the IP I guess.

[bplinson]

I'm getting 4 or 5 a day now.

I only want users from Canada and US so I've put 200.73 in the banned IP. Hope I haven't lost some people!

Sounds like a good idea especially if you do not have any members from Argentina. I am doing the same thing.

[digitalhome]

We need to stop this at the source. See my post here and lets stop these spammers.

[bglynn]

Actually, what we NEED is a registration system to prevent BOTs.

[trekwarfare]

Got my site too, alex356 or something. Just deleted the post and user and banned the bangelandcreamcheese.biz email addy.

Have to wait and see if I get anymore.