Announcement

Collapse
No announcement yet.

I suspect a spam a-comin'

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • #16
    I need to know that as well. I just dumped him/her. A couple of years ago, during one of these that was really crazed, the theory was to edit the user masks to deny all posting rights.

    I wonder what that would do to a bot? Anyone know?

    Soon to find out. bart224 just registered and is awaiting eMail confirmation with the standard ip and the lightblondvagina.biz and the mid pacific time zone.

    Later.
    Last edited by edshuck; Thu 17 Mar '05, 8:11pm.
    Ed Shuck
    noevalley.com

    Comment


    • #17
      I have had the same things on my board. They started registering a couple weeks ago but I didn't notice - I get dozens of registrations a day. A username cought my eye yesterday and I investigated to find 20 or so of these .biz registrations, one that had posted a couple test messages. I then deleted all the registrations and turned image verification back on. I don't like using it because SO many of my users are so utterly stupid, that it prompts emails and phone calls for troubleshooting. Anyway, it did no good. I had two more registrations and the same canned spam, posted. So much for image verification being any kind of help.

      I banned all .biz emails, since I only have 2 of 7500 users actually using one. The IP and domains are the same as listed above. luckily so far they are all very easy to filter. Funny, they are probably reading these forums right now to gain insights and adapt. I expect non .biz domains next.

      Comment


      • #18
        Apparently that guy has no limits...

        He struck my forum today...

        [email protected]

        200.73.174.183


        Edit: O, and I traced the IP, and it goes back to Argentina.....near a town called "Moron"

        Edit 2: Everyone submit a complaint about the bakedpotato guy over at http://www.enom.com/help/abusepolicy.asp

        It's his domain registrar....and hopefully they'll make his life miserable.
        Last edited by ManagerJosh; Thu 17 Mar '05, 9:15pm.
        ManagerJosh, Owner of 4 XenForo Licenses, 1 vBulletin Legacy License, 1 Internet Brands Suite License
        Director, WorldSims.org | Gaming Hosting Administrator, SimGames.net, Urban Online Entertainment

        Comment


        • #19
          I had one of these on my all but dead forum yesterday and I now had another register all with the same email. The one yesterday got in a post identical to the one posted on this forum here. I did ban the users and the IP.
          http://www.icecreamforum.com

          Comment


          • #20
            Just my opinion, Ed, but I think it would be a good idea to edit out some of the details, as posting the entire message helps get the word out for this spammer.

            I don't mean this in the wrong way, of course, but I assume you know that and remember me.

            Originally posted by edshuck
            Yep, it started. Sure as KFC fries chicken. Here is the one i got.

            Got to go clean forum.

            ed

            eMail [email protected]

            ip 200.73.174.183


            Hello,norberto492 has just posted in the Federal Politics forum of Noe Valley Forums under the title of Hi Guys. First Time Poster.This thread is located at http://www.noevalley.com/forum/showthread.php?threadid=658Here is the message that has just been posted:***************Hi guys. First time poster long time reader.Just wanted to say "Hi" On a side note my Hubby is REAL excited aboutthis new IPO stock XX. They just started tradingthis one like 2 days ago. It's already almostdoubled in just 2 days! My Husband is reallyexcited about this stock. Say's it could make us some really BIG money. You guys should check it out.Just spreading the wealth Go to http://www. X X.com and check symbol : X X you will see how big thegrowth is Let me know what you guys think ***************

            Comment


            • #21
              I'm really wondering if it is a BOT. Because the IP matches the Server IP.
              ManagerJosh, Owner of 4 XenForo Licenses, 1 vBulletin Legacy License, 1 Internet Brands Suite License
              Director, WorldSims.org | Gaming Hosting Administrator, SimGames.net, Urban Online Entertainment

              Comment


              • #22
                Originally posted by ManagerJosh
                I'm really wondering if it is a BOT. Because the IP matches the Server IP.
                I believe you are correct on this one. I have seen two registrations in the past two days that use this very same IP address. Both passed e-mail and image verification, and both seem to have the similar username makeup... semi-common name followed by 3 digits. Both came from the .biz domain, but the most interesting thing about the accounts they both registered at EXACTLY noon.

                As for me, my site doent' get alot of traffic, so both accounts were immediately banned, and '.biz' added to the banned e-mail addresses. Hopeflully that will put it at bay, but I fear that if this is a bot or automated script, that it can be sold/shared with other spammers, and further developed to be much more of a PITA to hold at bay...
                Matt Baskett
                www.torquecentral.com

                Comment


                • #23
                  I'm going to put a bug ticket in this and get a dev to follow up on this to see what's going on. Because this is starting to become a progressive problem.

                  I've counted two usernames:

                  enrique249
                  [email protected]
                  DOB: Jan 1 1969
                  IP:200.73.174.183


                  marcelino894
                  [email protected]
                  DOB: Jan 1 1969
                  200.73.174.183


                  Bug Submitted: http://www.vbulletin.com/forum/bugs....iew&bugid=3926
                  Last edited by ManagerJosh; Fri 18 Mar '05, 1:47am.
                  ManagerJosh, Owner of 4 XenForo Licenses, 1 vBulletin Legacy License, 1 Internet Brands Suite License
                  Director, WorldSims.org | Gaming Hosting Administrator, SimGames.net, Urban Online Entertainment

                  Comment


                  • #24
                    I've got him also with different username but same IP and b-day

                    gonzalo226
                    [email protected]

                    reinaldo962
                    [email protected]

                    I blocked IP and .biz email registration. I only have one legit user with .biz

                    Comment


                    • #25
                      I'm getting 4 or 5 a day now.

                      I only want users from Canada and US so I've put 200.73 in the banned IP. Hope I haven't lost some people!

                      Comment


                      • #26
                        I just got two registrations with that IP address, but from the bagelandccreamcheese.biz address. They posted one of those stock pick posts. Time to ban the IP I guess.
                        Last edited by sydude; Mon 3 Jul '06, 8:18am.
                        Team Juicy Racing - The Ultimate Racing School and Race Series Forums and unofficial home of the Skip Barber Racing School & Series

                        Comment


                        • #27
                          Originally posted by digitalhome
                          I'm getting 4 or 5 a day now.

                          I only want users from Canada and US so I've put 200.73 in the banned IP. Hope I haven't lost some people!
                          Sounds like a good idea especially if you do not have any members from Argentina. I am doing the same thing.

                          Comment


                          • #28
                            We need to stop this at the source. See my post here and lets stop these spammers.

                            Comment


                            • #29
                              Actually, what we NEED is a registration system to prevent BOTs.

                              Comment


                              • #30
                                Got my site too, alex356 or something. Just deleted the post and user and banned the bangelandcreamcheese.biz email addy.

                                Have to wait and see if I get anymore.
                                RPG Warfare
                                Choose your Destiny

                                Comment

                                widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.
                                Working...
                                X