I suspect a spam a-comin'

[edshuck]

Hi everyone,

I may get a registration once in a blue moon. So when I do, I look them over.

One came in an hour ago from a url on Niccosia, Cy. This is a bit odd since I am a neighborhood site in San Francisco, CA.

The IP is from Montevideo, Uy (Uruguay).

I await act two of this. No posts yet. But it is not lookin' good.

ed

[golfer adam]

Get some more moderators on hand so you are prepared, also just report the ip adress and they person will be blocked form the site, I konw people can just sign up at librarys and stuff but it is better than nothin.

[edshuck]

If / when spam starts, I will immediately report the ip and the userid to this forum.

Until then I can only wait.

[BamaStangGuy]

If / when spam starts, I will immediately report the ip and the userid to this forum.

Until then I can only wait.

Mostly likely just a bot. Do you have image verification on? Email activation. Check the email address and see if it is valid.

[edshuck]

Mostly likely just a bot. Do you have image verification on? Email activation. Check the email address and see if it is valid.

GOOD questions and yes to all three. I sent an eMail and did not get a bot reply (bounced eMail) so I guess it is going through. Any other way to check.

[ethank]

We had a bunch of .biz registrations this morning from a spammer. I just banned that domain from registering, which seems to have abated it for a bit.

What is with the amount of board spammers lately?

[golfer adam]

What is with the amount of board spammers lately?

I have been wondering that myself at are golf forum there is usually nothing but this week some guy signed up and posted like 10 ebay links in 5 minutes.

[edshuck]

What was the url of the spammer? and/or the ip?

I hesitate to post my potential since he has not shown himself to be a spammer yet.

[TVB]

I am facing the same situation. A user with the domain lightblondvagina.biz registered with an IP I had been watching because it seemed to be a bot trying to register for several days now. We use image and email verification so whoever it is was definitely determined.

New users don't get PM or member list info until at least 5 days or 5 posts have passed, which keeps most of the voyeurs at bay but this one seems to have patience. Our forums deals with some sensitive issues and we do get creeps wandering in occassionally and the 5 day "probation" period almost always loses them.

To see if it really was a legit email address, I sent the following to the address used:

My name is <removed> and I am the administrator of the <removed> forums.

Due to the email address you used to register, I have placed you on moderation. With moderation, all of your posts will need to be cleared by a moderator before they will be shown. Additionally, you will be unable to access member profiles and private messaging. If you attempt to circumvent the moderation process by registering under another URL without contacting me first, I will be forced to ban your IP.

The reasons behind this are simple. The main one is the domain name which itself is two fold. Can you tell me more about "lightblondvagina.biz"?

We also frown upon .biz emails as they almost always are from spammers. This is not implying that is your intent, but our goals are to keep integrity in our community; until a member using an email with a .biz extension proves they are not spamming, moderation is in place.

Feel free to send feedback if my concerns are mistaken.

Can you tell me why you joined our forum? And what you hope to gain from it?

The IP traces back to Argentina and while we are an international site, most never register from a custom domain because it's not a tech site at all. I don't think more than a few have their own sites.

I came searching for a way to simply ban all .biz emails so may as well ask it here until I find a better place to.

Will simply banning @.biz work?

Thanks,

Betsy

[edshuck]

I do not know but hopefully someone here will.

[TVB]

Well, had I scanned a few more posts down after searching .biz, I would discovered this tidbit: http://www.vbulletin.com/forum/showt...&highlight=biz

Betsy
---tottering off to just ban the m*f*.

[Alex Apple]

This lot were doing the rounds a month or so ago - my site escaped the first wave but we had a similar registration yesterday (from a bagelsandcreamcheese.biz email address).

There's a thread this board somewhere, and on TAZ, giving more details and potential IP numbers to ban.

If it is a bot, it's managed to get round both image verification and email confirmation on my site.

[ManagerJosh]

Here's more spam:

http://www.vbulletin.com/forum/showt...wpost&t=133313

[edshuck]

Yep, it started. Sure as KFC fries chicken. Here is the one i got.

Got to go clean forum.

ed

eMail [email protected]

ip 200.73.174.183


Hello,norberto492 has just posted in the Federal Politics forum of Noe Valley Forums under the title of Hi Guys. First Time Poster.This thread is located at http://www.noevalley.com/forum/showthread.php?threadid=658Here is the message that has just been posted:***************Hi guys. First time poster long time reader.Just wanted to say "Hi" On a side note my Hubby is REAL excited aboutthis new IPO stock GRDX. They just started tradingthis one like 2 days ago. It's already almostdoubled in just 2 days! My Husband is reallyexcited about this stock. Say's it could make us some really BIG money. You guys should check it out.Just spreading the wealth Go to http://www.otcbb.com and check symbol : GRDX you will see how big thegrowth is Let me know what you guys think ***************

[MJM]

I got one yesterday from...

[email protected]

200.73.174.183

Note the IP is the same as in previous post

As I've never had to ban an email addy or IP yet, what would be suggested here... ban the addy, or IP.

This user hasn't posted in yet.

Mark