To the forum moderators and to eFrontier, or Mike...

heyvern · Post by **heyvern** » Tue Dec 12, 2006 1:46 am

What about email confirmation? Is that automated by the spammers as well?

All the forums I have signed up for requires an email confirmation response.

My own family forum has more trouble signing up legitimate family members and we KNOW everyone. I had to wait for a day before I could post suggestions for the next reunion.

I suggest it be as hard as possible to sign up. You only have to do it once. Small price to pay to keep out the undesirables. How is that efrontier AS forum? Does anyone use that one? Do they have a lot of spam?

White text on a gray background... maybe the spammers hate that?

-vern

Rasheed · Post by **Rasheed** » Tue Dec 12, 2006 2:20 am

heyvern wrote:What about email confirmation? Is that automated by the spammers as well?

That's easy as pie for them. Good spammers have there mail sent from zombie-pcs. Writing a script that receives mail, searches for a conformation link, and activates that shouldn't be too difficult. I guess these packages are sold to spammers for as little as 10 dollars, about the same amount you pay for packages that exploit undiscovered and zero-day attacks on Windows.

How is that efrontier AS forum? Does anyone use that one? Do they have a lot of spam?

They have been lucky so far, probably because they use different forum software. That's security by obscurity.

I surely hope that Vista is a safer environment, because XP has given us only zombie pcs and lots of spam.

Post by **Víctor Paredes** » Tue Dec 12, 2006 2:52 am

heyvern wrote:My own family forum

wow...

artfx · Post by **artfx** » Tue Dec 12, 2006 4:10 am

Well, the E-Frontier AS forum is still part of their huge ocerall forum which has something like 98,000 members. That's gotta be a prime target for spammers. They must have good security.

bupaje · Post by **bupaje** » Fri Dec 22, 2006 6:36 pm

That b___ spears spammer is really active. Has been sending batches of 12 once per hour. I contacted several places to file complaints and try to get his domain revoked but it will be tough to control this way. Not sure if Mike is around but as a thought if the forum has an obscenity filter that automatically **** words on a bad word list can you put in britneyspears and some variants? Would this at least 'break' the urls for this clown?

Touched · Post by **Touched** » Fri Dec 22, 2006 8:23 pm

I was getting several Britney spams on my guestbook every day a few months ago, and deleting them, until I finally had enough and changed the guestbook so that I would have to approve any new posts before they would appear. That dramatically slowed down the amount of spam. Now I only have 1 every few weeks or so. But I just can't figure out who is still interested in Britney Spears anyway?

heyvern · Post by **heyvern** » Fri Dec 22, 2006 11:22 pm

I am getting tired.

If I could delete every post from one user it would be a piece of cake but I have to delete each post one at a time. Takes too long.

There has to be a better way. How do these guys have "better tools" for submitting than we have to delete them?

Is there a way to delete all messages from one user?

-vern

Touched · Post by **Touched** » Fri Dec 22, 2006 11:29 pm

I'm sure the good guys have as many tools available as the spammers do...it's just a matter of getting them installed on the forum and/or available to the moderators.

bupaje · Post by **bupaje** » Fri Dec 22, 2006 11:44 pm

heyvern wrote:Is there a way to delete all messages from one user?

Not as far as I know -with the mod settings- though maybe the admin settings might allow it.

bupaje · Post by **bupaje** » Sat Dec 23, 2006 12:07 am

Maybe LM can block these IP ranges listed here. I looked several of the Britney spams IP addresses up and they are hosted here. Looked for him on the net and there are also some shopping scam websites hosted there and he is on several 'block' lists as well. He may or may not be sending them himself -may just be a low cost ISP for all I know but either way if you can block this IP range it might knock out a bunch of this stuff.

Completewhois.Com Whois Server, Version 0.91a33, compiled on May 28, 2006
Please see http://www.completewhois.com/help.htm for command-line options
Use of this server and any information obtained here is allowed only
if you follow our policies at http://www.completewhois.com/policies.htm

[IPv4 whois information for 203.121.69.153 ]
[whois.apnic.net]
% [whois.apnic.net node-1]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 203.121.64.0 - 203.121.127.255
netname: TIMETELEKOM
descr: TIME Telecommunications Sdn Bhd
descr: Kuala Lumpur
country: MY
admin-c: AM59-AP
tech-c: AM59-AP
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
remarks: This object can only be updated by APNIC hostmasters.
remarks: To update this object, please contact APNIC
remarks: hostmasters and include your organisation'"'"'s account
remarks: name in the subject line.
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
mnt-by: APNIC-HM
mnt-lower: MAINT-MY-TTNET
mnt-routes: MAINT-MY-TTNET
changed: hostmaster@apnic.net 20000510
changed: hostmaster@apnic.net 20010712
status: ALLOCATED PORTABLE
changed: hm-changed@apnic.net 20040708
source: APNIC

person: Azmy Mohamad Yusof
nic-hdl: AM59-AP
e-mail: azmy@isp.time.net.my
e-mail: abuse@isp.time.net.my
address: TIMEdotNet Bhd
address: Level 3, Lot 14 Jalan U1/26 Glenmarie HICOM Industrial Park 40000
address: Shah Alam Selangor Malaysia
address: [abuse] abuse@isp.time.net.my
phone: +6-03-50326131
fax-no: +6-03-50326204
country: MY
changed: azmy@isp.time.net.my 20030217
mnt-by: MAINT-MY-TTNET
source: APNIC

Rhoel · Post by **Rhoel** » Sun Dec 24, 2006 9:21 am

I have already sent copies of this guys posts to TIMEdotNet Bhd, the IP block admins.

Between Mike and the abuse@isp.time.net.my, it might stop.

heyvern · Post by **heyvern** » Sun Dec 24, 2006 10:53 am

I just can't help myself. I keep deleting spam...

I swore I was going to stop because it never ends but I just can't help myself.

I have a system now that helps. I load the list of all the posts from a spammer and then open every spam in a separate tab in Firefox and delete each one and close the tab. Goes really quick. I don't have to scroll at all to find the posts.

I am convinced this is some sort of targeted attack though. Maybe this guy missed the free upgrade... or he hates the drawing tools.

-vern

heyvern · Post by **heyvern** » Sun Dec 24, 2006 11:11 pm

There is another issue regarding all these spammers signing up.

One of the "tactics" is to register and never post anything. A link is placed in the user profile to boost search engine results. Spiders view those user profiles.

They do this on a ton of servers and create false search engine results for the sites they are promoting.

I wish we could delete users.

I've lost count now on the amount of spam removed in just 24 hours. Probably 100-150-200-300? I lost count. I usually kill about 20 every time I check in. They added one of my threads to their "list"... got me all riled up.

I love keeping the forum spam free!. They are doing this over the holiday on purpose. They know people aren't keeping up. BUT I AM DAGNABBIT!

Merry Christmas!

I'm off to spend the eve with my family. Play with the nephews, take the puppy out to poo. Eat home made cookies. Watch Ice Age for the billionth time. Argue about politics.

I plan to dump another bunch of spam later tonight. Maybe Santa can lend me a hand? I will give him the IP address of this evil monster and he can put coal in his stocking.

-vern

Touched · Post by **Touched** » Sun Dec 24, 2006 11:45 pm

We can sic Père Fouettard on the spammers. ^_^

Post by **Víctor Paredes** » Mon Dec 25, 2006 1:07 am

Touched wrote:Père Fouettard

i didn't knew about him. that's is interesting.