Hello Spammer; Goodbye Spammer !!

[Seiko7A38]

I haven't recorded every spammer that I've banned and deleted recently, but while I remember, there were a couple more who newly registered late last night. No great surprise, the IP addresses were located in the Russian federation:

Spammers-NewlyRegistered-Russian-x2-22-04-2021.png (24.26 KiB) Viewed 12414 times

They claimed to be 'on holiday' in more exotic locations. They're now taking a rather more permanent vacation.
For the record (to remind me), including the 2 above, that's now a total of 39 I've banned and deleted in one week.

One week on, more of the same.

Spammers-NewlyRegistered-Russian-x2-29-04-2021.png.png (24.02 KiB) Viewed 12414 times

Two more Russian spammers caught napping and despatched while still inactive this afternoon. Ivan and Svetlana have been exiled to a rather less exotic location than where they claimed to be. They used different email addresses, but shared a common proxy IP address, located in Romania. (Note to self: for the record, they were users #111 and #112).

By a quick bit of mental arithmetic: I've actually deleted a total of 39 (mostly Russian) spammers in the last week !

Perhaps things are gradually slackening off. Those two bring my tally to 49 banned, blocked and summarily deleted.

[Seiko7A38]

To my surprise and annoyance, 'Ivan and Svetlana' were back again this morning as newly registered inactive members.

Spammers-NewlyRegistered-Russian-x2-30-04-2021.png (24.16 KiB) Viewed 12395 times

Note once again, their imaginative choice of exotic locations. They used the same email addresses as previously, but punctuated differently, with numerous full stops inserted. This time they shared a proxy IP address located in Moldova. As best I can tell, or remember, this is the first recurrence of a Russian spammer(s) managing to register a second time. I suspect they're just another smarter than average automated spam bot, but let's see if they try again.

[Seiko7A38]

I can't even finish my breakfast of Spam fritters, scrambled eggs and tomatoes in peace !
This Russian spammer registered while I was unpacking my food shopping after coming back from the supermarket.

Spammer-Andrewled-30-04-2021-Deleted.png (21.33 KiB) Viewed 12378 times

I suspect Andrew's another returnee (under a different alias, possibly 'Joshualow'), because when I came to block his IP address (incidentally located in Finland, not Yugoslavia), there was already a very similar IP address in the blocked list. So, I've blocked the entire range. While I was cooking my breakfast he managed to rattle off this single post - an odd mix of alpha-numeric gobbledegook and cyrillic.

Spam-AlphaNumeric+Cyrillic-30-04-2021-Post.png (54.47 KiB) Viewed 12378 times

[Seiko7A38]

Bugger me ! Svetlana snuck back in under the radar late this morning !!

Spammer-Svetlana-30-04-2021-Deleted.png (21.6 KiB) Viewed 12370 times

This time, their IP address location showed as Ukraine and funnily enough was close to another I'd blocked previously, so again I've blocked that entire range of IP's. Anyway, I've had enough of this silly game. Tomorrow, May Day is a favourite Russian national holiday. Automated bots or not, they're going to observe it and leave me in peace. I've seen to it.

[Seiko7A38]

The forum has been SPAM free for exactly one week. The Q&A counter-measure appears to have done the trick.

[Seiko7A38]

This morning, the forum suffered its first SPAM attack in nearly 12 months, from a newly joined member ARMAN.

Spammer-ARMAN-28-04-2022.png (34.99 KiB) Viewed 10605 times

He made 10 almost identical posts (on the subject of obtaining fake documents) in many of the more popular sections.

Spammer-ARMAN-28-04-2022-Posts-Forums.png (165.92 KiB) Viewed 10605 times

Although given 2 different titles, the message's content was the same (and about 3 times the length of my screen shot).

Spammer-ARMAN-28-04-2022-Post.png (65.25 KiB) Viewed 10601 times

On his profile, he stated a location of Italy but checking the IP address pointed to Madrid, Spain.

Spammer-ARMAN-28-04-2022-Details.png (22.48 KiB) Viewed 10599 times

A quick search on stopforumspam.com reveals he's been attacking other forums from a variety of different IP addresses (countries include: Czechoslovakia, UK and USA), so it's obvious he's using a proxy / VPN. He also uses other ID's besides ARMAN, including TIMMGG. The email address appears to be a common factor, but I suspect he has plenty of others.

Spammer-ARMAN-28-04-2022-StopForumSPAM.png (91.55 KiB) Viewed 10599 times

Needless to say he's been banned and his posts deleted. My only real concern is how he managed to register in the first place. It's probably time I changed the security question.

[Seiko7A38]

What is, in all likelihood, the same spammer returned in the early hours of this morning, registering as member TERET.

Spammer-TERET-30-04-2022-Profile.png (33.69 KiB) Viewed 10587 times

This time, they used a completely different IP and email addresses (as I'd predicted in my previous post).

Spammer-TERET-30-04-2022-Overview.png (27.84 KiB) Viewed 10587 times

Although they had ample opportunity, while I was asleep, they only made two posts in the General Discussion section.

Spammer-TERET-30-04-2022-Posts-General-Forum.png (64.88 KiB) Viewed 10584 times

The (full) wording of the two posts is exactly the same as before:

Spammer-TERET-30-04-2022-Post.png (71.4 KiB) Viewed 10584 times

Naturally I looked them up on stopforumspam.com. There was no exact match for 'TERET' ....

stopforumspam-TERET.png (103.12 KiB) Viewed 10582 times

But other spammers using the same gmail address had been reported a couple of times earlier this year:

stopforumspam-ammo49gmail.png (16.88 KiB) Viewed 10582 times

Needless to say, I've banned them and deleted their posts. I've also asked the question on stopforumspam.com.

[Seiko7A38]

The thread I started on stopforumspam.com's forum, entitled: Smarter than average spambot ? was close to the mark. Overnight, it received a couple more replies, but this one posted yesterday evening by moderator Alex Kemp was the most helpful, if not exactly encouraging.

Stopforumspam-Reply-AlexKemp.png (31.18 KiB) Viewed 10570 times

Yes indeed, having googled it, XRumer definitely sounds a nasty piece of work and I guess our spammer must be using it.

[Seiko7A38]

This week I've started noticing heightened levels of visitor activity. I wonder how many of them are spambots ?

Seiko7A38-Forum-Activity-05-05-2022.png (9.37 KiB) Viewed 10544 times

Edit: The situation 5 minutes later.

Seiko7A38-Forum-Activity-05-05-2022-63.png (9.43 KiB) Viewed 10542 times

[Seiko7A38]

That inflated visitor number peaked @ 82 yesterday evening:

Seiko7A38-Forum-Activity-05-05-2022-82.png (9.09 KiB) Viewed 10535 times

[Seiko7A38]

Looks like the bots were out in force again, earlier this morning. This is what I found at the bottom of the forum home page when I logged on just before 7:00 am. 79 supposed guests !!

Seiko7A38-Forum-Activity-12-05-2022-80-UsersOnline.png (9.33 KiB) Viewed 10488 times

[Seiko7A38]

The bots were swarming around again this afternoon. Didn't quite manage to break Monday's record high count though.

Seiko7A38-Forum-Activity-18-05-2022-108.png (9.58 KiB) Viewed 10446 times

[Seiko7A38]

The bots were swarming around again at lunchtime today - this time they broke the previous record.

Seiko7A38-Forum-Activity-18-07-2022-124.png (9.33 KiB) Viewed 7911 times