Hello Spammer; Goodbye Spammer !!

[Seiko7A38]

I haven't recorded every spammer that I've banned and deleted recently, but while I remember, there were a couple more who newly registered late last night. No great surprise, the IP addresses were located in the Russian federation:

Spammers-NewlyRegistered-Russian-x2-22-04-2021.png (24.26 KiB) Viewed 17195 times

They claimed to be 'on holiday' in more exotic locations. They're now taking a rather more permanent vacation.
For the record (to remind me), including the 2 above, that's now a total of 39 I've banned and deleted in one week.

One week on, more of the same.

Spammers-NewlyRegistered-Russian-x2-29-04-2021.png.png (24.02 KiB) Viewed 17195 times

Two more Russian spammers caught napping and despatched while still inactive this afternoon. Ivan and Svetlana have been exiled to a rather less exotic location than where they claimed to be. They used different email addresses, but shared a common proxy IP address, located in Romania. (Note to self: for the record, they were users #111 and #112).

By a quick bit of mental arithmetic: I've actually deleted a total of 39 (mostly Russian) spammers in the last week !

Perhaps things are gradually slackening off. Those two bring my tally to 49 banned, blocked and summarily deleted.

[Seiko7A38]

To my surprise and annoyance, 'Ivan and Svetlana' were back again this morning as newly registered inactive members.

Spammers-NewlyRegistered-Russian-x2-30-04-2021.png (24.16 KiB) Viewed 17176 times

Note once again, their imaginative choice of exotic locations. They used the same email addresses as previously, but punctuated differently, with numerous full stops inserted. This time they shared a proxy IP address located in Moldova. As best I can tell, or remember, this is the first recurrence of a Russian spammer(s) managing to register a second time. I suspect they're just another smarter than average automated spam bot, but let's see if they try again.

[Seiko7A38]

I can't even finish my breakfast of Spam fritters, scrambled eggs and tomatoes in peace !
This Russian spammer registered while I was unpacking my food shopping after coming back from the supermarket.

Spammer-Andrewled-30-04-2021-Deleted.png (21.33 KiB) Viewed 17159 times

I suspect Andrew's another returnee (under a different alias, possibly 'Joshualow'), because when I came to block his IP address (incidentally located in Finland, not Yugoslavia), there was already a very similar IP address in the blocked list. So, I've blocked the entire range. While I was cooking my breakfast he managed to rattle off this single post - an odd mix of alpha-numeric gobbledegook and cyrillic.

Spam-AlphaNumeric+Cyrillic-30-04-2021-Post.png (54.47 KiB) Viewed 17159 times

[Seiko7A38]

Bugger me ! Svetlana snuck back in under the radar late this morning !!

Spammer-Svetlana-30-04-2021-Deleted.png (21.6 KiB) Viewed 17151 times

This time, their IP address location showed as Ukraine and funnily enough was close to another I'd blocked previously, so again I've blocked that entire range of IP's. Anyway, I've had enough of this silly game. Tomorrow, May Day is a favourite Russian national holiday. Automated bots or not, they're going to observe it and leave me in peace. I've seen to it.

[Seiko7A38]

The forum has been SPAM free for exactly one week. The Q&A counter-measure appears to have done the trick.

[Seiko7A38]

This morning, the forum suffered its first SPAM attack in nearly 12 months, from a newly joined member ARMAN.

Spammer-ARMAN-28-04-2022.png (34.99 KiB) Viewed 15386 times

He made 10 almost identical posts (on the subject of obtaining fake documents) in many of the more popular sections.

Spammer-ARMAN-28-04-2022-Posts-Forums.png (165.92 KiB) Viewed 15386 times

Although given 2 different titles, the message's content was the same (and about 3 times the length of my screen shot).

Spammer-ARMAN-28-04-2022-Post.png (65.25 KiB) Viewed 15382 times

On his profile, he stated a location of Italy but checking the IP address pointed to Madrid, Spain.

Spammer-ARMAN-28-04-2022-Details.png (22.48 KiB) Viewed 15380 times

A quick search on stopforumspam.com reveals he's been attacking other forums from a variety of different IP addresses (countries include: Czechoslovakia, UK and USA), so it's obvious he's using a proxy / VPN. He also uses other ID's besides ARMAN, including TIMMGG. The email address appears to be a common factor, but I suspect he has plenty of others.

Spammer-ARMAN-28-04-2022-StopForumSPAM.png (91.55 KiB) Viewed 15380 times

Needless to say he's been banned and his posts deleted. My only real concern is how he managed to register in the first place. It's probably time I changed the security question.

[Seiko7A38]

What is, in all likelihood, the same spammer returned in the early hours of this morning, registering as member TERET.

Spammer-TERET-30-04-2022-Profile.png (33.69 KiB) Viewed 15368 times

This time, they used a completely different IP and email addresses (as I'd predicted in my previous post).

Spammer-TERET-30-04-2022-Overview.png (27.84 KiB) Viewed 15368 times

Although they had ample opportunity, while I was asleep, they only made two posts in the General Discussion section.

Spammer-TERET-30-04-2022-Posts-General-Forum.png (64.88 KiB) Viewed 15365 times

The (full) wording of the two posts is exactly the same as before:

Spammer-TERET-30-04-2022-Post.png (71.4 KiB) Viewed 15365 times

Naturally I looked them up on stopforumspam.com. There was no exact match for 'TERET' ....

stopforumspam-TERET.png (103.12 KiB) Viewed 15363 times

But other spammers using the same gmail address had been reported a couple of times earlier this year:

stopforumspam-ammo49gmail.png (16.88 KiB) Viewed 15363 times

Needless to say, I've banned them and deleted their posts. I've also asked the question on stopforumspam.com.

[Seiko7A38]

The thread I started on stopforumspam.com's forum, entitled: Smarter than average spambot ? was close to the mark. Overnight, it received a couple more replies, but this one posted yesterday evening by moderator Alex Kemp was the most helpful, if not exactly encouraging.

Stopforumspam-Reply-AlexKemp.png (31.18 KiB) Viewed 15351 times

Yes indeed, having googled it, XRumer definitely sounds a nasty piece of work and I guess our spammer must be using it.

[Seiko7A38]

This week I've started noticing heightened levels of visitor activity. I wonder how many of them are spambots ?

Seiko7A38-Forum-Activity-05-05-2022.png (9.37 KiB) Viewed 15325 times

Edit: The situation 5 minutes later.

Seiko7A38-Forum-Activity-05-05-2022-63.png (9.43 KiB) Viewed 15323 times

[Seiko7A38]

That inflated visitor number peaked @ 82 yesterday evening:

Seiko7A38-Forum-Activity-05-05-2022-82.png (9.09 KiB) Viewed 15316 times

[Seiko7A38]

Looks like the bots were out in force again, earlier this morning. This is what I found at the bottom of the forum home page when I logged on just before 7:00 am. 79 supposed guests !!

Seiko7A38-Forum-Activity-12-05-2022-80-UsersOnline.png (9.33 KiB) Viewed 15269 times

[Seiko7A38]

The bots were swarming around again this afternoon. Didn't quite manage to break Monday's record high count though.

Seiko7A38-Forum-Activity-18-05-2022-108.png (9.58 KiB) Viewed 15227 times

[Seiko7A38]

The bots were swarming around again at lunchtime today - this time they broke the previous record.

Seiko7A38-Forum-Activity-18-07-2022-124.png (9.33 KiB) Viewed 12692 times

[Seiko7A38]

We had our first SPAM attack in over 18 months this lunchtime. A newly created member Italetfidk, allegedly located in Mali, posted this jibberish as a new thread in General Discussion:

ForumSpam-Jibberish-Post-Italetfidk.png (42.1 KiB) Viewed 4131 times

Post and User ID have been deleted and banned.

[Seiko7A38]

Early this morning, while I was still fast asleep in bed, the forum came under attack from another spammer - a newly created ID InkCep, who openly stated their location as Russia. He made 22 posts, all in Cyrillic, containing various links.

ForumSpam-Russian-Postx22-InkCep.png (102.47 KiB) Viewed 3983 times

The fact that he posted them continuously, all in the same thread, made it remarkably easy to delete them.

[Seiko7A38]

It's been a busy morning, behind the scenes. No new SPAM posts, but overnight and earlier this morning, we supposedly gained 34 new members ! 33 of them were 'Inactive', but potential spammers. All had spurious email addresses and the few that I did check had Russian IP addresses, regardless of the variety of stated locations.

Forum-NewMembers(Inactive)-7-02-24-X14.png (37.43 KiB) Viewed 3820 times

Forum-NewMembers(Inactive)-7-02-24-X19.png (66.85 KiB) Viewed 3820 times

This other profile Ashleycrync, which was created while I was deleting the other 33, was a little more complete, but they also had a Russian IP address and a bogus email address, so they're also history !

Forum-Profile-Ashleycrync.png (39.21 KiB) Viewed 3820 times

[Seiko7A38]

Those SPAMbot generated new ('Inactive') user ID's kept on coming - all with spurious email addresses and Russian IP's. Probably one every 5 or 10 minutes. By mid-afternoon, I must have deleted at least another 30 more. Frankly, I got fed up with playing the game. I evidently need to reset the anti-spambot countermeasure question, which has worked amazing well for the last 2½ years. But for expediency's sake, I've simply temporarily disabled new registrations.

Belated Edit: Anti-spambot countermeasure Q&A now changed. Registration re-enabled.That'll fix 'em, I reckon.