Hello Spammer; Goodbye Spammer !!

Includes testing area for you to practice.
User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

Seiko7A38 wrote: Thu Apr 22, 2021 5:18 pm I haven't recorded every spammer that I've banned and deleted recently, but while I remember, there were a couple more who newly registered late last night. No great surprise, the IP addresses were located in the Russian federation:

Spammers-NewlyRegistered-Russian-x2-22-04-2021.png
Spammers-NewlyRegistered-Russian-x2-22-04-2021.png (24.26 KiB) Viewed 13963 times

They claimed to be 'on holiday' in more exotic locations. :roll: They're now taking a rather more permanent vacation. 8-)
For the record (to remind me), including the 2 above, that's now a total of 39 I've banned and deleted in one week. :mrgreen:
One week on, more of the same. :roll:

Spammers-NewlyRegistered-Russian-x2-29-04-2021.png.png
Spammers-NewlyRegistered-Russian-x2-29-04-2021.png.png (24.02 KiB) Viewed 13963 times

Two more Russian spammers caught napping and despatched while still inactive this afternoon. Ivan and Svetlana have been exiled to a rather less exotic location than where they claimed to be. They used different email addresses, but shared a common proxy IP address, located in Romania. (Note to self: for the record, they were users #111 and #112).
Seiko7A38 wrote: Thu Apr 22, 2021 4:44 pmBy a quick bit of mental arithmetic: I've actually deleted a total of 39 (mostly Russian) spammers in the last week ! 8-)
Perhaps things are gradually slackening off. Those two bring my tally to 49 banned, blocked and summarily deleted. :mrgreen:

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

To my surprise and annoyance, 'Ivan and Svetlana' were back again this morning as newly registered inactive members.

Spammers-NewlyRegistered-Russian-x2-30-04-2021.png
Spammers-NewlyRegistered-Russian-x2-30-04-2021.png (24.16 KiB) Viewed 13944 times

Note once again, their imaginative choice of exotic locations. :roll: They used the same email addresses as previously, but punctuated differently, with numerous full stops inserted. This time they shared a proxy IP address located in Moldova. As best I can tell, or remember, this is the first recurrence of a Russian spammer(s) managing to register a second time. I suspect they're just another smarter than average automated spam bot, but let's see if they try again.

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

I can't even finish my breakfast of Spam fritters, scrambled eggs and tomatoes in peace ! :roll:
This Russian spammer registered while I was unpacking my food shopping after coming back from the supermarket.

Spammer-Andrewled-30-04-2021-Deleted.png
Spammer-Andrewled-30-04-2021-Deleted.png (21.33 KiB) Viewed 13927 times

I suspect Andrew's another returnee (under a different alias, possibly 'Joshualow'), because when I came to block his IP address (incidentally located in Finland, not Yugoslavia), there was already a very similar IP address in the blocked list. So, I've blocked the entire range. While I was cooking my breakfast he managed to rattle off this single post - an odd mix of alpha-numeric gobbledegook and cyrillic.

Spam-AlphaNumeric+Cyrillic-30-04-2021-Post.png
Spam-AlphaNumeric+Cyrillic-30-04-2021-Post.png (54.47 KiB) Viewed 13927 times

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

Bugger me ! :o Svetlana snuck back in under the radar late this morning !! :x

Spammer-Svetlana-30-04-2021-Deleted.png
Spammer-Svetlana-30-04-2021-Deleted.png (21.6 KiB) Viewed 13919 times

This time, their IP address location showed as Ukraine and funnily enough was close to another I'd blocked previously, so again I've blocked that entire range of IP's. Anyway, I've had enough of this silly game. Tomorrow, May Day is a favourite Russian national holiday. Automated bots or not, they're going to observe it and leave me in peace. I've seen to it. 8-)

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

The forum has been SPAM free for exactly one week. :) The Q&A counter-measure appears to have done the trick. 8-)

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

This morning, the forum suffered its first SPAM attack in nearly 12 months, from a newly joined member ARMAN. :x

Spammer-ARMAN-28-04-2022.png
Spammer-ARMAN-28-04-2022.png (34.99 KiB) Viewed 12154 times

He made 10 almost identical posts (on the subject of obtaining fake documents) in many of the more popular sections.

Spammer-ARMAN-28-04-2022-Posts-Forums.png
Spammer-ARMAN-28-04-2022-Posts-Forums.png (165.92 KiB) Viewed 12154 times

Although given 2 different titles, the message's content was the same (and about 3 times the length of my screen shot).

Spammer-ARMAN-28-04-2022-Post.png
Spammer-ARMAN-28-04-2022-Post.png (65.25 KiB) Viewed 12150 times

On his profile, he stated a location of Italy but checking the IP address pointed to Madrid, Spain.

Spammer-ARMAN-28-04-2022-Details.png
Spammer-ARMAN-28-04-2022-Details.png (22.48 KiB) Viewed 12148 times

A quick search on stopforumspam.com reveals he's been attacking other forums from a variety of different IP addresses (countries include: Czechoslovakia, UK and USA), so it's obvious he's using a proxy / VPN. He also uses other ID's besides ARMAN, including TIMMGG. The email address appears to be a common factor, but I suspect he has plenty of others.

Spammer-ARMAN-28-04-2022-StopForumSPAM.png
Spammer-ARMAN-28-04-2022-StopForumSPAM.png (91.55 KiB) Viewed 12148 times

Needless to say he's been banned and his posts deleted. My only real concern is how he managed to register in the first place. It's probably time I changed the security question.

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

What is, in all likelihood, the same spammer returned in the early hours of this morning, registering as member TERET.

Spammer-TERET-30-04-2022-Profile.png
Spammer-TERET-30-04-2022-Profile.png (33.69 KiB) Viewed 12136 times

This time, they used a completely different IP and email addresses (as I'd predicted in my previous post).

Spammer-TERET-30-04-2022-Overview.png
Spammer-TERET-30-04-2022-Overview.png (27.84 KiB) Viewed 12136 times

Although they had ample opportunity, while I was asleep, they only made two posts in the General Discussion section.

Spammer-TERET-30-04-2022-Posts-General-Forum.png
Spammer-TERET-30-04-2022-Posts-General-Forum.png (64.88 KiB) Viewed 12133 times

The (full) wording of the two posts is exactly the same as before:

Spammer-TERET-30-04-2022-Post.png
Spammer-TERET-30-04-2022-Post.png (71.4 KiB) Viewed 12133 times

Naturally I looked them up on stopforumspam.com. There was no exact match for 'TERET' ....

stopforumspam-TERET.png
stopforumspam-TERET.png (103.12 KiB) Viewed 12131 times

But other spammers using the same gmail address had been reported a couple of times earlier this year:

stopforumspam-ammo49gmail.png
stopforumspam-ammo49gmail.png (16.88 KiB) Viewed 12131 times

Needless to say, I've banned them and deleted their posts. I've also asked the question on stopforumspam.com. ;)

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

The thread I started on stopforumspam.com's forum, entitled: Smarter than average spambot ? was close to the mark. Overnight, it received a couple more replies, but this one posted yesterday evening by moderator Alex Kemp was the most helpful, if not exactly encouraging.

Stopforumspam-Reply-AlexKemp.png
Stopforumspam-Reply-AlexKemp.png (31.18 KiB) Viewed 12119 times

Yes indeed, having googled it, XRumer definitely sounds a nasty piece of work and I guess our spammer must be using it.

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

This week I've started noticing heightened levels of visitor activity. I wonder how many of them are spambots ? :?

Seiko7A38-Forum-Activity-05-05-2022.png
Seiko7A38-Forum-Activity-05-05-2022.png (9.37 KiB) Viewed 12093 times

Edit: The situation 5 minutes later. :o

Seiko7A38-Forum-Activity-05-05-2022-63.png
Seiko7A38-Forum-Activity-05-05-2022-63.png (9.43 KiB) Viewed 12091 times

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

That inflated visitor number peaked @ 82 yesterday evening:

Seiko7A38-Forum-Activity-05-05-2022-82.png
Seiko7A38-Forum-Activity-05-05-2022-82.png (9.09 KiB) Viewed 12084 times

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

Looks like the bots were out in force again, earlier this morning. This is what I found at the bottom of the forum home page when I logged on just before 7:00 am. 79 supposed guests !! :roll:

Seiko7A38-Forum-Activity-12-05-2022-80-UsersOnline.png
Seiko7A38-Forum-Activity-12-05-2022-80-UsersOnline.png (9.33 KiB) Viewed 12037 times

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

The bots were swarming around again this afternoon. Didn't quite manage to break Monday's record high count though.

Seiko7A38-Forum-Activity-18-05-2022-108.png
Seiko7A38-Forum-Activity-18-05-2022-108.png (9.58 KiB) Viewed 11995 times

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

The bots were swarming around again at lunchtime today - this time they broke the previous record. :roll:

Seiko7A38-Forum-Activity-18-07-2022-124.png
Seiko7A38-Forum-Activity-18-07-2022-124.png (9.33 KiB) Viewed 9460 times

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

We had our first SPAM attack in over 18 months this lunchtime. A newly created member Italetfidk, allegedly located in Mali, posted this jibberish as a new thread in General Discussion:

ForumSpam-Jibberish-Post-Italetfidk.png
ForumSpam-Jibberish-Post-Italetfidk.png (42.1 KiB) Viewed 899 times

Post and User ID have been deleted and banned.

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

Early this morning, while I was still fast asleep in bed, the forum came under attack from another spammer - a newly created ID InkCep, who openly stated their location as Russia. He made 22 posts, all in Cyrillic, containing various links.

ForumSpam-Russian-Postx22-InkCep.png
ForumSpam-Russian-Postx22-InkCep.png (102.47 KiB) Viewed 751 times

The fact that he posted them continuously, all in the same thread, made it remarkably easy to delete them. :lol:

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

It's been a busy morning, behind the scenes. No new SPAM posts, but overnight and earlier this morning, we supposedly gained 34 new members ! 33 of them were 'Inactive', but potential spammers. All had spurious email addresses and the few that I did check had Russian IP addresses, regardless of the variety of stated locations.

Forum-NewMembers(Inactive)-7-02-24-X14.png
Forum-NewMembers(Inactive)-7-02-24-X14.png (37.43 KiB) Viewed 588 times
Forum-NewMembers(Inactive)-7-02-24-X19.png
Forum-NewMembers(Inactive)-7-02-24-X19.png (66.85 KiB) Viewed 588 times

This other profile Ashleycrync, which was created while I was deleting the other 33, was a little more complete, but they also had a Russian IP address and a bogus email address, so they're also history !

Forum-Profile-Ashleycrync.png
Forum-Profile-Ashleycrync.png (39.21 KiB) Viewed 588 times

User avatar
Seiko7A38
Site Admin
Posts: 2577
Joined: Thu Jan 28, 2021 12:05 pm
Location: S.W. England
Contact:

Re: Hello Spammer; Goodbye Spammer !!

Post by Seiko7A38 »

Those SPAMbot generated new ('Inactive') user ID's kept on coming - all with spurious email addresses and Russian IP's. Probably one every 5 or 10 minutes. By mid-afternoon, I must have deleted at least another 30 more. Frankly, I got fed up with playing the game. I evidently need to reset the anti-spambot countermeasure question, which has worked amazing well for the last 2½ years. But for expediency's sake, I've simply temporarily disabled new registrations.

Belated Edit: Anti-spambot countermeasure Q&A now changed. Registration re-enabled.That'll fix 'em, I reckon. 8-)

Post Reply