SPAM - monitoring thread

User avatar
Arjen Balfoort
Site Admin
Posts: 9280
Joined: 26 Jan 2013 19:36
Location: Netherlands
Contact:

SPAM - monitoring thread

Postby Arjen Balfoort » 08 Jun 2013 08:58





SolydXK needs you!
Development | Testing | Translations

User avatar
ane champenois
Posts: 1539
Joined: 24 Feb 2013 08:17
Location: Grands lacs Forêt d'Orient, France

Re: SPAM - monitoring thread

Postby ane champenois » 08 Jun 2013 09:18

Ok I've verified the 20 first users on the stop forum spam.
Some of them have results:
  • number 14
  • number 17
  • number 9
Ane
They did not know it was impossible so they did it.

User avatar
Arjen Balfoort
Site Admin
Posts: 9280
Joined: 26 Jan 2013 19:36
Location: Netherlands
Contact:

Re: SPAM - monitoring thread

Postby Arjen Balfoort » 08 Jun 2013 09:35

I've added a second list to show users with numbers in their email address, and have less than 5 posts.

Although I guess the first list will be sufficient, let's see how we're going to use both of them.

@Ane
Yes, these are suspicious, but haven't had any activity lately.

[EDIT]
With zerozero's new setting, these would have been marked as spammers. So, I removed them:
smmithjjohn - smmithjjohn@outlook.com - 182.178.43.133
carpinteyroqva - batteypai@hotmail.com - 59.56.44.65
ebdyebdys - ebdyebdys@live.com - 180.149.7.87
fsfs4ssg - qqqws32a@gmail.com - 120.37.216.149

And excluded (spam IP, but ligitimate user):
searcher1 - wcy125@gmail.com - 37.130.224.22


SolydXK needs you!
Development | Testing | Translations

User avatar
zerozero
Posts: 5373
Joined: 10 Feb 2013 23:37
Location: West Midlands, England
Contact:

Re: SPAM - monitoring thread

Postby zerozero » 08 Jun 2013 11:19

checking from 21 to 50 [following Ane's work]
will post the findings here
32- xinlinfcd http://www.stopforumspam.com/ipcheck/120.85.201.161 was already banned on may 7th
37- АcirlKnoro http://www.stopforumspam.com/ipcheck/95.84.137.56 was banned on may 2nd
47- carpinteyroeqzd http://www.stopforumspam.com/ipcheck/222.93.235.28 the username doesn't show up in the logs but the IP does (banned on april 25th and unbanned on may 3rd)
48- owelayclelt http://www.stopforumspam.com/ipcheck/119.62.72.202 banned on april 26th
48- CopeneepETedo http://www.stopforumspam.com/ipcheck/176.101.27.218 banned on april 22nd
bliss of ignorance

Deleted User 2761

Re: SPAM - monitoring thread

Postby Deleted User 2761 » 08 Jun 2013 11:40

OMG.

This Person are not Spammer. I Know this User.

Code: Select all

SolydXK - Last 100 users without posts
8	29/05/2013	Ch.Ba.	baumgaertelch@googlemail.com	 
38	01/05/2013	manu	manuelaweis1979@googlemail.com	 
68	30/03/2013	DeKa	        zoebel@gmx.at 
In the past i had in my phpbb3 forum many spammer. i fix that with stupid questions for the login(registry)prozess.

Besser mal auf Deutsch für Arjen, weil das in Englisch zu schwierig für mich ist zu erklären:
Spammer kannst Du ganz gezielt vermeiden, indem während der Registrierung Fragen gestellt werden, die nur ein Mensch beantworten kann. Je dümmer die Fragen umso besser. Generell würde ich beim Registrierungsprozess nie auf das Captchaplugin verzichten. Nie.
Wenn User im Forum mit 0 Posts sind, dann ist das keineswegs ein Indiz dafür das hier ein Spammer oder Schläfer unterwegs ist. Auch nicht die IP eines Proxy. Die eMailadresse des Users hingegen schon. Und die kann man im Internet ganz schnell in vorhandenen blacklisten erfragen.

User avatar
Arjen Balfoort
Site Admin
Posts: 9280
Joined: 26 Jan 2013 19:36
Location: Netherlands
Contact:

Re: SPAM - monitoring thread

Postby Arjen Balfoort » 08 Jun 2013 12:24

crizzly wrote:OMG.

This Person are not Spammer. I Know this User.

Code: Select all

SolydXK - Last 100 users without posts
8	29/05/2013	Ch.Ba.	baumgaertelch@googlemail.com	 
38	01/05/2013	manu	manuelaweis1979@googlemail.com	 
68	30/03/2013	DeKa	        zoebel@gmx.at 
In the past i had in my phpbb3 forum many spammer. i fix that with stupid questions for the login(registry)prozess.

Besser mal auf Deutsch für Arjen, weil das in Englisch zu schwierig für mich ist zu erklären:
Spammer kannst Du ganz gezielt vermeiden, indem während der Registrierung Fragen gestellt werden, die nur ein Mensch beantworten kann. Je dümmer die Fragen umso besser. Generell würde ich beim Registrierungsprozess nie auf das Captchaplugin verzichten. Nie.
Wenn User im Forum mit 0 Posts sind, dann ist das keineswegs ein Indiz dafür das hier ein Spammer oder Schläfer unterwegs ist. Auch nicht die IP eines Proxy. Die eMailadresse des Users hingegen schon. Und die kann man im Internet ganz schnell in vorhandenen blacklisten erfragen.
Indeed, these lists are not spammers: these are users without posts.
However, it does make it easier to find sleeper spammers.
When you register you need to fill in a captcha. Since yesterday it's in the form of a puzzle, and servers the same as asking a question. Unfortunately, there are (human) spammers that become a member, wait for a while, and then start spamming. These lists help to locate them before they spam.


SolydXK needs you!
Development | Testing | Translations

User avatar
Arjen Balfoort
Site Admin
Posts: 9280
Joined: 26 Jan 2013 19:36
Location: Netherlands
Contact:

Re: SPAM - monitoring thread

Postby Arjen Balfoort » 08 Jun 2013 12:28

zerozero wrote:checking from 21 to 50 [following Ane's work]
will post the findings here
32- xinlinfcd http://www.stopforumspam.com/ipcheck/120.85.201.161 was already banned on may 7th
37- АcirlKnoro http://www.stopforumspam.com/ipcheck/95.84.137.56 was banned on may 2nd
47- carpinteyroeqzd http://www.stopforumspam.com/ipcheck/222.93.235.28 the username doesn't show up in the logs but the IP does (banned on april 25th and unbanned on may 3rd)
48- owelayclelt http://www.stopforumspam.com/ipcheck/119.62.72.202 banned on april 26th
48- CopeneepETedo http://www.stopforumspam.com/ipcheck/176.101.27.218 banned on april 22nd
I'm in favor of removing accounts that are already banned.
You?


SolydXK needs you!
Development | Testing | Translations

Deleted User 2761

Re: SPAM - monitoring thread

Postby Deleted User 2761 » 08 Jun 2013 12:30

there are (human) spammers that become a member, wait for a while, and then start spamming
Ja. Es gibt auch die Möglichkeit alle neu registrierten User in die Gruppe "Kürzlich registrierte User" aufzunehmen. Die ersten 5 Posts der neuen User müssen dann erst von einem Admin freigegeben werden. So wäre aus meiner Sicht auch ein Spamschutz mit Boardmitteln gegeben.

Grüße von mir.

User avatar
zerozero
Posts: 5373
Joined: 10 Feb 2013 23:37
Location: West Midlands, England
Contact:

Re: SPAM - monitoring thread

Postby zerozero » 08 Jun 2013 12:37

Schoelje wrote:I'm in favor of removing accounts that are already banned.
You?
completely 8-) i start doing this lately but wasn't in the beginning (i didn't see the setting at the time :lol: )
bliss of ignorance

User avatar
Arjen Balfoort
Site Admin
Posts: 9280
Joined: 26 Jan 2013 19:36
Location: Netherlands
Contact:

Re: SPAM - monitoring thread

Postby Arjen Balfoort » 08 Jun 2013 13:04

crizzly wrote:
there are (human) spammers that become a member, wait for a while, and then start spamming
Ja. Es gibt auch die Möglichkeit alle neu registrierten User in die Gruppe "Kürzlich registrierte User" aufzunehmen. Die ersten 5 Posts der neuen User müssen dann erst von einem Admin freigegeben werden. So wäre aus meiner Sicht auch ein Spamschutz mit Boardmitteln gegeben.

Grüße von mir.
I'll roughly translate this, because this is also a good option:

New members go into the group "Newly registered users", which means an admin needs to check their first 5 posts before they are published.
As long as we don't get hundreds of new users on a daily basis, this might be an option.

What do you think?


SolydXK needs you!
Development | Testing | Translations

User avatar
Arjen Balfoort
Site Admin
Posts: 9280
Joined: 26 Jan 2013 19:36
Location: Netherlands
Contact:

Re: SPAM - monitoring thread

Postby Arjen Balfoort » 08 Jun 2013 13:30

In ACP you also have a list of inactive users (with some names we've already seen above): Users and Groups / Users / Inactive users

I changed some settings (marked with ">>>"):

User registration settings / General settings
  • Account activation:
    This determines whether users have immediate access to the board or if confirmation is required. You can also completely disable new registrations. “Board-wide e-mail” must be enabled in order to use user or admin activation.

    No activation (immediate access) >>> By user (e-mail verification)
  • Registration attempts:
    Number of attempts users can make at solving the anti-spambot task before being locked out of that session.

    5 >>> 3
I haven't set the "Set Newly Registered Users group to default", because that would mean more work for us moderators. We need to agree on this one.


SolydXK needs you!
Development | Testing | Translations

User avatar
Arjen Balfoort
Site Admin
Posts: 9280
Joined: 26 Jan 2013 19:36
Location: Netherlands
Contact:

Re: SPAM - monitoring thread

Postby Arjen Balfoort » 08 Jun 2013 13:54

Removed already banned users:
xinlinfcd
АcirlKnoro
carpinteyroeqzd
owelayclelt
CopeneepETedo

Now, I'm going to sit in the sun with a good book, and a cold Chouffe (http://forums.solydxk.nl/viewtopic.php?p=2943#p2943).


SolydXK needs you!
Development | Testing | Translations

Deleted User 2761

Re: SPAM - monitoring thread

Postby Deleted User 2761 » 08 Jun 2013 14:02

cheers, Prost, nastrovje Image

User avatar
ane champenois
Posts: 1539
Joined: 24 Feb 2013 08:17
Location: Grands lacs Forêt d'Orient, France

Re: SPAM - monitoring thread

Postby ane champenois » 08 Jun 2013 14:05

Schoelje wrote: I'm in favor of removing accounts that are already banned.
You?
Yes of course 8-) Is it possible to blacklist them automatically?
Schoelje wrote:
crizzly wrote:
there are (human) spammers that become a member, wait for a while, and then start spamming
Ja. Es gibt auch die Möglichkeit alle neu registrierten User in die Gruppe "Kürzlich registrierte User" aufzunehmen. Die ersten 5 Posts der neuen User müssen dann erst von einem Admin freigegeben werden. So wäre aus meiner Sicht auch ein Spamschutz mit Boardmitteln gegeben.

Grüße von mir.
I'll roughly translate this, because this is also a good option:

New members go into the group "Newly registered users", which means an admin needs to check their first 5 posts before they are published.
As long as we don't get hundreds of new users on a daily basis, this might be an option.

What do you think?
Interesting yes: I think if spammers have to act as real users, they'll go to another forum.
Schoelje wrote: Now, I'm going to sit in the sun with a good book, and a cold Chouffe (http://forums.solydxk.nl/viewtopic.php?p=2943#p2943).
Have a nice and sunny afternoon you deserve it!
They did not know it was impossible so they did it.

User avatar
zerozero
Posts: 5373
Joined: 10 Feb 2013 23:37
Location: West Midlands, England
Contact:

Re: SPAM - monitoring thread

Postby zerozero » 09 Jun 2013 02:38

67 25/03/2013 whell whell@yahoo.com 170.146.225.4
http://www.stopforumspam.com/ipcheck/170.146.225.4
====
a special case
82 04/03/2013 Ferre ferre.franckx@gmail.com 212.123.0.8
http://www.stopforumspam.com/ipcheck/212.123.0.8
no activity for 7 months. might be a new owner, changed life, dunno.
====
96 21/02/2013 fchurca federico.churca@gmail.com 157.92.4.71
http://www.stopforumspam.com/ipcheck/157.92.4.71

====
1st i will delete now; 2nd and 3rd i would like other opinions
bliss of ignorance

User avatar
Arjen Balfoort
Site Admin
Posts: 9280
Joined: 26 Jan 2013 19:36
Location: Netherlands
Contact:

Re: SPAM - monitoring thread

Postby Arjen Balfoort » 09 Jun 2013 06:19

zerozero wrote:67 25/03/2013 whell whell@yahoo.com 170.146.225.4
http://www.stopforumspam.com/ipcheck/170.146.225.4
====
a special case
82 04/03/2013 Ferre ferre.franckx@gmail.com 212.123.0.8
http://www.stopforumspam.com/ipcheck/212.123.0.8
no activity for 7 months. might be a new owner, changed life, dunno.
====
96 21/02/2013 fchurca federico.churca@gmail.com 157.92.4.71
http://www.stopforumspam.com/ipcheck/157.92.4.71

====
1st i will delete now; 2nd and 3rd i would like other opinions
They were created quite a while ago, and they haven't posted anything since. So, I think they simply forgot about it.
I'd delete them.


SolydXK needs you!
Development | Testing | Translations

User avatar
zerozero
Posts: 5373
Joined: 10 Feb 2013 23:37
Location: West Midlands, England
Contact:

Re: SPAM - monitoring thread

Postby zerozero » 09 Jun 2013 10:06

Schoelje wrote:I'd delete them.
done
82 04/03/2013 Ferre ferre.franckx@gmail.com 212.123.0.8
and
96 21/02/2013 fchurca federico.churca@gmail.com 157.92.4.71
banned
bliss of ignorance

User avatar
zerozero
Posts: 5373
Joined: 10 Feb 2013 23:37
Location: West Midlands, England
Contact:

Re: SPAM - monitoring thread

Postby zerozero » 31 Dec 2013 18:50

checked the list until today's entries and found 2 registrations with reports on SFS
both "users" removed
LUCK2 and jj1two3
bliss of ignorance

User avatar
Arjen Balfoort
Site Admin
Posts: 9280
Joined: 26 Jan 2013 19:36
Location: Netherlands
Contact:

Re: SPAM - monitoring thread

Postby Arjen Balfoort » 31 Dec 2013 19:01

Aaaaah, now that we're so close to the 1000...on the last day of 2013!


SolydXK needs you!
Development | Testing | Translations

User avatar
zerozero
Posts: 5373
Joined: 10 Feb 2013 23:37
Location: West Midlands, England
Contact:

Re: SPAM - monitoring thread

Postby zerozero » 31 Dec 2013 19:05

:lol: ohh, sorry about that; yeahh that crossed my mind (after i posted here meaning too late)
bliss of ignorance


Return to “Archive”

Who is online

Users browsing this forum: No registered users and 1 guest