ForumPostersUnion.com

AnthonyCea · #1 08-16-2006, 04:58 AM

Spammers have targeted forums today and they use many proxies to join up with a lot of different user names, we have blocked a lot of IP's out of Korea and China that are used by proxy operators to slow down the onslaught a bit and have banned email addresses many of them use!

Many times I delete their accounts even before they make post number one since I can tell that it is the same spammer by their user agent even when they join with a different IP!

Some of these guys will give me all the proxy IP's they use in one day because they keep coming back in machine gun style and I am able to ban all their proxy IP's in one day!

What do you forum owners do to stop spam

#2 08-16-2006, 06:58 AM

You can get a PHP script that can backtrack through non secure proxies.
It shouldnt be hard to integrate into a login/signup field.

AnthonyCea · #3 08-16-2006, 07:00 AM

DarkSat, you will get your shot at implementing it soon because these spammers are out of control on forums, blogs, MySpace and just about everywhere including email.

#4 08-16-2006, 07:10 AM

Stick this in your Signup page.

Code:

<?php
if ($_SERVER['HTTP_X_FORWARDED_FOR'] != '') {
  $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
}
?>

That way if you block the IP address once they cant use a proxy to get back in again.

AnthonyCea · #5 08-16-2006, 07:25 AM

Can you explain what this does for non coders

How does it catch the old IP via a proxy IP, a traceback though an unsecured proxy

#6 08-16-2006, 07:38 AM

It tells the page to treat the persons real address as the proxy address and display the real IP address instead of the proxy.

Its quick and nasty and to work properly it might have to be included in an overall header file so you can track and ban the right IP number but I would have to look under the hood of VB to see how best to implement it.

Personally I would build a custom spider trap as well.

AnthonyCea · #7 08-16-2006, 07:44 AM

One of the problems we face with IP bans or spider traps is the fact that we are going to ban some IP's of legitimate users, but that is the price you have to pay or you will be hit everyday with thousands of spam posts!

I am leaving the bans on spiders and users that give us trouble long term, we were getting a lot of spammer registrations from certain email address providers and I blocked those too!

#8 08-16-2006, 07:50 AM

There are a lot of ways of combatting spammers.
the best thing to do is have a seperate login field for anything that trips a spam alert, this will then email you all the signup details and you can manually approve a registration.
Think multi layer security.
Its a game I love playing.

AnthonyCea · #9 08-16-2006, 08:38 AM

We tried the manual email deal, but it was causing us to lose legitimate sign ups because some ISP's had Nintendo's server blocked from sending email out, so we had to stop that process!

#10 08-16-2006, 08:57 AM

No what I mean is that specific users who trip certain filters have to be approved, like people using a proxy to sign up.
and why is his email blocked from some ISPs.
there are a lot of ways to combat spammers.

AnthonyCea · #11 08-16-2006, 09:02 AM

His server IP is banned from some systems, I think he got caught sending out a lot of notices from his video game forums!

You know once people report your IP as spam even on Yahoo they send all your mail automatically to spam folders, so you can't always depend on email to get though and that can hurt you big time if you are using email verification before allowing people to post!

You just can't grow a forum like that if they never see your mail, in other words you will have zero new members if your system is too hard to deal with!

Developer · #12 08-16-2006, 05:30 PM

You could implement a CAPTCHA system on your login/signup pages.

AnthonyCea · #13 08-16-2006, 05:52 PM

That is good for robotic sign ups, but we are talking about professional spammers that want to post cell phone ads in threads.

I was in a discussion with a coder on another forum and he introduced a posting bot that could be programmed to post automatically on any forum, I don't think that is what we are dealing with, but you never know!

#14 08-17-2006, 02:14 AM

Quote:

Originally Posted by AnthonyCea

I was in a discussion with a coder on another forum and he introduced a posting bot that could be programmed to post automatically on any forum, I don't think that is what we are dealing with, but you never know!

Yeah he was cool for a bible basher.
I really have to resurect my forum, I still have all the code he posted in the underground.

PS, it wasnt a bot, just a script that allowed him to post in 20 forums at a time.

AnthonyCea · #15 08-17-2006, 03:41 AM

I don't think we are talking about the same man, if you are interested I will PM you the thread, I really don't want to publicize this out here too much, it pissed off a few forum owners, ask Noppid, he will remember this because he and Joey were really pissed about it!

#16 08-17-2006, 04:47 AM

OK, pm me the thread, I thought it was the jehovas witness dotNet programmer that was posting on my forum for a while.

#17 08-17-2006, 06:44 AM

On my video game boards, for a while I got a LOT of sign-ups that had usernames of drugs, especially viagra!!!!

AnthonyCea · #18 08-19-2006, 02:50 PM

The guy that started this thread on forum spammers had to ban the same email address that I banned here!

AnthonyCea · #19 08-21-2006, 06:27 AM

http://search.yahoo.com/search?ei=UT...=intercage.com

216.255.190.66

Check out the above IP used by spammers called Intercage.com, when you go to this site you get a blank screen, needless to say I just banned their IP!

This IP resolves to the United States but is used by Russian spammers, so forum spammers are getting more sophisticated since many forum owners ban IP's from Russia which is sad because I have some good friends from Russia that are highly valued posters!

Another IP from Intercage.com 216.255.185.82

AnthonyCea · #20 10-17-2006, 12:10 PM

More on our friends at Intercage as far as them being a spam source

http://spamhuntress.com/2005/05/21/trojan-on-atrivo/

AnthonyCea · #21 10-27-2006, 11:27 AM

This network out of Russia is a well known scraper and spammer!

81.95.146.162 PTR record: ip-146-162.rbnnetwork.com

http://www.google.com/search?q=ip-14...rbnnetwork.com

I tried to ban the IP: 81.95.146.162 at the server level and it would not take this IP!

I was able to ban the IP in the ACP in the forum software and it is on our blocked IP database!

#22 10-27-2006, 01:58 PM

Need me to help you!!!

I'm da master at banning IPs from servers!!!

noppid · #23 10-27-2006, 03:31 PM

Quote:

Originally Posted by Nintendo

Need me to help you!!!

I'm da master at banning IPs from servers!!!

hehe, you didn't teach ACea correctly though. Hold out!

AnthonyCea · #24 10-27-2006, 03:41 PM

05:27 PM Guest

Sending Forum Feedback
81.95.146.162
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; MRA 4.3 (build 01218))

This slime bag is back Noppid, I thought you blocked him man

AnthonyCea · #25 10-28-2006, 01:12 PM

Another BIG TIME spammer and scraper exposed, ban this IP at server level folks.

http://www.dnsstuff.com/tools/ip4r.c...19.136.239.51+

AnthonyCea · #26 11-03-2006, 10:58 PM

See this report on these scammers, spammers and scrapers!

http://www.dnsstuff.com/tools/ip4r.ch?ip=62.254.64.13+

http://www.google.com/search?q=ntli.net

PS: I banned them at the server level if they are posted here, I nailed them already!

AnthonyCea · #27 11-06-2006, 07:25 AM

Here is another very interesting spam block list!

Check this report out on this proxy used by spammers out of China

Here is an IP that lights up the spam blacklists with a ton of RED WARNINGS

Here is another IP that lights up the spam scoreboard

More IP addresses below that light up the spam blacklists:

http://www.dnsstuff.com/tools/ip4r.ch?ip=24.167.155.56

NOTE, IF THEY ARE LISTED IN THIS THREAD THEY ARE BANNED AT THE SERVER LEVEL ALREADY!

AnthonyCea · #28 11-10-2006, 12:15 PM

193.238.36.0/22 is listed on the Register Of Known Spam Operations (ROKSO) database as being assigned to, under the control of, or providing service to a known professional spam operation run by Leo Kuvayev / BadCow.

Nic.ru aka ConnectCom.ru spamhaus - oemguy.com ; etc

Known "fake ISP hosting" criminal spammers. AS34596 via << AS24919

http://www.cidr-report.org/cgi-bin/as-report?as=as34596
___________

http//1stoem.net

= cc27.connectcom.ru

--- DNS lookup for "oem-add.biz", please wait...
--- contacting nameserver: ns1.oem-add.biz [193.238.38.230]

oem-add.biz SOA
origin = oem-add.biz
mail addr = root@oem-add.biz
serial = 1068178713
refresh = 120 (2 mins)
retry = 120 (2 mins)
expire = 1209600 (14 days)
minimum ttl = 86400 ()
oem-add.biz NS ns2.oem-add.biz
oem-add.biz NS ns1.oem-add.biz
ns1.oem-add.biz A 193.238.38.230
ns2.oem-add.biz A 193.238.38.231

--- DNS Lookup completed

________

@ns1.oem-add.biz
-------------------
1stoem.net
aboutfacesoft.com
aboutfacesoft.net
bestoemsoft.net
blacksunware.com
blyapal.com
bobrasoft.com
cadettable.com
cafeden.biz
citisoftware.net
cyberdyneoem.com
easysoft4sale.com
easysoft4sale.net
extremeoem.com
extremeoem.net
fastsoftdl.com
fastsoftdl.net
flashoemsoft.com
flasoemsoft.net
flybynightsoft.com
groundworm.biz
historylabel.com
hohloware.com
homesafedefence.com
honestoem.com
honestoem.net
hotsoftdeals.com
hotsoftdeals.net
instantoem.net
ipoemed.com
isodsoft.com
justgshop.biz
kosherware.net
lgyroem.biz
liberationsoft.net
ls-la.biz
maoem.com
msoemsale.com
msoemsale.net
mynewsoft.net
neatosoft.com
neatosoft.net
newesoft4u.com
newesoft4u.net
number1soft.com
number1soft.net
obscureware.com
oem-add.biz
oem-software-store.com
oemdojo.com
oemgiant.net
oemhalloween.com
oemhalloween.net
oemism.com
oemparadise.net
oemspecials.com
oemspecials.net
ondemando.com
ondsbonus.com
onthelineoem.com
partisanware.com
pinkfluffysoft.com
ps-aux.biz
rbagz.biz
redhotoem.com
redhotoem.net
saleonoem.com
saleonoem.net
saveoemnow.com
saveoemnow.net
scholasticsoft.net
seattlesoftware.net
socheapsoft.com
socheapsoft.net
softbusters.net
softoemshopg.biz
softruba.com
softwareshopnewg.biz
speakeroffice.net
splashoem.com
spoileroem.com
spookyoem.com
spookyoem.net
studentoem.com
studentoem.net
summeroem.net
top-oem-software.com
trancesoft.net
twodimesoft.com
ware1917.com
wefed.biz
zooem.com

AnthonyCea · #29 11-11-2006, 07:39 AM

More spammer IP's that are on our blacklist

80.64.94.252 World Champion Spammer out of Russia

85.140.252.163

218.98.221.108 China based blackliste open proxy IP

AnthonyCea · #30 11-17-2006, 11:26 AM

Stopping web robot abuse is a major problem all forum owners face, hackers are looking to scrape content and harvest email addresses, so you have to fight it constantly.

http://www.google.com/search?q=nodomaintransfer27.com

Above and in the following link are searches on a domain known for email harvesting and stealing content.

There are programs available that can help you block robot crawlers that scrape content automatically, check this out and comment please if you have used this program.

AnthonyCea · #31 11-17-2006, 08:46 PM

IP 221.2.243.114 is banned by just about every blacklisting service out there!

218.75.11.221 proxy out of China

222.240.212.29 China proxy that lights up the IP Blacklists Ban list

IP 200.51.208.87 out of South America on a ton of spam blacklists

IP 124.216.25.114 is a proxy out of Korea used by spammers

More blacklisted spam source IP used by comment spam bot operators.

82.193.96.236

203.144.144.164

222.172.222.79

87.248.164.43 87-248-164-43.starnet.md

87.248.164.59

87.248.164.74

AnthonyCea · #32 11-28-2006, 08:26 PM

IP 202.83.173.141 is on just about every Blacklist out there, he was registering with the following two IP addresses at the same time!

10:11 PM Guest Registering 202.83.173.141
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT) ::ELNSB50::000061100320025802a00111000000000507000 900

10:10 PM Guest Registering 200.55.15.75
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT) ::ELNSB50::000061100320025802a00111000000000507000 900

---------------------------------------------------------------
Additional spam source blackholed IP's

217.132.173.203

200.88.223.99

AnthonyCea · #33 11-29-2006, 08:39 PM

Do I need to check your IP, if it comes up with Blacklist Spam alerts like this IP does I may ban your IP too!

Check this out, this 212.76.37.150 IP is on just about all Spam Blacklists, these guys hit just about everyone, this spammer Blacklist website says they are a professional spamming organization after investigation of their IP and servers.

IP that light up the spam blacklists

203.144.160.242

85.140.146.73

81.195.7.100

221.128.132.113

AnthonyCea · #34 12-01-2006, 09:25 AM

ThePlanet.com is famous as a base of operations for spammers and many static IP addresses come out of ThePlanet.com that are scraper spam bots.

AnthonyCea · #35 12-02-2006, 09:21 AM

Check this IP of a known spam harvesting bot

http://moensted.dk/spam/no-more-funn/?addr=81.94.16.38

210.102.237.3 proxy out of Korea should be banned by every forum owner.

The following spammer was using all the following IP addresses in machine gun style here!

203.230.206.25 IP and proxy out of Korea that is blacklisted for spam

217.199.117.107

203.129.239.102

71.72.139.236

`````````````````````````````````````````````````` `````````

200.66.47.134 creative spammer joined the forum using a Russian email address and a Mexican IP address

193.194.84.198 spammer IP proxy

85.140.93.202 IP from Russia on about every spam Blacklist

221.6.210.44 spammer is using a proxy out of China

61.172.123.202 Blacklisted IP out of China, not removable from some lists it is so bad.

210.22.117.100 China IP used by spammers on many blacklists

213.254.92.22 Spammer IP on many blacklists out of Spain

The above Joker uses a 85.125.231.141 dynamic DSL connection because so many have banned his proxy IP, this is a way to get around that.

58.226.1.196 proxy out of Korea that should be banned all webmasters since it is on a lot of spam blacklists

AnthonyCea · #36 12-05-2006, 08:43 PM

Blacklisted spammer open proxy IP addresses to ban at the server level.

203.158.221.227

59.94.10.252

201.13.47.120

200.233.131.204

201.17.33.52 Spam source IP out of Brazil

AnthonyCea · #37 12-06-2006, 07:44 AM

IP 62.141.53.139 is controlled by automated professional spam bot called Keymachine.de should be banned from every forum at the server level.

Google Search on Keymachine.de

Keymachine.de is a crawler that harvests email addresses and scrapes content with their spider

09:38 AM Guest Logging In 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:38 AM Guest Replying to Thread
vBSEO software package! 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:38 AM Guest Registering 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:36 AM Guest Registering 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:36 AM Guest Viewing Thread
vBSEO software package! 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:38 AM Guest Replying to Thread
vBSEO software package! 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:38 AM Guest Registering 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:37 AM Guest Registering 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:38 AM Guest Logging In 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:38 AM Guest Registering 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:37 AM Guest Registering 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:36 AM Guest Replying to Thread
vBSEO software package! 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:38 AM Guest Replying to Thread
vBSEO software package! 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:38 AM Guest Registering 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:37 AM Guest Registering 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

09:36 AM Guest Registering 62.141.53.139
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

Here is another Keymachine.de IP 87.118.96.121
Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)

87.118.104.44 PTR record: ns.km20802-04.keymachine.de

one IP range for keymachine.de

Complete IP range for keymachine.de

ns.km22226-04.keymachine.de

Another user agent from keymachine.de

87.118.98.137
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.0.2) Gecko/20020924 AOL/7.0

AnthonyCea · #38 12-06-2006, 08:26 PM

210.87.251.41 open proxy out of Hong Kong that spammers use and this IP address is Blacklisted by many sources.

spam bot IP 195.229.242.89

AnthonyCea · #39 12-07-2006, 02:17 PM

219.153.5.251 spam IP address out of China on nearly all IP Blacklists

Funny how these scam artists use a proxy out of China and a US based IP at the same time!

04:06 PM Guest Viewing Index
Forum Posters Union 219.153.5.251
Mozilla/3.0 (x86 [en] Windows NT 5.1; Sun)

04:14 PM Guest Registering 87.248.173.155
Mozilla/3.0 (x86 [en] Windows NT 5.1; Sun)

AnthonyCea · #40 12-08-2006, 09:48 AM

81.215.120.187 dynamic IP system used by a proxy out of Turkey on many spam Blacklists

201.21.91.34 Blacklisted IP out of Brazil used for spam

218.202.36.94 IP address is an open proxy out of China Blacklisted for spam