ForumPostersUnion.com

AnthonyCea · #41 12-09-2006, 02:49 PM

Professional spam botnet operation running dedicated servers 72.232.37.162 162.37.232.72.reverse.layeredtech.com

AnthonyCea · #42 12-09-2006, 07:50 PM

59.6.103.215 proxy out of Korea on a lot of spam Blacklists

61.41.201.98 Proxy out of Korea IP is on most spam Blacklists

60.28.48.102 Blacklisted IP out of China

210.91.29.208 spammer IP address out of Korea used as a proxy that is blacklisted

85.140.4.249 multiple Blacklisted IP out of Russia used as a proxy by spammers

201.14.91.131 IP address on many blacklists out of Brazil that a spammer using a Russian email address joined FPU with.

83.237.166.62 IP out of Russia used by spammers and Blacklisted at many spam reporting portals

213.42.2.21 IP out of the UAE that is listed on many Spam Blacklists as an exploitable server

AnthonyCea · #43 12-11-2006, 09:45 AM

This scrapper spam bot is back again, notice they use different IP's all at the same time, we banned all the IP's they were using last time they pulled in, now they are back with more that were all banned.

11:32 AM Guest Viewing Forum
Amazon zShops storefront 210.194.183.177
PycURL/7.15.5

11:27 AM Guest Viewing Forum
vBulletin Administration 222.100.38.157
PycURL/7.15.5

11:36 AM Guest Viewing Forum
vBulletin SEO 67.82.179.204
PycURL/7.15.5

11:28 AM Guest Unknown Location
/#top 220.226.63.254
PycURL/7.15.5

11:34 AM Guest Moderating 221.208.130.182
PycURL/7.15.5

AnthonyCea · #44 12-11-2006, 12:10 PM

125.214.233.68 Proxy used by spammers out of Hong Kong that is blacklisted

87.240.15.25 Spam proxy IP out of Russia on most Blacklists

AnthonyCea · #45 12-11-2006, 07:35 PM

Check this comment spam botnet out, he is using three spam proxy IP's at the same time!

09:29 PM Guest Registering 221.153.56.253
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.6) Gecko/20050224 Firefox/1.0.2

09:29 PM Guest Replying to Thread
MySpace.com is the big daddy of Networking people! 66.98.212.79 dabworx.com
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.6) Gecko/20050224 Firefox/1.0.2

09:28 PM Guest Replying to Thread
MySpace.com is the big daddy of Networking people! 219.199.148.134
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.6) Gecko/20050224 Firefox/1.0.2

#46 12-11-2006, 11:17 PM

Knock knock!!! I'm still waiting to be IP banned!!!

AnthonyCea · #47 12-12-2006, 08:09 AM

80.58.205.34 Blacklisted spammer IP

More spam IP addresses on blacklists

89.178.10.134

151.100.50.249

58.22.131.19 Blacklisted proxy IP out of China

201.220.118.14 Blacklisted Spam IP out of South America

201.29.27.72 Russian spammer using a Blacklisted proxy IP out of Brazil

91.76.76.136 IP out of Russia used for spam on many Blacklists

85.140.92.190

202.83.206.37 Open Proxy IP used by spam artists that is blacklisted

AnthonyCea · #48 12-13-2006, 08:55 PM

Learn more about the spam bot operators and content scrapers operating under cover of LayeredTech hosting.

10:37 PM Guest Viewing Index
Forum Posters Union 72.21.39.242
<a href=\'http://www.netforex.org\'> Forex Trading Network Organization </a> info@netforex.org

http://www.google.com/search?hl=en&l...g+&btnG=Search

AnthonyCea · #49 12-14-2006, 10:53 AM

There are reports out that this is some sort of scraper spam bot that should be banned.

63.166.111.6

fcevtk6.evertekfc.net

AnthonyCea · #50 12-14-2006, 11:17 AM

Check out this scam, this spider is most likely a content scraper bot, banned all three IP addresses when I caught them crawling here last night!

10:38 PM Guest Viewing Index
Forum Posters Union 83.184.112.53
Mozilla/3.0 (compatible; WebCapture 2.0; Auto; Windows)

10:39 PM Guest Viewing Forum
Open Source Search Engines 66.148.71.119
Mozilla/3.0 (compatible; WebCapture 2.0; Auto; Windows)

10:39 PM Guest Viewing Index
Forum Posters Union 200.80.130.60
Mozilla/3.0 (compatible; WebCapture 2.0; Auto; Windows)

AnthonyCea · #51 12-14-2006, 08:49 PM

Check these jokers out, both IP addresses were here tonight, both spammers banned.

10:33 PM Guest Viewing Index
Forum Posters Union 202.68.151.116
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Address and Port: 202.68.151.116
Record Created: Tue May 10 12:54:40 2005 GMT
Record Updated: Tue Dec 12 03:20:10 2006 GMT
Additional Information: Spam Sending Trojan or Proxy attempted to send mail from/to from=<support@national.com.au> to=<r.dennis@paticipating.domain>

10:22 PM Guest Registering 81.177.22.180
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a)

AnthonyCea · #52 12-14-2006, 09:53 PM

Blacklisted open proxy IP's out of Korea

218.52.104.92

59.21.61.121

125.191.145.91

AnthonyCea · #53 12-15-2006, 09:02 PM

Address and Port: 193.69.180.120
Record Created: Mon Dec 4 13:37:58 2006 GMT
Record Updated: Tue Dec 12 22:18:27 2006 GMT
Additional Information: Likely Trojaned Machine, host running trojan

AnthonyCea · #54 12-16-2006, 11:30 AM

All the following IP's were used by one professional spammer at the same time and all were banned at the server level.

Open proxy IP's used by spam botnets and blacklisted.

218.78.210.96

121.1.6.130

62.181.57.113

200.84.12.98

203.229.235.209

219.7.0.119

AnthonyCea · #55 12-16-2006, 02:18 PM

Proxy IP out of Korea on many spam blacklists

61.73.146.68

Address and Port: 62.150.137.219
Record Created: Mon Nov 27 01:01:28 2006 GMT
Record Updated: Fri Dec 15 03:40:10 2006 GMT
Additional Information: Likely Trojaned Machine, host running trojan

AnthonyCea · #56 12-16-2006, 05:08 PM

Mystery IP is not such a mystery, it is a scraper spam bot

http://incredibill.blogspot.com/2006...-scraping.html

AnthonyCea · #57 12-16-2006, 06:08 PM

Ref: SBL47589

82.205.243.44/30 is listed on the Spamhaus Block List (SBL)

20-Oct-2006 11:50 GMT | SR08

419 Nigerian scam sources at turner-technologies.com

82.205.243.45 and 82.205.243.46 emit 419 scam mails since july 2006.

inetnum: 82.205.243.32 - 82.205.243.63
netname: TURNER
descr: Assignment or Turner Technologies, Nigeria
remarks: INFRA-AW
country: NG
admin-c: KA1537-RIPE
tech-c: KA1537-RIPE
status: Assigned PA
mnt-by: HSS-MNT
source: RIPE # Filtered

person: Kenn Adejuyigbe
address: Turner Technologies Limited
address: 8,Lateef Salami Street, Ajao Estate, Mafouluku,
address: Lagos , Nigeria
e-mail: kenn@turner-technologies.com
phone: +234-1-8966530
nic-hdl: KA1537-RIPE
source: RIPE # Filtered

route: 82.205.242.0/23
descr: Ramboillet teleport
origin: AS35360
mnt-by: HSS-MNT
source: RIPE # Filtered

================================================== ==============
Return-Path: <drmikebenb@hotmail.com>
Received: from bay0-omc3-s21.bay0.hotmail.com (bay0-omc3-s21.bay0.hotmail.com [65.54.246.221])
by x (Postfix) with ESMTP id x
for <x>; Fri, 20 Oct 2006 04:41:06 +0200 (CEST)
Received: from hotmail.com ([64.4.18.53]) by bay0-omc3-s21.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.1830);
Thu, 19 Oct 2006 19:41:04 -0700
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Thu, 19 Oct 2006 19:41:04 -0700
Message-ID: <BAY24-x@phx.gbl>
Received: from 82.205.243.46 by by24fd.bay24.hotmail.msn.com with HTTP;
Fri, 20 Oct 2006 02:41:00 GMT
X-Originating-IP: [82.205.243.46]
X-Originating-Email: [drmikebenb@hotmail.com]
X-Sender: drmikebenb@hotmail.com
Reply-To: drmikeben404@o2.pl
From: "Richard Thomas" <drmikebenb@hotmail.com>
Subject: i need your urgent business assistance
Date: Fri, 20 Oct 2006 03:41:00 +0100
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
X-OriginalArrivalTime: 20 Oct 2006 02:41:04.0350 (UTC) FILETIME=[2FEF07E0:01C6F3F1]
To: undisclosed-recipients: ;

Good Day Friend.

I am Dr,Mike Ben, an international business consultant.

One of my client is interested in investing Millions of
Dollars in your country and he is interested in
investing with your company.

kindly forward all your company's profile to me for
immediate decision on the investment programme.

Total amount to be invested= $75,000,000,00.usd cash.

Immediately I receive your detailed information, I will
inform him about your willinness to champion the
project effectively and feed you with his arrangements
on how the said fund could reach you.

Anticipating your immediate reply for more details on
this private E-mail: ( drmikeben404@o2.pl )

Best regards
Dr.Mike Ben

AnthonyCea · #58 12-16-2006, 07:21 PM

Russian spammers don't know how to take no for an answer, they keep coming back with new IP addresses from all over the world.

09:06 PM Guest Viewing Index
Forum Posters Union 209.160.64.38
Mozilla/3.0 (x86 [en] Windows NT 5.1; Sun)

09:07 PM Guest Viewing Index
Forum Posters Union ppp85-140-95-217.pppoe.mtu-net.ru
Mozilla/3.0 (x86 [en] Windows NT 5.1; Sun)

AnthonyCea · #59 12-16-2006, 08:00 PM

Check this professional spammer out, he is out of Germany but is using a US based IP too all at the same time!

09:52 PM Guest Viewing Index
Forum Posters Union 84.62.159.177 PTR record: dslb-084-062-159-177.pools.arcor-ip.net
Mozilla/2.0 (compatible; MSIE 3.02; Windows CE; 240x320)

09:53 PM Guest Registering 75.13.40.99
Mozilla/2.0 (compatible; MSIE 3.02; Windows CE; 240x320)

09:53 PM Guest Registering adsl-75-13-40-99.dsl.toldoh.sbcglobal.net

AnthonyCea · #60 12-16-2006, 11:09 PM

203.232.74.224 Korean Proxy IP on blacklists used by spammers

221.9.6.104 Blacklisted spam source IP

AnthonyCea · #61 12-17-2006, 10:25 AM

Check this joker out, he is using 3 spam proxy IP addresses at one time!

12:06 PM Guest Viewing Index
200.93.171.26
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MRA 4.3 (build 01218); .NET CLR 1.1.4322)

12:11 PM Guest Registering
69.61.78.103 ns2.vpsland.com
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MRA 4.3 (build 01218); .NET CLR 1.1.4322)

12:04 PM Guest Viewing Index
203.162.3.146
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MRA 4.3 (build 01218); .NET CLR 1.1.4322)

AnthonyCea · #62 12-17-2006, 12:34 PM

Forum owners alert!!

One of the spammers favorite tactics is to drop virus links on your forums, so beware of this threat.

Doing this allows the hackers to find suckers that click on the links so they can download executable scripts that convert the users computer into a zombie so they can then use their IP and computer to commit cyber crimes.

AnthonyCea · #63 12-17-2006, 08:28 PM

IP 59.3.23.143 is a popular open proxy used by spammers that is blacklisted from Korea.

AnthonyCea · #64 12-18-2006, 07:55 AM

These scrapers look for content and email addresses and use fake user agents of legitimate bots, so make sure you always check the IP's and don't ban good bots.

Ban by IP and not user agent or you will ban good crawlers too since these scam artists are using user agents of legitimate crawler bots.

AnthonyCea · #65 12-18-2006, 08:15 AM

Be sure you reference this source if you are looking to ban the top spam harverster robots.

AnthonyCea · #66 12-18-2006, 09:15 AM

IP 200.180.96.60 is an Open proxy IP used by spammers on blacklists out of Brazil.

AnthonyCea · #67 12-18-2006, 03:50 PM

Russian spammer using both blacklisted IP addresses at one time!

05:34 PM Guest Registering 83.237.108.41
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a) Gecko/20040416 Firefox/0.8.0+

05:31 PM Guest Creating Thread
General Forum Topics & Gossip 82.207.120.198
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a) Gecko/20040416 Firefox/0.8.0+

`````````````````````````````````````````````````` `````````````
11:04 AM Guest Registering 200.180.96.60
Jakarta Commons-HttpClient/3.0.1

05:41 PM Guest Registering 194.176.125.7
Jakarta Commons-HttpClient/3.0.1

05:39 PM Guest Viewing Index
Forum Posters Union 213.150.178.6
Jakarta Commons-HttpClient/3.0.1

09:21 AM Guest Registering 193.207.68.21
Jakarta Commons-HttpClient/3.0.1

AnthonyCea · #68 12-19-2006, 09:50 AM

Check this scraper spam bot setup out!

11:42 AM Guest Viewing Thread
Excellent web design showcase 64.92.199.36
Mozilla/4.0 compatible

11:42 AM Guest Viewing Archives 64.92.199.43
Mozilla/4.0 compatible

11:42 AM Guest Sending Forum Feedback 64.92.199.47
Mozilla/4.0 compatible

11:42 AM Guest Viewing Index
Forum Posters Union 64.92.199.56
Mozilla/4.0 compatible

http://www.kloth.net/internet/badbots.php

AnthonyCea · #69 12-21-2006, 08:14 AM

http://www.five-ten-sg.com/blackhole...m.spam-support

203.143.121.22 Open proxy IP from Japan used by spam artists

AnthonyCea · #70 12-21-2006, 09:09 AM

Check out this spam harvester bad bot, most likely a content scraper, we banned all of the IP addresses listed in this thread.

10:53 AM Guest Registering 213.146.205.142
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:0.9.6) Gecko/20011128

10:53 AM Guest Registering 83.201.144.151
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:0.9.6) Gecko/20011128

10:51 AM Guest Creating Thread
General Forum Topics & Gossip 201.48.59.51
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:0.9.6) Gecko/20011128

10:56 AM Guest Viewing Attachment
In 2002 there was a Shakira virus on the web 201.36.104.154
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:0.9.6) Gecko/20011128

10:52 AM Guest Creating Thread
General Forum Topics & Gossip 200.82.38.79
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:0.9.6) Gecko/20011128

10:57 AM Guest Logging In 75.4.15.222
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:0.9.6) Gecko/20011128

AnthonyCea · #71 12-21-2006, 05:05 PM

http://www.pigstye.net/error/lamer.php?order=ip

The above link shows scams, spammers and bots to block!

The below link is an example of one of the scraper bot scams that are out there!

11:06 PM Guest Viewing Index
Forum Posters Union 71.13.115.117
bot/1.0 (bot; http://; bot@bot.bot)

201.3.13.59 Spam IP address used by spammers out of Brazil on many blacklists is an open proxy.

AnthonyCea · #72 12-22-2006, 03:44 PM

211.41.232.21 IP used as proxy for spammers on many blacklists out of Korea

New Spambot on the loose

www137.powerstorm.ai.net

09:09 AM Guest Viewing Thread
Get Started with PayPal, find help here! 205.134.172.137
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4

Beware of two subdomains of powerstorm.ai.net:

www143.powerstorm.ai.net
www142.powerstorm.ai.net

AnthonyCea · #73 12-24-2006, 04:51 AM

IP 58.74.251.76 is being used by a Spam and Scraper bot user agent using proxy out of Korea

06:49 AM Guest Viewing Forum
Advertising Programs 58.74.251.76
Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; MSIECrawler)

220.117.240.133 Big time open proxy used by spammers out of Korea, more blackholed IP's listed below:

221.146.132.14

202.30.12.138

AnthonyCea · #74 12-25-2006, 08:48 AM

59.95.19.185 open Proxy IP out of India used by Russian spammer on many Blacklists

Notice user agent, still using Windows 95

59.95.19.185
Mozilla/4.0 (compatible; MSIE 5.5; Windows 95)

AnthonyCea · #75 12-25-2006, 11:54 AM

80.51.234.54 Open Proxy IP used by spammers out of Warsaw, Poland on many blacklists

See user agent:

01:51 PM Guest Registering 80.51.234.54
Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.2b) Gecko/20021016 K-Meleon 0.7

AnthonyCea · #76 12-25-2006, 02:06 PM

Check this spam artist out, he joined and is using at least 4 different IP addresses at the same time to program a forum posting bot.

221x241x227x197.ap221.ftth.ucom.ne.jp

03:34 PM debtaaaabc Registering 221.241.227.197
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050224 Firefox/1.0+

03:52 PM debtaaaabc Logging In 201.42.53.197
Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)

03:53 PM Guest Creating Thread
General Forum Topics & Gossip 58.224.34.50
Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)

03:52 PM Guest Creating Thread
General Forum Topics & Gossip 24.74.75.190
Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)

AnthonyCea · #77 12-25-2006, 04:37 PM

Here is a spammer registering from the same IP at one time using two different user agents at one time!

06:28 PM Guest Registering 203.121.69.153

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a)

06:28 PM Guest Registering 203.121.69.153
Opera/7.21 (Windows NT 5.0; U) [en]

AnthonyCea · #78 12-25-2006, 06:45 PM

85.101.30.152 IP out of Turkey that is on many spam Blacklists

218.122.112.56 Spam IP used as proxy out of Japan on many Blacklists

Notice the spammer clown using two IP's and notice the user agents and lack of user agent on the second record.

09:27 PM Guest Viewing Index
Forum Posters Union 218.122.112.56 softbank218122112056.bbtec.net
Mozilla/4.0 (compatible; MSIE 4.01; Digital AlphaServer 1000A 4/233; Windows NT; Powered By 64-Bit A

09:27 PM Guest Registering 66.98.180.53 ev1s-66-98-180-53.ev1servers.net

AnthonyCea · #79 12-26-2006, 09:30 PM

Spam IP on many blacklists out of Russia

Spammer out of Russia using two IP addresses at the same time, one a Russian IP and the other a proxy out of China, see below!

11:06 AM Guest Registering 89.19.160.26
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.00

11:08 AM Guest Viewing Index
Forum Posters Union 219.232.9.181
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.00

AnthonyCea · #80 12-27-2006, 10:05 AM

Spammer registering with a clean IP out of France, then spamming from a proxy IP.

12:04 PM Guest Registering 88.191.20.200 alinea.kd2.org France City: Paris, Ile-De-France
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.2a) Gecko/20020910

12:03 PM Guest Creating Thread
Advertising Programs 201.26.44.126
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.2a) Gecko/20020910

12:10 PM Guest Creating Thread
Advertising Programs 88.191.20.200
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.2a) Gecko/20020910