Spam-borg ban list: forum owners please post recent spammer usernames here...

[Christophe_O]

There seems to be a new wave of human-assisted spambots, i.e. spamborgs that pass through Recapcha and image verification. See Spam Bots Defeat Recapcha (http://www.vbulletin.com/forum/showthread.php?t=272439).

I suspect these are Asian game addicts. My nephew in Jakarta told me that the internet cafes there stay up all night for the teen and pre-teen game addicts. I have seen news reports of special treatment programs for game addiction in China. It is the same all over Asia. A private internet connection there is often expensive, but an internet cafe is cheap. Children go to play unsupervised.

In general, playing these games is like pinball, it does not make any money. These children seem logical targets for a local geek who can convince them that they can make money, or to help him in exchange for internet time, or game points he wins illegally with his robot skills. Most of these new spammers advertise WOW gold from the popular game World of Warcraft. Some are branching out with youthful enthusiasm to amateurish celebrity sites such as KidmanNicole.com, LoveBritneySpears.net, etc. (Click here for my spam archive thread (http://starnectar.com/showthread.php?t=63).)

There are many ideas to filter this spam, as discussed in the thread Spam Bots Defeat Recapcha (http://www.vbulletin.com/forum/showthread.php?t=272439). Meanwhile, I would like to start this thread for reporting the usernames of these 'Spamborgs'. They reuse the same usernames at hundreds of forums. But banning someone who has not even done anything at my forum is touchy. I prefer to wait until I find a WOW gold ad or a previous banning. But that is tedious. Instead, here is my idea.

1. Forum owners please make a habit of posting usernames here of any new spammer.
2. They can then be banned proactively at dozens of forums.
3. This also just might throw a wrench in their operation.

Notes:

It may be most effective to ban spamborgs after they register--instead of preventing them from registering. The spamborg method is to join dozens of forums and do nothing for some time--then suddenly start a spamming spree. If we ban a spamborg at the start of a spree--but after registering--they have wasted much effort in useless registrations. Whereas, if we attempt to prevent a spamborg from registering--they immediately know this, and can more readily respond by changing their methods.
Subscribe to this thread (http://www.vbulletin.com/forum/subscription.php?do=addsubscription&t=275885) with instant email notification to be notified of each new spammer.
In case of error, include in the one-line 'reason' for the ban that the bannee can be reinstated via your Vbulletin 'contact form'--or give a temporary email address. Also please report here if any listing is in error.
You can probably ignore any numbers appended to these usernames.
If you suspect a username--but it has not spammed your forum--please search Google first to find:
a. numerous forum memberships showing "Total Posts 0"
b. AND two "Banned" profiles OR one "WOW Gold" ad OR a listing at StopForumSpam.com (http://www.stopforumspam.com)
...If both of the above are found, then please list the username here.

Total posts and bans can be found as follows:

a. StopForumSpam.com/search?q=[username] (http://www.stopforumspam.com/search?q=[username])
b. Google: "View Profile [username]" +"Total Posts 0"
c. Google: "View Profile [username]" +Banned
d. To Google for posts that have NOT been deleted:
"View Profile [username]" -"Total Posts 0"

Caution: please confirm the 2 bans by clicking on the Google listings.

(My personal method to ban these borgs is to give a custom 12-point user infraction (http://www.vbulletin.com/forum/showthread.php?p=1569135#post1569135) of 'very obvious spam', meanwhile my auto-ban setting is permanent for 12 points. Meanwhile a forum-wide announcement of etiquette says that a banned member can simply apologize and be reinstated manually. For me, this is easier than going to the admin panel. For the bannee, this sends an automatic PM explaining the ban reason in one line. My browser remembers that one line so it's just one more click. Incidentally, my forum disallows numbers in usernames (http://starnectar.com/showthread.php?p=100). This is mainly a matter of taste but does make things easier for me and harder for them. If there are any spam posts, I 'show all posts by...' and move these with another click to a single spam archive thread (http://starnectar.com/showthread.php?t=63).)

We can start with this list from COPIERTALK at 'spam bots defeat recaptcha' (http://www.vbulletin.com/forum/showthread.php?p=1580646#post1580646):

beijmanli
jklm292
joshbob
KaiyreBoy
KevinFlys
lovebeijgo
lovemaryii
Pereftiyo
weiwei

[cyburbia]

coinnetnet
loveumaryoo
wowgold2008
tonilovekelly
lkky00245

Caught them before they could spam. All are from Chinese IPs. (On my site, they also enter the word "Array" into custom profile fields.)

FWIW, the word "love" is far more common in the usernames of my legitimate Chinese users than those from English-speaking countries. My advice: if you get a user with "love" in the username, or certain keywords related to MMORPGs (wow, warcraft, power, level, gold, coin, rune, etc), investigate.

[David Grove]

jklm160 just registered.

[beishe8]

bobo891x11 ready to post,mainly on arabic sites.

Last night Google could not find this name.

http://www.google.com.au/search?hl=en&q=bobo891x11&btnG=Google+Search&meta=

[Christophe_O]

Springbirdoo. Had not yet spammed my forum. But I banned him for "very obvious spam" because:

I found 18 memberships with 0 posts by googling:
Springbirdoo +"Total Posts 0"
AND I found 2 bans by googling:
"Springbirdoo is offline" +Banned


P.S. I also found Springbirdoo listed at StopForumSpam.com (http://www.stopforumspam.com/country/cn)

Caution: to confirm 2 bans, right-click on the Google listing and 'open in new tab'. For example, here are some Google results that are not Ban listings:

Registered Today : 2. This Hour: 0. This Month: 29. Total: 436. Banned: 0 ...
BANNED !!! bilboyfrodo. View Public Profile .... Springbirdoo
... French President Albert Lebrun immediately banned all future public executions. .... Welcome to our newest 5 members, mnop584, Springbirdoo ...

[David Grove]

Suggestion: Keep the list of usernames updated in the first post, so people can copy and paste one list. :)

[cyburbia]

I know what's going to happen to this thread. People are going to start posting the usernames of ALL spammers they get, not just the ones that fit the profile of a spamborg (likely Chinese MMORPG spammer).

A note to others: can this thread be limited to just Chinese spamborg users? Thanks.

Just seen associated with Chinese MMORPG spam on other sites:

gamelee
wwwzhudan
warren123
twelve2008
akgame
freegood
fff123r
bcde889
jeep1688

[David Grove]

Here's another one:
username: socanvz
email: cavanza@21cn.com
ip: 218.6.9.101
birthday: Jan 1 1980
timezone: +8 Beijing

[cyburbia]

defg070: nrm00521@gmail.com, 125.33.204.140 (China), 1-1-1980, +8

Googled the name, and found Italian WoW gold farming spam associated with it.

[K4L]

We have a "question" verification turned on but bots keep signing up :/ THis started happening since the recent upgrade from 3.6 to 3.7. Previously I had a plugin called "nospam!" that worked excellent.

Try this other plugin to reduce spams.
http://www.vbulletin.org/forum/showthread.php?t=135094

[cyburbia]

Try this other plugin to reduce spams.
http://www.vbulletin.org/forum/showthread.php?t=135094

Off-topic: I've got that plugin installed. It's actually based on a concept I posted a while back, but couldn't code. I noticed that xrumer (a Russian spam bot) would hammer register.php four or five times in rapid succession; far faster than a human could possibly complete the registration form.

The Chinese borgs are getting through register.php on the first try, without retries. I had custom fonts used for the captcha, and they still got through on the first try. This tells me that part of the registration process (decoding the captcha) is done by a human that is somewhat familiar with the Roman alphabet, while the rest (filling in the profile fields) is done by a script. If the new captcha and recaptcha were truly broken, we'd be seeing a lot more than just MMORPG spam from China.

My moderately-successful "Great Wall" has been:

1) In .htaccess, redirecting trouble-prone Chinese IPs to a placeholder page. This blocks about 90% of them. I add new blocks to .htaccess on a regular basis. Do a search for user to find details about how I do this.
2) Blocking certain free email addresses. Blocks a bunch more.
3) MonkeyStop Keyword and URL Moderation plugin and a good list of keywords. For the few that register, this mod directs their posts to the mod queue.

I have legit Chinese users, so this allows them to view the board, but keeps spambots from registering; legit users from China are directed to send me email if they want to join. For those with no legit Chinese users, there's the nuclear option; blocking the entire country through .htaccess.

Back on topic. FWIW, I've noticed that most of the IPs have been from Chinanet provincial network blocks.

[l4a]

Here is a useful tool for those of you who choose to manually approve new registrations - Check It Out (http://www.stopforumspam.com/search)

[copiertalk]

weiwei visits my site a few times a day now. Him/her and kevinflys are starting to get on the annoying side. I wish they would at least click on my ads.

221.221.12.102

seems to be pretty much content just sitting there banned.

[David Grove]

A couple more just registered.

username: LRTIMKEN
email: liushuai3366@sina.com
b'day: Jan 1 '80
IP: 221.201.208.86
Timezone: Beijing

username: Lovingttu
email: ccc32o@gmail.com
b'day: Jan 1 '80
IP: 222.183.121.112
Timezone: Beijing

[K4L]

If you are using vb3.7+ trying using NoSpam! for 3.7+
http://www.vbulletin.org/forum/showthread.php?p=1548655#post1548655

[David Grove]

And a couple more...

Username: alexwm1234
Email: javaalexme@gmail.com
IP Address: 218.104.68.244
Birthday (d-m-y): 1-1-1980
Timezone: 8

Username: zhangfanfan001
Email: zhangfanfan001@gmail.com
IP Address: 125.71.130.65
Birthday (d-m-y): 1-1-1980
Timezone: 8

[copiertalk]

A couple more just registered.


username: Lovingttu
email: ccc32o@gmail.com
b'day: Jan 1 '80
IP: 222.183.121.112
Timezone: Beijing

same

I have picked up several members with out valid email as well.

[K4L]

Okay this is what I have done to reduce spams.

Since this is a v3.7 forum I presume that you are using v.3.7+

- I downloaded nospam! plugin for 3.7+ (http://www.vbulletin.org/forum/showpost.php?p=1548655&postcount=765) and installed
- akismet plugin from vbulletin.org to detect spams by human / also try the new built-in akismet feature in 3.7
- turned off "Q & A Human Verification" and changed it to "Image verification".
- links not allowed to post for new members.

Just 2 cents.

[Hayk]

beijmanli
jklm292
joshbob
KaiyreBoy
KevinFlys
lovebeijgo
lovemaryii
Pereftiyo
weiwei

lol, I know all of them:D

Will submit, when will have a free time;)

[1996 328ti]

Add wowgold1000
122.234.54.127

[Christophe_O]

I came here to list Lovingttu: 76 +"Posts 0" google results, 1 "Lovingttu is offline" +Banned, plus a listing at StopForumSpam.com (http://StopForumSpam.com). (But SOCKWATER beat me to it.)

Can this thread be limited to just Chinese spamborg users?
I agree that we do not want to list spam from real people who also post discussion messages, i.e., people who are at least competent to be real forum members. However I think we do not need to worry about spam from traditional bots, because I do not think they are getting through Image Verification.

My idea is to list anything that gets through Image Verification that is evidently a spamborg. Maybe they are all Chinese but I am not following that assumption. As CYBURBIA has pointed out, these are software-assisted humans. These are not, for example, webhosts who advertise in the non-advertising subforums. They don't start new threads. They don't pick relevant threads that might be seen by potential customers. They obviously don't even understand what they are posting. Obvious and pointless spam is all that they do. This is why I can verify them by Googling for +"Total Posts 0"--and 12 or more Google results indicates a probable spamborg.

The reason for this thread is that these spamborgs are like antibiotic-resistant viruses. They can not be stopped with automatic software. It might not even be the best strategy to stop them. If you could automatically recognize them and prevent them from entry, then they can just retry with a different name or whatever. It may be better to allow them to join, then quarantine them to some invisible subforum. There they can leave their dirt, without messing up your real forum. However for the time being I am just banning them.

My own forum is new, will not be officially open for about 6 months. (I am busy working on related websites.) My forum has only 3 real members, and disallows numbers in usernames. Therefore, my forum is like a testing laboratory. I use standard Image Verification, not Recapcha, and there is no reason to advertise in my forums. Traditional Bots are not getting through in my forum, and perhaps not even trying. Yet the spamborgs are coming. So, perhaps you can even determine how often a new spamborg is created from how often I post in this thread. I am hoping they will peter out from timely banning. But if not, then I will experiment with a quarantine.

( :rolleyes: If the puppetmasters of all this spam were a bit more clever, they could easily find ways to post effective signature ads in major forums, that would not even be detected as spam! But it seems that all this is like just another game to them. They seem to be the result of a Western-invented Computer Mom upbringing, combined with an Eastern-invented post-communist survivalism. I.e., the East and the West have met and the result is not exactly Tai Chi. These are real-life teenage mutants, who are not even human enough to understand what a 'discussion forum' is about.)

Suggestion: Keep the list of usernames updated in the first post, so people can copy and paste one list. :)
There may be a time limit for editing the first post. Also I might not get to it sometimes. So...

Here is a complete list of all spamborgs posted here so far.
Anyone: if your browser shows a new page and nobody has yet posted a total list, feel free to do so.
Please use the size=1 VB code for the smallest font size for this list.
Maintain alphabetical order please.


akgame
alexwm1234
bcde889
beijmanli
bobo891x11
coinnetnet
defg070
fff123r
freegood
gamelee
lkky00245
jeep1688
jklm292, jklm160
joshbob
KaiyreBoy
KevinFlys
lovebeijgo
lovemaryii
loveumaryoo
LRTIMKEN
Pereftiyo
socanvz
Springbirdoo
tonilovekelly
twelve2008
warren123
weiwei
wowgold2008, wowgold1000
wwwzhudan
zhangfanfan001

[K4L]

I dont understand why many of you are getting many spam accounts.

Try my method. It has stopped for me.
http://www.vbulletin.com/forum/showpost.php?p=1585600&postcount=18

[cyburbia]

I'm fine-tuning my IP diversion list.

Question to those still getting hit hard with spam: do you have any MMORPG spamborgs that are not in a Chinanet, CNC Group (also Chinanet), Oriental Cable, China Education and Research Network or Beijing Education Information Network IP block?

Basically, if I divert every Chinese IP block in .htaccess, the IP list would be unbelievably long. If i get the biggies listed above, which comprise about 95% of the country's IP space -- and from what I've seen so far, all of the spamborg sources -- the list would be much, much shorter.

(FWIW, I don't blacklist Chinese IP blocks, because I have many legit users in the PRC. I'm diverting visits to register.php from certain IP blocks to a placeholder page, which ask those who are interested in joining the message board to send me an email with pertinent details.)

[transpetaflops]

Basically, if I divert every Chinese IP block in .htaccess, the IP list would be unbelievably long. If i get the biggies listed above, which comprise about 95% of the country's IP space -- and from what I've seen so far, all of the spamborg sources -- the list would be much, much shorter.

If you're referring to the list in this thread, that list is unnecessarily long. Most of those subnets can be combined to larger ones resulting in a list only half as long but still containing the same information. Still - over 500 rows of ip-blocks in .htaccess is rather extreme...
/PP

[cyburbia]

If you're referring to the list in this thread, that list is unnecessarily long. Most of those subnets can be combined to larger ones resulting in a list only half as long but still containing the same information. Still - over 500 rows of ip-blocks in .htaccess is rather extreme...
/PP

That's the nuclear option, which I don't advise using unless one is getting hit really hard.

Like I said, I don't ban Chinese IPs. I divert selected IPs away from register.php. This is my latest list. Of course, it can be uncommented and cut in half; down to 100 lines or so. EDIT: If you downloaded the attachment the first day I posted it, it included a Telstra IP block. I made some corrections since then, and re-uploaded the list.

[Nick]

ok0510
ok0510@126.com
221.6.182.50

Banned on many other forums: Google: ok0510 + "banned" (http://www.google.com/search?client=firefox-a&rls=org.mozilla%3Aen-US%3Aofficial&channel=s&hl=en&q=ok0510+%2B+%22banned%22&btnG=Google+Search&aq=f)

--

crack
crackwee@yahoo.com
83.138.172.79

[David Grove]

Just go this one:

Username: Spetertoi
Email: sof8op@gmail.com
IP Address: 222.183.129.47
Birthday (d-m-y): 1-1-1980
Timezone: 8

Updated list:

akgame
alexwm1234
bcde889
beijmanli
bobo891x11
coinnetnet
crack
defg070
fff123r
freegood
gamelee
lkky00245
jeep1688
jklm292, jklm160
joshbob
KaiyreBoy
KevinFlys
lovebeijgo
lovemaryii
loveumaryoo
LRTIMKEN
ok0510
Pereftiyo
socanvz
Spetertoi
Springbirdoo
tonilovekelly
twelve2008
warren123
weiwei
wowgold2008, wowgold1000
wwwzhudan
zhangfanfan001

[1996 328ti]

Here's a new one.
stuv021
221.200.211.135

[1996 328ti]

And another.
qrst747
60.175.220.137

[Windsun]

We just got tired of it and blocked most Chinese IP's.

Funny thing is, just yesterday we got an admin post wondering why one of them could not register, so that proves that there is a human in there someplace.

[Nick]

Updated List:


akgame
alexwm1234
bcde889
beijmanli
bobo891x11
coinnetnet
crack
defg070
fff123r
freegood
gamelee
lkky00245
jeep1688
jklm292, jklm160
joshbob
KaiyreBoy
KevinFlys
lovebeijgo
lovemaryii
loveumaryoo
LRTIMKEN
ok0510
Pereftiyo
qrst747
socanvz
Spetertoi
Springbirdoo
stuv021
tonilovekelly
twelve2008
warren123
weiwei
wowgold2008, wowgold1000
wwwzhudan
zhangfanfan001

[steponfrog]

Hi,

Don't you think it would be easier if all users that fail the CAPTCHA process at registration time were marked as SPAMMERS, and then all their posts placed into a moderated queue, until removed from the SPAMMER list?

An automatic system that marks unsuccessful registrations (ie, BOTs that fail the CAPTCHA image) would save you having to chase SPAMMERS and their posts through your own boards.

To prove how successful an automatic SpamMarking system would be in stopping spam on your board, simply register yourself on your own board. Take note:

that you have to provide a username to register with;
when you fail the CAPTCHA image, you are doing exactly what the BOTs do;
every part of your registration process can be logged, but isn't!
The method of creating a list of usernames is helpful, just so long as the list doesn't get too long, becuase the Admins will have to check each name on their own boards against the names in this Spammer Username list.

An automatic Spammer Marking system would be more effective in prevention.

This thread --> http://www.vbulletin.com/forum/showthread.php?t=276686 <-- marks out the system that I am, and I believe everyone else will be, after.... but, if you're going to read it, please remember that it is not asking for a list of usernames, nor is it providing a means to code your own boards. This thread is asking for instructions on how to create, or for someone to do the job of creating a system (a MOD, or a way of editing templates) that moves new registrations that fail the CAPTCHA image recognition procedure at registration time into a moderated queue, and then for usernames in this moderated queue to be flagged whenever a post appears under that username.

I think it should already be a part of the vBulletin system, anyway, but that's my own opinion.

[1996 328ti]

Hi,

Don't you think it would be easier if all users that fail the CAPTCHA process at registration time were marked as SPAMMERS, and then all their posts placed into a moderated queue, until removed from the SPAMMER list?Maybe it's too early in the morning for me to understand,
but if a registration fails because of CAPTCHA, didn't CAPTCHA do it's job?
I can't tell you how many times I fail and need to re-enter the image when I register on sites.

[David Grove]

I definitely think that failing a CAPTCHA should NOT indicate that a user is a spammer. A very high percentage of real humans fail captchas.

[Nick]

Hi,

Don't you think it would be easier if all users that fail the CAPTCHA process at registration time were marked as SPAMMERS, and then all their posts placed into a moderated queue, until removed from the SPAMMER list?


What posts? On most forums, a member can't register without passing CAPTCHA. Furthermore, they cannot post without being registered.

Therefore, anybody who fails CAPTCHA cannot post... thus, there would be no moderation queue for them.

[David Grove]

Just got a couple more:

Username: qrst436
Email: goldsmaker@gmail.com
IP Address: 59.56.7.82
Birthday (d-m-y): 1-1-1980
Timezone: 8

Username: stuv454
Email: bbsone@pc136.com
IP Address: 60.171.227.0
Birthday (d-m-y): 1-1-1980
Timezone: 8

[1996 328ti]

Just go this one:

Username: Spetertoi
Email: sof8op@gmail.com
IP Address: 222.183.129.47
Birthday (d-m-y): 1-1-1980
Timezone: 8

got this one just now
222.183.122.160

I'm glad I have the mod that sends me security token mismatch errors.
It's usually caused by a spammer.

Array
(
[do] => updatesignature
[wysiwyg] => 1
[MAX_FILE_SIZE] => 10485760
[sigpicurl] => http://www.
[url] => /forum/profile.php?do=editsignature
[s] =>
[message] => free games
[securitytoken] =>
[ajax] => 0
)

Request URI

[tommy2watt]

Here's another one:
username: socanvz
email: cavanza@21cn.com
ip: 218.6.9.101
birthday: Jan 1 1980
timezone: +8 Beijing

do yourself a favor and under USER BANNING in the ADMINCP
ban the email address @21cn.com

i have had well over 10 registrations from that domain in 1 week!
all with random usernames.

[1996 328ti]

A new one.

worthtosee
117.26.202.197
worthtosee @ 163.com

[Christophe_O]

I dont understand why many of you are getting many spam accounts. Try my method. It has stopped for me.
NoSpam! --an alternative to capcha images (http://www.vbulletin.org/forum/showthread.php?t=124828).

Thank you for the tip K4L. I like the NoSpam system and I have referenced it in the other thread. This enables people to use simple questions, either to replace or add to image verification. I believe this can help because Spamborgs do not seem to speak English... However... I just realized that Vbulletin 3.7 has Q&A verification. I am going to upgrade and try that first. NoSpam might be better, but I like to avoid hacks as much as possible.

*************************

I just banned Spetertoi, with 36 Google results for +"0 Posts"... 2 Google results for "Spetertoi is offline" +Banned... 1 StopForumSpam.com listing... and 2 previous listings in this thread :o

*************************

Spamborg join dates for Starnectar Free Forums (http://starnectar.com). (A new forum, not advertised, with 62 Threads, 130 Posts, 20 Members, standard non-Capcha image verification on low settings, and numbers disallowed in user names.)

2008.05.20 KaiyureBoy
2008.05.21 beijmanli
2008.05.22 lovebeijgo
2008.05.28 loveumaryii
2008.05.31 dreamath
2008.06.04 Tcrubuyuuie
2008.06.10 weiwei
2008.06.11 Pereftiyo
2008.06.17 socanvz
2008.06.18 Springbirdoo
2008.06.25 Lovingttu
2008.07.04 Spetertoi

My conclusions so far.

In May, I suspected that the spamborgs were more attracted to my forum because I was lax in banning them.
In June, I developed systematic pre-emptive banning. This "maybe" was responsible for slowing them down but has not stopped them.
Currently I receive one spamborg weekly like clockwork.
It is possible to predict the next spamborg and what his name will be. Spetertoi joined SOCKWATER's forum June 30, then Starnectar Forum July 4.
Using such predictions, a "stealth cookie" might ID a spamborg computer, then trigger a special reaction the next time that computer is used to join a Vbulletin, regardless of the user name. To prevent the borg-master from countering with a format, this reaction must be invisible. (Such as allowing his spamborgs to join, but confining them to a phantom subforum.)
However, my strategy for now is simply to upgrade to Vbulletin 3.7 and use the new Q&A verification.

(If after installing the Q&A system, I still get spamborgs, I will not ban them. Instead, I will attempt to divert them to a phantom subforum. I would like to see how this works out, and also whether "allowing" spamborgs to believe they are posting successful messages may or may not encourage a flurry of additional spamborg sign-ups...?)


do yourself a favor and under USER BANNING in the ADMINCP ban the email address @21cn.com
socanvz is my only spamborg who used @21cn.com to join Starnectar Forums. All others used @gmail.com. 21cn.com (http://21cn.com) appears to be a major Chinese language website. So, banning @21cn.com sign-ups may be equivalent to banning Gmail sign-ups or Chinese IP's. I am no expert but I surmise that this might discourage real Chinese members, while the spamborgs would simply change to all Gmail accounts.

[giraffesyo]

New one today at 03:00 -6:00 GMT

"Global" was his username, posted two iphone ads.

[Christophe_O]

I think the spamborg problem may be solved by upgrading to Vbulletin 3.7. (As I said in an edit of my last message.) With creative use of the new Q&A verification system, and each forum having simple but different questions, we can keep things easy for real members but create a headache for spamborgs who evidently as part of their nature of being 'ultra cheap labor' do not speak English. I just checked our profiles and it seems that everyone including me who is posting in this thread is a slacker using Vbulletin 3.6... :o Perhaps that says something...?
If spamborgs start using popular names, this may make listing them rather pointless. I just received a suspicious sign-up from 'Stephanie'. I can not ban her or put her on the list because this is such a popular name. There are numerous Google results for Stephanie, but clearly including many different and real people. There is one StopForumSpam listing with the same email address, so I do have a probable spammer. But is this a spamborg or a real person who misbehaved once? StopForumSpam does not supply links to archives of alleged spam, so I can't tell.
Meanwhile, let's soldier on. I never promised this would lead anywhere. Just an experiment for those who are so inclined, or have a bit of insomnia. To reduce the screen length of the spamborg list, let's put all names beginning with the same letter on one line, as below.

July 5, 2008 Alleged Spamborg List.
akgame, alexwm1234
bcde889, beijmanli, bobo891x11
coinnetnet, crack
defg070
fff123r, freegood
gamelee, Global
lkky00245
jeep1688, jklm292, jklm160, joshbob
KaiyreBoy, KevinFlys
lovebeijgo, lovemaryii, loveumaryoo, LRTIMKEN
ok0510
Pereftiyo
qrst436, qrst747
socanvz, Spetertoi, Springbirdoo, stuv021, stuv454,
tonilovekelly, twelve2008
warren123, weiwei, worthtosee, wowgold1000, wowgold2008, wwwzhudan
zhangfanfan001

P.S.

I have updated my methods of searching for Ban listings.

a. StopForumSpam.com/search?q=[username] (http://www.stopforumspam.com/search?q=[username])
b. Google: "View Profile [username]" +"Total Posts 0"
c. Google: "View Profile [username]" +Banned
d. To Google for posts that have NOT been deleted:
"View Profile [username]" -"Total Posts 0"

:D Thank you for the note below, COPIERTALK. (I hope Stephanie is a raving Buddhist fanatic. I could use a few on my forum. That would go well with all the WOW Gold ads.)
:D Thank you for the heads up SOCKWATER. (I think our defenses against PM spam could be improved with a 'daily limit'. Click here for my strategy against PM spam (http://www.vbulletin.com/forum/showthread.php?p=1590647#post1590647).)

[copiertalk]

I think Stephanie was a Buddhist spammer. I think I remember that from a previous spam thread from the chit chat forum.

[David Grove]

On my boards, Stephanie started sending Buddhist spam via PMs to a lot of users before I banned her.

[cyburbia]

They got onto my 3.7 board (using vBulletin image verification) before I made the IP restrictions tougher. Their posts never appeared (posts including URLs by those with five or fewer posts are diverted to the mod queue), but they still registered.

[shohin]

Seems as though no one is listening to what "K4L" has said!
Posting a list of spammers is a bit absurd and, if nothing else, a lot of unnecessary work. After all, trying to put up with spammers is a lot of work and is that what you're trying to avoid is it not?

I've had email verification for sometime so as not to let them in. It got to the point that they were quite easy to spot but at yet there were times of doubt as to someone being legitimate or not. Simply stop the idiots in their tracks and don't waste any more time trying to sort them out and waste valuable time making lists!

I was getting an average of 8 to 12 a day until I got sick of it!
Simply use human verification and put an end to it and spend time with other things. When I placed this in it stopped immediately!! Not ONE single spammer since I used this method. Either use the link "K4L" gave you or simply use this: http://www.vbulletin.com/forum/showthread.php?t=205214 or this: http://www.vbulletin.org/forum/showthread.php?t=124828

No more spammers……no more lists! End of it!!

~Phil

[riderbook]

posting the usernames is of no use, they use different username if you ban 1, u need to ban the ip, try to find the original ip of the user and not the proxy usually these spammers use to get in, hack is available in vb.org to convert proxy to real ips

[riderbook]

Seems as though no one is listening to what "K4L" has said!
Posting a list of spammers is a bit absurd and, if nothing else, a lot of unnecessary work. After all, trying to put up with spammers is a lot of work and is that what you're trying to avoid is it not?

I've had email verification for sometime so as not to let them in. It got to the point that they were quite easy to spot but at yet there were times of doubt as to someone being legitimate or not. Simply stop the idiots in their tracks and don't waste any more time trying to sort them out and waste valuable time making lists!

I was getting an average of 8 to 12 a day until I got sick of it!
Simply use human verification and put an end to it and spend time with other things. When I placed this in it stopped immediately!! Not ONE single spammer since I used this method. Either use the link "K4L" gave you or simply use this: http://www.vbulletin.com/forum/showthread.php?t=205214 or this: http://www.vbulletin.org/forum/showthread.php?t=124828

No more spammers……no more lists! End of it!!

~Phil
this is pretty good suggestion but you don't expect all spammers to be wierd there will be some clever and.... spammers around so itz not of 100% guarantee and personally changing text is highly impossible for some of the busy admins around

[copiertalk]

Easyforpp

uf9p9o@gmail.com

jan 1. 1980

222.183.131.90

Went right to modifying signature right after registration.

[shohin]

this is pretty good suggestion but you don't expect all spammers to be wierd there will be some clever and.... spammers around so itz not of 100% guarantee and personally changing text is highly impossible for some of the busy admins around

You don't have to change anything. You simply enter in a simple question(s) and your done with it. How long can that take.....5 minutes? Like I previously said, I was getting an average of 12 or more a day. It's just been over two weeks now and not a single one! Now I have more time to devote to other more important things. One of them is certainly not making and placing spammers on a list as I simply don't have any more! I'm sure the occasional one may slip through here and there but it seems as though they will be very few and far in between. It seems to me that checking and making lists of spammers is far more time consuming than simply implementing a simple safe guard. But, if you insist on doing so by all means be my guest.
http://www.vbulletin.org/forum/showpost.php?p=1568961&postcount=45

~Phil

[randychase]

Kind of a new twist on just one of my forums.

I get around 10 people all signing up within minutes. All different names, emails. All real estate related. My forum is about motorsports in San Diego... not real estate in Virginia. The only thing that seems to be the motivation is that they all have sigs with real estate urls.

I deleted all of them, 2 days later 10 new ones.

[riderbook]

Kind of a new twist on just one of my forums.

I get around 10 people all signing up within minutes. All different names, emails. All real estate related. My forum is about motorsports in San Diego... not real estate in Virginia. The only thing that seems to be the motivation is that they all have sigs with real estate urls.

I deleted all of them, 2 days later 10 new ones.

check out their IP's and email registrars you might find a similarity if they are coming from same location

[riderbook]

You don't have to change anything. You simply enter in a simple question(s) and your done with it. How long can that take.....5 minutes? Like I previously said, I was getting an average of 12 or more a day. It's just been over two weeks now and not a single one! Now I have more time to devote to other more important things. One of them is certainly not making and placing spammers on a list as I simply don't have any more! I'm sure the occasional one may slip through here and there but it seems as though they will be very few and far in between. It seems to me that checking and making lists of spammers is far more time consuming than simply implementing a simple safe guard. But, if you insist on doing so by all means be my guest.
http://www.vbulletin.org/forum/showpost.php?p=1568961&postcount=45

~Phil
you are rite and we have it already added not the vb.org but the one suggested via profile field manager
I would never entertain myself to be your guest :p

[Christophe_O]

[LIST]
I think the spamborg problem may be solved by upgrading to Vbulletin 3.7. (As I said in an edit of my last message.) With creative use of the new Q&A verification system...

Seems as though no one is listening to what "K4L" has said! Posting a list of spammers is a bit absurd and, if nothing else, a lot of unnecessary work... Simply use [Q&A] human verification and put an end to it and spend time with other things... [The NoSpam hack (http://www.vbulletin.org/forum/showthread.php?t=124828) enables the use of both Q&A and Image Verification.]
:D Thank you PHIL for supporting, with your direct experiece, what I surmised myself, and also the benefits of the NoSpam system. I personally suspect it is more friendly for real members to use just the questions, as available in Vbulletin 3.7, and it's not necessary to mix questions with pictures as is possible with NoSpam. But time will tell. Meanwhile, for those who feel inclined to make this spamborg list, it is a nice little reference and there is no telling how this may help to refine our future strategies.

:D Evidently, the new Vbulletin Q&A feature was inspired by NoSpam. Which is the ultimate kudo for a hack, to be made a standard feature. However as PHIL has also said, NoSpam still has greater versatility and is evidently quite stable.

:D I just banned Easyforpp: 36 profiles with "total posts 0", 2 previous bans, listed in StopForumSpam.com, and also in this thread 2 days ago. I believe this says 2 things.

PHIL is right, listing and banning does not slow down the spamborgs. They are now definately coming faster if anything. One of my reasons for starting this thread was to find this out and it is now found out.
But RIDERBOOK is not quite right. These spamborgs are so far not so intelligent as not to reuse their usernames. (Except of course to the extent that probably only a few people are responsible for our entire spamborg list. Maybe even just 1 wiseacre.)

;) Please note that this thread is about spamborgs who are as unlike traditional spammers as a suicide 911 hijacking is unlike the traditional hijackers who wanted to land somewhere such as Cuba, etc. The spamborgs are more of a potential problem for more forums because they are without rhyme or reason. But by the same token their bag of tricks is limited. Hopefully PHIL is right and with Q&A we will be rid of this phenomena.

[steponfrog]

Now here's an odd one... It seems some spammer has posted their whole advertisement into the username box on the registration form on my forum...

Here's a copy of the username the spammer tried giving:

{cigarette|cheap cigarette|discount cigarette|marlboro cigarette|camel cigarette|cigarette store|cigarette cases|buy cigarette|online cigarette|cigarette smoking|cigarette coupon|cigarette smoke|newport cigarette|wholesale cigarette |cigarette holder|cigarette lighter|cigarette girl|cigarette boat|accessorie cell cheap cigarette phone|buy cigarette online|cigarette prices|cheapest cigarette|doral cigarette|cigarette machine|cheap cigarette online|free cigarette coupon |coffee and cigarette|marlboro cigarette web site|clove cigarette|cheap marlboro cigarette|first cigarette|winston cigarette|camel cigarette web site|cigarette fag smoking|salem cigarette|cigarette rolling machine|kool cigarette|dirt cheap cigarette|cigarette cheaper|cigarette tobacco|cigarette sale|woman cigarette|cigarette tax|marlboro cigarette coupon|buy cheap cigarette|effects of cigarette smoking|light cigarette |cigarette brand|cig cigarette smoker smoking|free cigarette|cigarette ads|leather cigarette cases|candy cigarette|cigarette ingredient|romance and cigarette|newport cigarette coupon|discount cigarette online|american spirit cigarette|marlboro cigarette official web site|cigarette filter|cigarette pack|basic cigarette|dunhill cigarette|camel cigarette official web site|cigarette box|cigarette carton|duty free cigarette|seneca cigarette|cigarette lighter adapter|cheap newport cigarette |quit smoking cigarette|lucky strike cigarette|parliament cigarette|buy cheap cigarette online|smoking cigarette tobacco|ingredient in cigarette|in cigarette|cigarette sales|long cigarette|cigar cigarette|girl smoking cigarette|cigarette papers|cigarette card|tax free cigarette}

The IP address is
68.41.219.232

Errrr..... Can I just point something out...?


Seems as though no one is listening to what "K4L" has said! Posting a list of spammers is a bit absurd and, if nothing else, a lot of unnecessary work... Simply use [Q&A] human verification and put an end to it and spend time with other things... [The NoSpam hack (http://www.vbulletin.org/forum/showthread.php?t=124828) enables the use of both Q&A and Image Verification.]


All this means that a possible SpamBot has attempted a registration on your forum and has not been entirely successful. However, patt of the registration process HAS been successful, because a username has been logged -> see Paul M (http://www.vbulletin.org/forum/member.php?u=63698)'s Mod Track Guest Visits (http://www.vbulletin.org/forum/showthread.php?t=167278).

If you find it hard to see what relevance my gripe has with Spammers, then you should install the Mod Track Guest Visits (http://www.vbulletin.org/forum/showthread.php?t=167278) by Paul M (http://www.vbulletin.org/forum/member.php?u=63698), as it shows pages that have been viewed and by whom, primarily by IP address (so I can spot SearchEngine Bots). But, more to the point, the Track Guiest Visits mod shows what usernames have attempted to register through the registration page; this latter part is interesting, because it means the username that someone has tried registering with has been logged somewhere.

And, yes, before you go pointing out that the SpamBot has been unsuccessful, don't you thnk it a tad likely that the human equivalent can come back and finish the registration job off under the same username?

The best way to stop the attempted spamming is to do it at the registration process, so that the username is logged, and later that username can be placed into a moderation queue should a post be made. This will stop any posts being placed in any of your forums, and differs from any AntiSpam mod out there now in that the AntiSpam mods wait for a spam post to be made, and then they delete or whatever.

A lot of people have completely misunderstood the discussions I've posted about this subject, so here's two threads that bring it all to light:

http://www.vbulletin.com/forum/showthread.php?t=276686
http://www.vbulletin.com/forum/showthread.php?t=276709

The key here is to log and track all usernames, which vBulletin doesn't do, unless you're registered, hence you're a member. It won't take up any more space in your database than a single post (just look at the length of this one!) There would be a comparison against such a list of usernames made at re-registration (and possibly a notice shown and an alert to the Admin), or allowed to register and then moderated (useful for possible legitimate users).

Seriously, the only thing that I've found useful is the Track Guest Visits by Paul M, because it actually shows the username and IP address that has tried to register with my forum, whereas everything else doesn't. If a username that isn't registered on your forum can be shown on the Track Guest Visits page, then why can't these usernames be logged to a database and then tracked? For some reason, this doens't seem sensible to a lot of people (probably spammers).

[stevectaylor]

Is there a method that VB could collate a list for us to use easily?

[setishock]

iDracula
myphpbb@gmail.com
222.187.236.141

[Dark Lord]

Username - Greettat
Email - greettt@gmail.com
IP - 125.82.22.46
Time Zone - +8 Beijing (Surprise surprise)

Had 3 of these so far and just deleted them. God knows how they found my site as it's not even been submitted to the search engines yet coz I'm still working on it :confused:

[shohin]

:D Thank you PHIL for supporting, with your direct experiece, what I surmised myself, and also the benefits of the NoSpam system. I personally suspect it is more friendly for real members to use just the questions, as available in Vbulletin 3.7, and it's not necessary to mix questions with pictures as is possible with NoSpam. But time will tell.

Hopefully PHIL is right and with Q&A we will be rid of this phenomena.

Well, all I can say on my part/experience thus far is this.
I was getting an average of 8 to 14 spammers a day and it seemed to be snow balling out of hand! Since I implemented the question and then later, the question with the image verification of "NoSpam" I've not had a single one since! That is well over one month now with not even one spammer!
As I said before I'm confident that there will indeed be the occasional one who may slip through the crack but I think I can handle one every few months rather than what I was going through before every singe damn day! It's now a pleasure to turn on the computer each morning rather than the dread I had before knowing I would have to deal with a crap load of moron spammers!

~Phil :)

[MGSteve]

Since we installed this mod (http://www.vbulletin.org/forum/showthread.php?t=135094&highlight=ISBot) on the 2nd of June its stopped 4,801 attempted signups.

At the very least I strongly recommend you install this. It doesn't stop them all, but it stops a lot of them.

[tommykjensen]

Since we installed this mod (http://www.vbulletin.org/forum/showthread.php?t=135094&highlight=ISBot) on the 2nd of June its stopped 4,801 attempted signups.

At the very least I strongly recommend you install this. It doesn't stop them all, but it stops a lot of them.

Thanks for that tip. Less than an hour after installing this it blocked the first spam bot.

[esperone]

This might be a stupid question but how do i ban a username, in the admincp, if it doesn't exist in my database?

I have been trying to figure it out but can't seem to find a way to do it.

[David Grove]

You should start a new thread with your question.

[g0dfather]

Opps, one second.

[Racing Sim]

Just found this thread...


Our public forums have been hit by 70 spam accounts from 2/08 - 17/08 today! 35 accounts per week!


I forced a sign up field (Additional Required Information - profile) and the spam bots have fallen for it and keep using the same name in the field!!! Thus this is a good reason to force the bots to use so you can get an idea who is signing up and if it’s genuine. As a result I am certain it’s the same bot / human signing up as the required field is the same every time!


Image Verification... I have tried all three and all don’t seem to stop them from registering.


Can’t we have a random sign up URL after the Image Verification and drop down boxes to answer a maths question? Then a 2nd Image Verification option after the random sign up URL? If the maths question is wrong force a new start up!


Great site: http://www.stopforumspam.com/downloads/ (http://www.stopforumspam.com/downloads/)

Here are some of the sign up accounts:


bifikoza
Email Address : misha007@terbuny.net
Birthday : August 25, 1988
IP Address: 74.50.108.111

Powerhorse
Email Address : alfa-de-villa@ua-news.net
Birthday : March 27, 1960
IP Address: 66.232.114.56

Mifikko
Email Address : minerals@rupr.org
Birthday : September 19, 1967
IP Address: 74.50.108.219

muyinoa
Email Address : muyinoa@gmail.com
Birthday : October 12, 1960
IP Address: 222.74.200.2
browsing address: 2.200.74.222.broad.hh.nm.dynamic.163data.com.cn

pataagusata
Email Address : pataagusata@greatfreemail.net
Birthday : February 26, 1971
IP Address: 78.157.143.212

LagkawCeask
Email Address : juioluil@gmail.com
Birthday : April 19, 1969
IP Address: 92.48.127.93

benderkoz
Email Address : benderkoz@gmail.com
Birthday : June 21, 1986
IP Address: 87.236.29.207

germibv
Email Address : germibv@gmail.com
Birthday : February 17, 1978
IP Address: 68.230.44.234

bymnOppotoror
Email Address : nempoesywew@bimgir.net
Birthday : October 13, 1983
IP Address: 70.168.2.5

freevideom
Email Address : freevideom@mail.ru
Birthday : January 9, 1980
IP Address: 72.36.132.226

oveseeTootrum
Email Address : sdthrhtrj@gmail.com
Birthday : June 23, 1982
IP Address: 92.48.127.93

sernivaz
Email Address : sernivaz@gmail.com
Birthday : May 28, 1976
IP Address: 24.63.222.23

chunpula
Email Address : chunpula@gmail.com
Birthday : October 3, 1988
IP Address: 89.136.133.67

kekphefly
Email Address : noviidor@mail.ru
Birthday : January 28, 1979
IP Address: 195.188.174.182

Nearreonoum
Email Address : zextneurece@xsecurity.org
Birthday : May 15, 1974
IP Address: 91.121.95.104

BuyCheapest
Email Address : viagra-cheapest@your-best-holiday.info
Birthday : June 19, 1981
IP Address: 200.63.42.147

hamnigam
Email Address : hamnigam@gmail.com
Birthday : February 21, 1960
IP Address: 216.9.106.147

guehoutbath
Email Address : rtgdrghhrth@gmail.com
Birthday : July 9, 1967
IP Address: 92.48.127.93

EVEXTTUMEXCAT
Email Address : advodaexabete@gmail.com
Birthday : July 15, 1973
IP Address: 200.63.42.107

Joymnallemolo
Email Address : stoxdoomb@gmail.com
Birthday : February 17, 1968
IP Address: 200.63.42.71

EVEXTTUMEXCAT
Email Address : advodaexabete@gmail.com
Birthday : April 19, 1984
IP Address: 200.63.42.107

dedAppobresew
Email Address : playncunacy@gmail.com
Birthday : February 21, 1974
IP Address: 200.63.42.105

kinokitla
Email Address : kinokitla@gmail.com
Birthday : October 12, 1971
IP Address: 83.141.213.197

Nearreonoum
Email Address : zextneurece@xsecurity.org
Birthday : May 15, 1974
IP Address: 165.193.47.4

bervedas
Email Address : bervedas@gmail.com
Birthday : September 8, 1981
IP Address: 64.69.36.205

TulpSueld
Email Address : asfgsdfh@gmail.com
Birthday : October 8, 1964
IP Address: 200.63.42.105

cogpadicill
Email Address : deragaz@gmail.com
Birthday : July 6, 1975
IP Address: 92.114.187.20

maeijuh
Email Address : maeijuh@gmail.com
Birthday : October 6, 1962
IP Address: 98.161.6.246

Lapysapsefs
Email Address : zexorbire@gawab.com
Birthday : October 14, 1961
IP Address: 85.255.120.58

ademansderty
Email Address : ade@worldmp3songs.com
Birthday : August 11, 1966
IP Address: 193.164.132.17

polinapus
Email Address : polinapus@gmail.com
Birthday : August 13, 1985
IP Address: 92.48.112.74

lominerad
Email Address : lominerad@gmail.com
Birthday : October 12, 1962
IP Address: 63.199.245.151

bigroda
Email Address : bigroda@gmail.com
Birthday : April 3, 1961
IP Address: 92.48.112.74

dedugan234
Email Address : kuartova@ukr.net
Birthday : April 25, 1982
IP Address: 92.113.29.168

labudash
Email Address : labudash@gmail.com
Birthday : June 5, 1965
IP Address: 87.236.29.207

GydayTainvawn
Email Address : dokmdall@gmail.com
Birthday : September 6, 1961
IP Address: 89.41.71.85

DoctorMensentDornt
Email Address : doctormens@mail.ru
Birthday : October 11, 1979
IP Address: 87.118.96.94

mwerima
Email Address : mwerima@gmail.com
Birthday : June 1, 1981
IP Address: 209.254.236.210

derimna
Email Address : derimna@gmail.com
Birthday : October 20, 1965
IP Address: 81.203.169.89

enazitarefteric
Email Address : remyimichehow@metaping.com
Birthday : September 6, 1961
IP Address: 78.157.143.211

yaskazala
Email Address : yaskazala@gmail.com
Birthday : May 21, 1987
IP Address: 85.86.146.119

chichapa
Email Address : chichapa@gmail.com
Birthday : June 21, 1977
IP Address: 76.172.118.92

solovekaaqw
Email Address : mail@worldmp3songs.com
Birthday : September 13, 1985
IP Address: 193.164.132.17

FogincBiorn
Email Address : pochta5@honent.ru
Birthday : April 4, 1965
IP Address: 93.80.245.131

Keegan Skky
Email Address : xxxspicegirls@mail.ru
Birthday : June 3, 1960
IP Address: 91.77.6.60

prosoxa
Email Address : prosoxa@gmail.com
Birthday : September 8, 1983
IP Address: 211.178.32.231

liaggrailikek
Email Address : stepbystepik@mail.ru
Birthday : February 18, 1970
IP Address: 92.48.84.208

sukecal
Email Address : sukecal@gmail.com
Birthday : March 18, 1967
IP Address: 74.192.85.240

xxlmegasex
Email Address : drehopxxl@googlemail.com
Birthday : June 15, 1976
IP Address: 68.9.119.52

Rathovezeta
Email Address : nedgeunelebog@mainru.com
Birthday : February 23, 1971
IP Address: 70.189.2.152

dernima
Email Address : dernima@gmail.com
Birthday : January 19, 1970
IP Address: 69.116.22.240

Vidaluxa
Email Address : internationalp@gawab.com
Birthday : June 11, 1974
IP Address: 69.46.28.225

Faruhabib
Email Address : kumar.habib@gawab.com
Birthday : March 28, 1982
IP Address: 74.50.99.140

chinchinat
Email Address : chinchinat@gmail.com
Birthday : August 28, 1967
IP Address: 97.85.145.34

Veneciano
Email Address : milanot@gawab.com
Birthday : August 5, 1966
IP Address: 66.232.114.56

Megustas
Email Address : bumbarash@gawab.com
Birthday : September 2, 1975
IP Address: 206.51.229.102

solovekazs
Email Address : 777@worldmp3songs.com
Birthday : April 28, 1975
IP Address: 193.164.132.1

nicesitess
Email Address : leonardcooper62@yahoo.co.uk
Birthday : April 25, 1981
IP Address: 92.48.127.90

jkkjkjjfhyaasass
Email Address : 23derrick723@gmail.com
Birthday : June 4, 1986
IP Address: 72.241.88.30

cimuren
Email Address : cimuren@gmail.com
Birthday : October 23, 1966
IP Address: 65.29.124.75

fluenibeimb
Email Address : evilkildvug@mail.ru
Birthday : August 27, 1986
IP Address: 93.80.160.174

!abcodygz
Email Address : joddy@ringrate.com
Birthday : August 20, 1962
IP Address: 84.16.252.77

weopima
Email Address : weopima@gmail.com
Birthday : June 21, 1988
IP Address: 61.40.48.15

etibasa
Email Address : etibasa@gmail.com
Birthday : March 25, 1978
IP Address: 189.47.170.203

serniuma
Email Address : serniuma@gmail.com
Birthday : January 6, 1967
IP Address: 24.99.29.117

trevosemtree
Email Address : trevosemtree@greatfreemail.com
Birthday : April 25, 1960
IP Address: 195.245.119.76

Britney Speers
Email Address : xxxspicegirls@mail.ru
Birthday : January 9, 1965
IP Address: 91.77.225.132

dazvenginzks
Email Address : coothewhomoo@gmail.com
Birthday : May 4, 1973
IP Address: 12.192.82.59

Reynold78
Email Address : acilliozzy@mymail-in.net
Birthday : September 4, 1960
IP Address: 72.9.99.34

TimEricsson
Email Address : tim@drugshome.org
Birthday : August 11, 1976
IP Address: 190.10.18.118

[Racing Sim]

Just added two new fields (Additional Required Information - profile) a drop down box option and a radio button selection and it looks like the bot / human have got confused! No more sign ups to day. I will keep you guys posted.

[shohin]

Can’t we have a random sign up URL after the Image Verification and drop down boxes to answer a maths question? Then a 2nd Image Verification option after the random sign up URL? If the maths question is wrong force a new start up!



JMHO but I still don't see the sense in all of this wasted time in posting spammers. Just install "NoSpam (http://www.vbulletin.org/forum/showthread.php?t=124828)" as a plug-in and you're set to go as far as subjecting a registrant to a question(s). I went from an average of 6 to 14 or so a day and it stopped dead in it's tracks after I installed it and only entered in one very simple question although I believe you can enter more.

~Phil

[CareyCrew]

IP address 60.166.53.244

email xiaotiansmile@163.com

username xiaotiansmile

net range 60.166.0.0 - 60.175.255.255

[amaderforum]

why don't set - unverified member can't post. problem solved. let them register after? they have to verify. if they use fake email id - they waste time.

[CareyCrew]

why don't set - unverified member can't post. problem solved. let them register after? they have to verify. if they use fake email id - they waste time.

Spammers /borgs do register and verify......... then they post spam.

Bots are easy to stop ,manual spammers are not.

[Racing Sim]

Good news... no new accounts! The new fields (Additional Required Information - profile) works for me without the need for any plug-ins ;-)

[shohin]

Good news... no new accounts! The new fields (Additional Required Information - profile) works for me without the need for any plug-ins ;-)

No new spammers or, no new accounts! One is not the other! lol
For me the "question" upon registering has seemed to stop the spammers cold albeit there might be the occasional human assisted spammer that might possibly wiggle in but even then they don't seem to want to take the time or effort to answer the question. Hey....whatever works to keep the creeps out of ones site!

~Phil ;)

[CareyCrew]

U/name/ iphone27


Emails / awoomo44@yahoo.com : awomobilesss1@hotmail.com

DOB / September 5, 1970 (37)


IP address 72.3.137.82

http://www.google.com/search?client=opera&rls=en&q=iphone27&sourceid=opera&ie=utf-8&oe=utf-8

[g0dfather]

I will have more, just is taking me a while to compose the list...

efgh433/ gangannilao@21cn.com/ 60.166.122.121
callbbryant/benwalec@gmail.com/121.204.36.130
stuv564/wiuhetgdd@21cn.com/60.166.107.13
bro4golds/dellusa@21cn.com/60.166.109.250
BaBeBiLaaaa/a182402666@gmail.com/123.131.108.173

[shohin]

Yet another nice little add in which tells you about everyone who is visiting your site and or, trying or had tried to log in for the past 24 hours to your site:"Track Guest Visits (http://www.vbulletin.org/forum/showthread.php?t=167278)". Very interesting to say the least! I've kept track of two that insist on trying to register about four to five times a day for the past month but yet fail to do so!

As for adding any spammers to the list here I'm afraid but, very happy, that I cannot contribute as I don't get them any more with the "No Spam" plug in! Not saying that it will never happen again but it seems as though even the human assisted spam bots do not wish to take the time or effort to answer any question I have placed in for the registration procedure. With that I still fail to see the need for this time consuming list. I can handle the occasional one that may slip through the cracks every few months as opposed to the 8 to 14 a day I was getting but other than that.....what's the purpose of it all when it can so easily be cut down by 99%! as I have done?

~Phil :)

[gailoan]

Hi, i have Ban these IP but seem not work, especaily 74.6.18.218 74.6* 74.6.18 74.6.18* they join about more than 10 at a time just by Guest but some how they can contact to all the members and PM to them.

41.209.165.39
141.84.28.20 a020.lmu.vpn.lrz-muenchen.de 72.187.141.211 74.6.18.218 125.234.112.239 .adsl.viettel.vn 222.252.219.114 141.84.23.130 74.6* 74.6.18 74.6.18*

[CareyCrew]

74.6.18.218 74.6* 74.6.18 74.6.18* :rolleyes::rolleyes: Do a IP Lookup you are trying to ban Yahoo crawlers, they are NOT spammers.

[CareyCrew]

Now this jerk is a real clever boy. It is a UK solicitor that spends his sunday afternoon adding SPAM entries to threads and then writing blogs full of all his wonderful services, does not have the common courtesy or decency to ASK first, well chummy, you want to post adverts with images on a forum then you PAY for it OK?

Do you offer anyone free services ........................... er ,thought not.

and yes I kepy copies and screenshots of your handywork before I blew you off the forum:mad:

----------------------------------------

mylegafriend

info@mylegalfriend.com

91.104.108.249

www.mylegalfriend.com


---------------------------------------------

[DelphiVillage]

hi,

here (http://www.vbulletin.org/forum/showthread.php?t=176481)is a mod that integrates vBulletin into the stopforumspam service.If anyone in the spamdatabase trying to register it will be denied it needs cURL for the remote functions (you can check that through)



<?php
phpinfo();
?>


if the output shows a cURL section you have it ...

[CareyCrew]

Username : edward2002


Email : baifeng79110@gmail.com


IP Address : 216.108.229.68

Time Zone : (GMT+8) Beijing,Perth

[Parabellum]

I also tried banning most of these names but they just keep signing up again using random names. They use real people to register then they log back on a few days later to spam.

I ended up banning all of China and India since I have yet to get a honest member from those countries. Ever since I banned those 2 countries my spam has been down to 1 spammer a month. Before I was getting 3-5 new spammers a day.

[mlb]

StopForumSpam.com (http://www.stopforumspam.com/country/cn)

This site appears to be pretty effective at helping me manually determine if a user who is attempting to register is a SPAMMER (or is LIKELY a spammer). It will show you what other forums he has registered on and when ... found a bunch where they have registered for six forums within a one hour period, or where something else is suspicious (like country of origen). You can then google the user name, and see if they are banned elsewhere, etc.

THE ODD THING I NOTICE is that I had almost no spam until I recently (days ago) upgraded from 3.6.8 PL2 to 3.7.3 (now 3.7.3 PL1) ... AND when I downloaded 3.7.3, I added a link to my forum in the vbulletin.com "online links system". [When you go into the Members area ... then hit "edit license" ... you then see a radio button that says "Display in online links system?". I changed that from "no" to "yes" ... and the spammers have not let up since then. They must be mining that list for forums to spam.]

[Deathspawner]

I'm not sure how much this list will help, but these are the spammers I've had in the past two weeks:

sh2008seo
tytiiiore
herryjohn
ghij509
greg21
Netlog
wajiguqu0223
tuvw604
klmn201
noyourid
damn001
alexheim03
samuel01
stock11
shawndeal
just4mail
putosell
technosystems33

Like the last poster, I haven't had so much spam until recently. The past two weeks and especially the past week alone, I've been dealing with spam everyday. I used to have to deal with a spammer usually once a week. I think the problem now is a lot of them are not even bots, because they are awful selective about the sub-forums they post in.

[Mrs Take 2]

I got this one this morning.

admin86skf
ccbearing@yahoo.cn
ip address 117.11.109.247

[ryukenden]

How do we stop these spam bots?

Vbulletin , any suggestions?

[Steve Machol]

How to Reduce Spam and Registration Bots (http://www.vbulletin.com/forum/showthread.php?t=275800)

[pauloo]

yzzxjm06 / dinmo01@gmail.com / 123.244.226.154

sztin10 szpilitest001@gmail.com 59.40.43.26

opqr333 sdfhgggf@live.cn 122.5.206.231

uvwx869 hongxiebbs@gmail.com 220.179.217.215

[CareyCrew]

username : aso101

email : asoelectro@hotmail.com

IP : 72.3.137.82

[shohin]

How to Reduce Spam and Registration Bots (http://www.vbulletin.com/forum/showthread.php?t=275800)

Yep....that's it! Or, the "No Spam" plug in. Haven't had one spammer since 06/27/'08 as opposed to the 8 to 12 a day as I used to get! I just don't get the purpose of this whole list thing?

~Phil ;)

[redufo]

It always come from China IP addresses so what I did was google for all of China main IP addresses. Then collected about 700 IPs, used find/replace to make a custom SQL insert comand and inserted all 700 IPs into the banlist.

Haven't had WOW spam since.

I did that with my main CMS not Vbulletin but I'll just copy over the list to VB

[CareyCrew]

Email Address : favorsneaker1@hotmail.com
Birthday : August 8, 1988

IP Address: 218.85.11.132


Username : helen592

[stevectaylor]

It might be a useful tool if VB could collate them all and publish them for us to use in the banning function.

[ascender]

Can someone confirm the IP address ranges I need to enter in the User Banning Options section so I can bar China and India please?

[Hitterman]

Username: halogen19
email: halogen19@gmail.com
IP address:122.162.136.141
His IP ranges from 122.162

What he do:
A hacker. I'll recommand everyone to block his IP address.

[car20]

qrst392
ebbsblog@21cn.com

[Patrick Simmons]

tamir1

Just registered on my site and did a search and is registered on over 9,000 other forums.

[Lee Wallace]

These two sat for awhile and then hit the board with paragraphs full of non-sense which included hotlinks. Cdef continues to lurk even with his banned status.

cdef303
tianxin520520@gmail.com

fionala
fionala@sohu.com

I allow nothing from sohu.com...

Just had another sohu.com try to get approved with a username of Vagena. LMAO!

[Desibabu19]

My ban list:
gawab.com
rupr.org
mail.ru
21cn.com
sohu.com
qq.com

If I run a query for one of the email id using Admincp >> Users >> Search for Users, I get a list of users with zero posts. I assume these are sleepers. How do I get rid of them ?

The result page force me to delete the users one by one. We dont have a choice like Mass move/prune users page.
I have about 200 userids ( possible spammers) how do I remove them ? Is there a short cut ? Or a query that I can run to move them to banned list ? thanks,

[Hitterman]

I have noticed that most of the Spammers are from China. (Correct me if i am wrong)

[DelphiVillage]

I have noticed that most of the Spammers are from China. (Correct me if i am wrong)

do not forget

India
Russian Federation
Ukraine
....
any country where spamming is not illegal

[car20]

user: Huoliuhi
Email Address : huoliuh@gmail.com
Birthday : January 1, 1980
IP Address: 211.158.21.152
+++++++++++++++++++++++++++++++
user: Lihualee
Email Address : lihuale@gmail.com (huoliuh@gmail.com)
IP Address: 222.183.118.201
++++++++++++++++++++++++++++++++
user: qrst392
Email Address :ebbsblog@21cn.com
IP Address: 219.130.102.241
++++++++++++++++++++++++++++++++
Teetdiro
gtuutu@gmail.com
222.183.120.202
+++++++++++++++++++++++++++++++++

[ElizeF]

Username: vip0pop
email: igxe@vip.sohu.com
IP: 60.166.109.159
I use a question and answer verification system on my forum and this was the first spammer since July 2008.
He has posted 3 times and his post starts like this:
Because of the extensive gorilla research begun by Dr. Fossey and since carried on by the Dian Fossey Gorilla Fund International, the mountain gorilla is perhaps the best understood of all gorillas.
I did a search on Google and this person has registered on a lot of forums.

[Ernie Romers]

Thanks for the helpful list, I've added yahoo.cn to my banning options list.

[grimm75]

jukavukass@gmail.com

JukaVukass (http://www.google.com/url?sa=t&source=web&ct=res&cd=22&url=http%3A%2F%2Fwww.csource.ru%2Fforum%2Findex.ph p%3Fshowuser%3D3545&ei=RZjfSMbsIIqEhAKW-43yAw&usg=AFQjCNG0AQVNHafMifipg-uQbN5Fc3L0dQ&sig2=FCs_HczdWsHlBVfzTk1nxQ)


This person tried joining my site last, as well as MANY others. I Google search the name and just over the last day or 2, has joined as many forums as they could, it seems.

Also is posting this message:
"
Where seek-url on your site!
So... interesting site...

This same message is posted on various sites.
Where search-page on your site.
Can you advise me?

P.S. Anybody know about XRumer 5.0 software? Need a link to it..."

[acwatts]

wajiguqu0568 shenqing@chongsoft.com 221.200.213.150

[GSXR]

VWJOHN
FAFEGAILI
TIXMEESTEPLED
SHEEROPEMEFEN
REOTLEANORM
MEDIABONZA
MARINA WONDERS
MEGARIESTA
HAUMSLALGEM1

All registered within a couple of minutes of each other.

[laruezie]

Beingcentered
CEO2008GAME
CHOOMAHA
COILEEVELLA
forlan001
immicypef
kanny
MarinaWonders
mickey0604
nopq323
opqr569
VWJohn
whereantee

Also, where would I get this:vBulletin Anti-Spam Key Powered by Akismet

[Reg Carter]

QuoppyZoozy

email -

lonyeffof@gmail.com

What actually happens with this list? Is it going to be put online somewhere? Is it going to be integrated into some kind of anti spam feature?

Reg

[jayjenxi]

Wajorsecroste
FromFiecoke
ToxArrony2
Inceno
JesicaSmith
muivihbapm
Esseresquiz
Mediabonza
pamnwarywer
reetcoors
mombscolf
dymndiece
sexgirlinLA
EssedeSweds1
drodsFemapams
avessyalemi

[jmwking]

I use a question challenge on my board for registrations and I moderate all new members. I preemptively banned most of these over the last couple months - I move them all into a special usergroup for tracking. Most are asian, a couple african, a couple european. (I hope the formatting sticks reasonably well. It was a table when I previewed!)



seaman0916 afsdffafafe@rocketmail.com 194.0.252.166
rFdgffy shoes131@yahoo.cn 119.146.206.17
tranquill tranquillera@gmail.com 89.179.45.67
michaelhillery serialkisser0755@gmail.com 122.168.19.141
stuartdenley stuartdenley1@gmail.com 203.163.253.98
ShankAlenka styleme1@gmail.com 124.43.35.208
ok0510 ok0510@126.com 218.4.158.66
telcom tltd01@hotmail.com 196.3.181.105
deebak deebakse05@gmail.com 121.246.107.124
oxtonstore oxtonstore@yahoo.com 80.78.20.50
Esteban12 ansleytobias@yahoo.com 117.196.134.45
incre68 incre68@gmail.com 58.187.164.165
jen0608 babynames01@gmail.com 125.60.241.253
teddy1 sharpadvertltd@cooltoad.com 204.14.44.138
LoraMarc88 lora_marc88@yahoo.com 122.167.49.126
Kenwoodltd jordan_elect26@yahoo.com 196.29.217.218
Schrupp26 Charity_Bothwell@yahoo.com 122.167.55.37
FGFDSTHT shoes200@yahoo.cn 119.146.205.181
luccy naninagini@gmail.com 121.246.89.98
mathewhadley mathewhadley@gmail.com 122.165.25.179
goodfriend america@torontomail.com 117.92.88.12
anghew025 anghew025@gmail.com 221.215.223.169
netranika netranikasimpson@gmail.com 59.93.200.70

-jk

[KarenneLyn]

I am getting these same people spamming. Is there a way to Ban the IP addresses? That might help a little:(

[bluidkiti]

I have been getting hit hard by these people today at all 3 of my sites. Everything has been quiet and all of a sudden - bam! - the bottom has fallen out. What's going on? And how do I stop them?

[pranaysanghavi]

tamir1

Just registered on my site and did a search and is registered on over 9,000 other forums.

How did you arrive at that count?

anyway, here're my chief guests:
Email Address : hrffsdds@fensite.net
Birthday :
Referrer: N/A
IP Address: 93.174.93.196

Email Address : biasufdrmiff@mail.ru
Birthday :
Referrer: N/A
IP Address: 89.149.227.193

Email Address : canada@viagrabe.com
Birthday :
Referrer: N/A
IP Address: 78.157.142.5

someone from vb may keep a centralized database and then offer a patch to simply switch on the connection to ban these users from ever growing database.. or a cron that routinely matches the established guests of honor and treats them well. :rolleyes:

[pranaysanghavi]

my esteeemed guests even took time to set up a profile, with icq, etc.. e.g.. :cool:
About Gehefriskinee
Biography
Man
Location
Tanzania
Interests
Gehefriskinee
Occupation
Tanzania

[Floris]

Admin Control Panel > vBulletin Options > vBulletin Options > User Banning Options > Here you can add their IP

[Jingus]

This is just from today. They have been registering all day getting past the captcha code and posting in my guest forums.
I deleted alot more yesterday and the day before but I didn't save any of their info.

noleemews
accurfsar@gmail.com
93.92.200.20

SuinnaUnony
sdfhfjfhjsddysfue@gmail.com
61.221.54.234

Napoxyday
cletsintemn@gmail.com
89.0.10.237

garden-furniture
adamzcahvs@tmail.com
85.141.233.177

Ricyscurdydix
gregorzfrances@e-mail.net
68.49.43.180

Feariagen
demnereva@gmail.com
92.243.166.98

Reiletarleree
rubboluffep@gmail.com
85.114.24.206

PresidentX
ghhheigeieei@gmail.com
89.208.9.67

[Jingus]

my esteeemed guests even took time to set up a profile, with icq, etc.. e.g.. :cool:
About Gehefriskinee
Biography
Man
Location
Tanzania
Interests
Gehefriskinee
Occupation
Tanzania
I deleted all but one of my new guests so I can play with him.
I altered his e-mail, changed his password then approved his account.
It should be amusing to see how many times he reregisters after his password doesn't work and he can't resend a new one.

I also had MARINA WONDERS register the other day and make a post.
It was a link to a site which she claimed had a photograph of the administrator (me).
Very weird spam.

[Ohiosweetheart]

OMG I have been hit hard at all of my sites today by spammers, with some of the most explicit, nasty porn I've ever seen! WTH?? There has GOT to be a way to stop this. IP banning isn't working.

Here's my list so far -
affonlelymn
alla
Beniuccemsbem1
crandouro
EmumHoomi
globalid
hypnoticpimp
indoroids
JukaVukass
Nadeau25
newera2k5
SeedDyexsed
thilmtymn
VWJohn
#*goarara
AnnuagDeala
Antiquini
ClieliVag
coelterekfrm
GreeskHarie
indinairl
Johnwolfer
RaymondIU
SladdicleTied
Stellaquiexia

That's just a partial list. It's been crazy. :eek:

[Ohiosweetheart]

I deleted all but one of my new guests so I can play with him.
I altered his e-mail, changed his password then approved his account.
It should be amusing to see how many times he reregisters after his password doesn't work and he can't resend a new one.

LOL that's funny!

[drobie]

wrirtyAlils
HailMaryPC
wrirtyAlils
Exetaviatty
SteackLeaks
vaniaandkirak
Gymnshashinna
Linasticksx
jkkjkjjfhyaasass
scossyMaf
#*ragogoar
nonnacark
diecidwinuids
coureexcurf
Elasialmawl
CigAdughPuh
fooftennY
exceneFlottfrm
Liaicyfrall
Sofia_Magic
VoxComeVosy
Scoowsspeance
DrurnPync
settercoush
AntereeSent
fagPreele
AssesyElems2
UnmagmaGave
Feesmultult
deldoxibe
flenlyUnfok
Towsspeeque
Magariesta
elutleescah
VWJohn

[OS,]

Spam is on the rise now... just yesterday and today we have been getting an influx of over 30 spam registrations from russia.... and the email they register with always resolves to gmail or some other free email service.

We have email verification and they seem to also verify their email accounts some how and spam...

[RHarbison]

There's got to be a way to automate what you're doing here or something. I've had so many of these spammers register today it's incredible.

I've got the anti-spam running, but they still register and then create links to various websites in their profile.

VB has got to find a way to combat these idiots or they're going to ruin the usefulness of forums.

[pank]

Same BS here. Here is a list of new banning options I added as of today (I actually totally disabled gmail and hotmail for now since 98% of the spammers used those emails as well as .ru emails)

Emails:
@gmail.com @hjklghjkl.co.cc rambler.ru @xmail.net mymail-in.net @e-mail.org @web-sex.tv @mail.ru @intim-shluhi.ru @viagrabe.com @sina.com

IP's:
93.81.*
92.243.*
82.7.*
78.157.*
67.212.*
87.118.*
94.50.*
93.81.*
200.63.*

I know this is somewhat drastic but at this point I had no choice. I probable deleted around 300 accounts today.

Tip: Do a search for new accounts registered today/yesterday.
If they use a gmail I just deleted them. But click on their profile and look for suspicious sigs, websites, etc...

Hopefully this helps. And note: I am using all of the current spam settings. The only thing I do not have (but am adding right now) is the extra registration question (http://www.vbulletin.com/forum/showthread.php?t=205214)...

[purplesage]

They have been registering all day getting past the captcha code and posting in my guest forums.Switch to recaptcha
Admin Control panel -- Human Verification Manager
get the keys from http://recaptcha.net/

Its free

[Ohiosweetheart]

Switch to recaptcha
Admin Control panel -- Human Verification Manager
get the keys from http://recaptcha.net/

Its freeUnfortunately, they're getting past reCaptcha as well.

[Reg Carter]

All these names have registered in the last 12 hours (that's how bad this is) -


(http://www.myastrospace.com/forums/member.php?u=677)Advararce4 (http://www.myastrospace.com/forums/member.php?u=704), (http://www.myastrospace.com/forums/member.php?u=677)Anitastarzzz (http://www.myastrospace.com/forums/member.php?u=650), , (http://www.myastrospace.com/forums/member.php?u=677)baincipandyfrm (http://www.myastrospace.com/forums/member.php?u=660), (http://www.myastrospace.com/forums/member.php?u=677)BioriPrurb (http://www.myastrospace.com/forums/member.php?u=699), (http://www.myastrospace.com/forums/member.php?u=677)Cipnittee (http://www.myastrospace.com/forums/member.php?u=658), (http://www.myastrospace.com/forums/member.php?u=677)Cireassauts (http://www.myastrospace.com/forums/member.php?u=656), (http://www.myastrospace.com/forums/member.php?u=677)Coriebydrerve (http://www.myastrospace.com/forums/member.php?u=666), (http://www.myastrospace.com/forums/member.php?u=677)Dastanimest (http://www.myastrospace.com/forums/member.php?u=709), (http://www.myastrospace.com/forums/member.php?u=677)dermreuth (http://www.myastrospace.com/forums/member.php?u=695), (http://www.myastrospace.com/forums/member.php?u=677)Dobwhomma (http://www.myastrospace.com/forums/member.php?u=690), (http://www.myastrospace.com/forums/member.php?u=677)Doxyslala (http://www.myastrospace.com/forums/member.php?u=654), (http://www.myastrospace.com/forums/member.php?u=677)Drydaynonwsbi (http://www.myastrospace.com/forums/member.php?u=682), (http://www.myastrospace.com/forums/member.php?u=677)effeldwrild (http://www.myastrospace.com/forums/member.php?u=669), (http://www.myastrospace.com/forums/member.php?u=677)elarseGal (http://www.myastrospace.com/forums/member.php?u=681), (http://www.myastrospace.com/forums/member.php?u=677)eMulleryn (http://www.myastrospace.com/forums/member.php?u=708), (http://www.myastrospace.com/forums/member.php?u=677)Etesfreniaten (http://www.myastrospace.com/forums/member.php?u=700), (http://www.myastrospace.com/forums/member.php?u=677)Foeboance (http://www.myastrospace.com/forums/member.php?u=678), (http://www.myastrospace.com/forums/member.php?u=677)gainiagroNe (http://www.myastrospace.com/forums/member.php?u=674), (http://www.myastrospace.com/forums/member.php?u=677)Gemianusnilia (http://www.myastrospace.com/forums/member.php?u=698), (http://www.myastrospace.com/forums/member.php?u=677)Grivostette (http://www.myastrospace.com/forums/member.php?u=662), (http://www.myastrospace.com/forums/member.php?u=677)HailMaryPC (http://www.myastrospace.com/forums/member.php?u=683), (http://www.myastrospace.com/forums/member.php?u=677)huckabuck (http://www.myastrospace.com/forums/member.php?u=576), (http://www.myastrospace.com/forums/member.php?u=677)ivanaburonec (http://www.myastrospace.com/forums/member.php?u=691), (http://www.myastrospace.com/forums/member.php?u=677)Jackson42South (http://www.myastrospace.com/forums/member.php?u=85), (http://www.myastrospace.com/forums/member.php?u=677)JaxwrallArrop3 (http://www.myastrospace.com/forums/member.php?u=703), (http://www.myastrospace.com/forums/member.php?u=677)jeraemikege (http://www.myastrospace.com/forums/member.php?u=671), (http://www.myastrospace.com/forums/member.php?u=677)JesicaSmith (http://www.myastrospace.com/forums/member.php?u=640), (http://www.myastrospace.com/forums/member.php?u=677)JumaXXX (http://www.myastrospace.com/forums/member.php?u=652), (http://www.myastrospace.com/forums/member.php?u=677)Knidozook (http://www.myastrospace.com/forums/member.php?u=692), (http://www.myastrospace.com/forums/member.php?u=677)LILLYJANES (http://www.myastrospace.com/forums/member.php?u=694), (http://www.myastrospace.com/forums/member.php?u=677)Linasticksx (http://www.myastrospace.com/forums/member.php?u=679), (http://www.myastrospace.com/forums/member.php?u=677)litteflaphatA (http://www.myastrospace.com/forums/member.php?u=673), (http://www.myastrospace.com/forums/member.php?u=677)LuissaMarkx (http://www.myastrospace.com/forums/member.php?u=665), (http://www.myastrospace.com/forums/member.php?u=677)Magariesta (http://www.myastrospace.com/forums/member.php?u=659), (http://www.myastrospace.com/forums/member.php?u=677)Mantorkas (http://www.myastrospace.com/forums/member.php?u=688), (http://www.myastrospace.com/forums/member.php?u=677)MarinaSimini (http://www.myastrospace.com/forums/member.php?u=670), (http://www.myastrospace.com/forums/member.php?u=677)Marta (http://www.myastrospace.com/forums/member.php?u=706), (http://www.myastrospace.com/forums/member.php?u=677)neoleanda (http://www.myastrospace.com/forums/member.php?u=707), (http://www.myastrospace.com/forums/member.php?u=677)Nibedrorope2 (http://www.myastrospace.com/forums/member.php?u=655), (http://www.myastrospace.com/forums/member.php?u=677)norvascgeneric (http://www.myastrospace.com/forums/member.php?u=685), (http://www.myastrospace.com/forums/member.php?u=677)oneflyAdodype (http://www.myastrospace.com/forums/member.php?u=697), (http://www.myastrospace.com/forums/member.php?u=677)PexSonned (http://www.myastrospace.com/forums/member.php?u=689), (http://www.myastrospace.com/forums/member.php?u=677)PiottgatSixzu (http://www.myastrospace.com/forums/member.php?u=661), (http://www.myastrospace.com/forums/member.php?u=677)PresidentF (http://www.myastrospace.com/forums/member.php?u=667), (http://www.myastrospace.com/forums/member.php?u=677)PribraFripigo (http://www.myastrospace.com/forums/member.php?u=653), (http://www.myastrospace.com/forums/member.php?u=677)RaymondIU (http://www.myastrospace.com/forums/member.php?u=686), (http://www.myastrospace.com/forums/member.php?u=677)Reargeawl (http://www.myastrospace.com/forums/member.php?u=663), (http://www.myastrospace.com/forums/member.php?u=677)ReumLiesunush (http://www.myastrospace.com/forums/member.php?u=676), (http://www.myastrospace.com/forums/member.php?u=677)Roamygroumure (http://www.myastrospace.com/forums/member.php?u=696), (http://www.myastrospace.com/forums/member.php?u=677)sadovaya-mebel (http://www.myastrospace.com/forums/member.php?u=668), (http://www.myastrospace.com/forums/member.php?u=677)Sizabsjaimb (http://www.myastrospace.com/forums/member.php?u=672), (http://www.myastrospace.com/forums/member.php?u=677)Skylines (http://www.myastrospace.com/forums/member.php?u=701), (http://www.myastrospace.com/forums/member.php?u=677)sleploype (http://www.myastrospace.com/forums/member.php?u=693), (http://www.myastrospace.com/forums/member.php?u=677)Sofia_Magic (http://www.myastrospace.com/forums/member.php?u=651), (http://www.myastrospace.com/forums/member.php?u=677)StacyStain (http://www.myastrospace.com/forums/member.php?u=687), (http://www.myastrospace.com/forums/member.php?u=677)SvetLAnkA (http://www.myastrospace.com/forums/member.php?u=675), (http://www.myastrospace.com/forums/member.php?u=677)syclesmalse (http://www.myastrospace.com/forums/member.php?u=664), (http://www.myastrospace.com/forums/member.php?u=677)taksBooro (http://www.myastrospace.com/forums/member.php?u=657), (http://www.myastrospace.com/forums/member.php?u=677)Tooniummona (http://www.myastrospace.com/forums/member.php?u=702), (http://www.myastrospace.com/forums/member.php?u=677)VeraTrapton (http://www.myastrospace.com/forums/member.php?u=684), (http://www.myastrospace.com/forums/member.php?u=677)VWJohn (http://www.myastrospace.com/forums/member.php?u=680), (http://www.myastrospace.com/forums/member.php?u=677)Whedelype (http://www.myastrospace.com/forums/member.php?u=705), (http://www.myastrospace.com/forums/member.php?u=677)zxXxSexyBabyxXxz (http://www.myastrospace.com/forums/member.php?u=677) (http://www.myastrospace.com/forums/member.php?u=677)

Does Vbulletin have a solution for this? How can we stop these signups?

I brought this exact same problem up on these forums 12 months ago -

http://www.vbulletin.com/forum/showthread.php?t=242753

It's frustrating that 12 months later there is no solution and its getting worse. Please VB Team, find a fix.

Also in my human verification options, I don't have the ask a question option. Any ideas? I'm using 3.7.2.

Reg

[Reg Carter]

I actually deleted 9000 (yes 9000, 12 months worth) of these spam bot names off my site about 1 week ago. I hadn't seen this thread when I did this.

Is there a way to go into the database and get a list of those names? I'm sure they would be quite handy for this thread. It would also help demonstrate how bad this problem is.

Reg

[Bonus Paradise]

until now no new spammer signed up after I did yesterday this what i already posted here

http://www.vbulletin.com/forum/showthread.php?p=1631625#post1631625

I see them still trying to register in the who is online
but til now not one of them was able to


this will not be enough
there are spambots with all kind of addys, also .net and and
this is a very good site to check
http://www.stopforumspam.com/ (http://www.stopforumspam.com/)

spam bots found a way to read now the image verifications
I been attacked too yesterday
then i installed a few mods from vbulleting org
and now i watch the spam bots try to register and they cannot anymore

http://www.vbulletin.org/forum/showthread.php?t=181818&highlight=enhanced+image+verification (http://www.vbulletin.org/forum/showthread.php?t=181818&highlight=enhanced+image+verification)

http://www.vbulletin.org/forum/showthread.php?t=183329 (http://www.vbulletin.org/forum/showthread.php?t=183329)

that one is also very useful and easy
http://www.vbulletin.org/forum/showthread.php?p=1635427#post1635427 (http://www.vbulletin.org/forum/showthread.php?p=1635427#post1635427)

[abroad]

yes, the recent spam are all from the same source...profile entries are all similar:

here are 2 emails out of 15 new registrations which were spam:

batman@viagrabe.com
getfreehostnaw@gmail.com

We need a solution, I get every hour 1 or 2 new Spam registrations from them!!!!

[abroad]

here more from today:

djkdllns07@gmail.com
inharahunda@gmail.com
staillaseaw@gawab.com
hottopspicymail@mail.ru
etqwyumc@mail.ru
tichepigh@gmail.com
rettanatsep@gmail.com

[abroad]

The latest SPAM attacks have all as an occupation "Man" in their profile

[mightyonefl]

my forums are getting hit hard, i don' think i can keep up with the spam registration. is there a solution for this serious problem?

[Floris]

There's not much we can do when there is a user who registers manually, and then gives those details to the bots who only need the user/pass to get in.

I recommend to turn on registration moderation. Or put the default usergroup into new posts = moderated, but 5 posts or more = approved and they dont get moderated (second usergroup with promotion).

And I recommend to require email verification, and not allow to keep banned email. And only allow to let people register once.

And to try and find patterns with the spammers. Are it the same keywords? put those on the ban list, are they all from the same IP range, ban that IP range. Are they all using a certain email address, ban that address.

It's unfortunate that spam == big money making business. People are simply STUPID and click banners, don't understand the difference between spam and a real post. So it makes them millions in income by doing cheap mass spam. So it won't go away, regardless of the tools.

As long as a user is allowed to register, someone can register that has malicious intent.

Unless we require everybody to have a credit check and SSN and scan of photo id and manually charge their CC with $0,1 for verification, and do a phone number listing check, tc .. I doubt anything will change.

We can try our best to implement anti spam matters, vB even has multiple options, and uses it throughout the forum features to balance against user friendlyness, usergroups permissions, etc. And has akismet support.

About akismet, get a key from their site and use it on vb. This helps put spam posts into moderation at least, and who cares about that.. yes, as staff you might get frustrated, but the end user doesn't even notice ; and the latter is what is important. A smooth experience for those who do not wish bad things to the forum.

[Floris]

http://www.vbulletin.org/forum/showthread.php?t=183329

This mentioned mod from vborg

vb 3.7.3 pl1 has the option built in for a q/a

[Charlie_Brown]

http://www.vbulletin.org/forum/showthread.php?t=183329

This mentioned mod from vborg

vb 3.7.3 pl1 has the option built in for a q/a

It has happen to me as well same emails etc.... I put that mod on my forum this morning and added some unique and simple questions. Must fill profile fields helps a bit too but not by itself.

[Floris]

I am just saying, why install a mod from vborg that does Q/A when it is a default feature?

[Ohiosweetheart]

Yeah they're back at my forums again today too.

[Comtech]

I've implemented GeoIP on my server and through htaccess. This method of banning countries works great. The problem is I can't just outright ban the UK, US,CA or a few other countries. Those are where my members actually come from.

[bluidkiti]

They have been to my sites today but can't get in. I also upgraded my No Spam mod yesterday to this one http://www.vbulletin.org/forum/showthread.php?t=183329 . Hadn't had any problems since. Keeping an eye out though.

[abroad]

vabfaubre@gmail.com
bradzcahvs@tmail.com
leariadepaibe@gmail.com
bailleys@mail.ru
lildthele@gawab.com
ertqryqwghy@mail.ru
billi505@mail.ru
fanniemwhistler@gmail.com
gollandica@inmail24.com
knossendbeela@gawab.com
shietseem@gmail.com
sam@canamedic.com
earneprop@gmail.com
mp3giopd@gmail.com
boinousiaj@mail.ru
nick@horny-sluts-blog.com
trupsfreesk@gmail.com
bqrpb5dxc9@list.ru
vaniandn@mail.ru
hrffsdds@fensite.net

[GSXR]

Like everyone else I was bombarded.

Now I only have 1 question and answer in place, it is an extremely cryptic question. Anyone from my country should be able to answer it. There is no way in the world this answer could be googled.

I haven`t had a spammer since that question has been in place, now 48 hours.

[KerryAnn]

I've had several hundred in the last few days. They're signing up faster than I can delete them and ban their IPs/e-mail addresses.

I finally banned gmail accounts this morning until this slows down. I can't keep up!

[oople]

I have a custom question - there's no right answer, but it not only enables me to manually see if they are genuine but also blocks the current spammers with a regular expression which occludes either blank answers or the word 'test' - which is what they have all answered up to now.

I tried recaptcha - which totally stopped spam AND real members joining - even I had a hard time getting thru it.

[Caddyman]

latika2050


MelanieCC


eMulleryn

all spammers...

[AWJunkies]

I to have been bombarded past 3 days by over 15 of them and just saw another 5 try just now. I have never in 8 years had an issue with spammers ever until the past three days not cool.

[Charlie_Brown]

Below is my list but haven't been hit after doing a few tweaks the toe forum.


basettasex589@mail.ru - basettasex
usa@viagrabe.com - Cealemado
drugstore9@rambler.ru - CymnCalry
canada@viagrabe.com - elottTesk
somefurs@gmail.com - Enarcreentect
gatebig999@gmail.com - gatebig999
existeprere@gmail.com - Guigourenoumn
oradiatte@gmail.com - HailMaryPC
accurfsar@gmail.com - ItenohetKnish
mukalanaher@mymail-in.net - JumaXXX
elapselay@gmail.com - lutNomHeitteewsbi
liammaloult@gmail.com - QuoraIrrito
denywall@lkhi.net - unaniarmamoke

[RHarbison]

#Bellad[OLO] cralmilla@gawab.com 85.12.24.30
#ligord[Gerl] shiettyentemn@gawab.com 85.12.24.30
*ZolioliBaps* alexzfrances@tmail.com 92.113.16.142
AActiofoff re.dbrielatide@gmail.com 222.134.69.179
accellino xxxvideofree@gmail.com 92.241.168.218
Accifsbit imponsnumts@gmail.com 85.17.201.131
ACCINAGET scohyncsows@gmail.com 92.114.149.18
Achiedped batman@viagrabe.com 78.157.142.5
advarmami bupillursefes@gmail.com 67.212.189.146
AlaultySoypory va.bfau.bre@gmail.com 85.12.25.43
Alicesdww joghtyeyeyeei@gmail.com 85.254.186.161
american-royal americanroyal009@gmail.com 195.60.174.21
AnnaThereseVonRoth annatheresevonroth@gmail.com 83.233.180.36
ATetrobsnorb vabfa.u.bre@gmail.com 85.12.25.43
basettasex annaztivanov@xmail.com 209.67.216.138
becyunlillire xbesttlaser@gawab.com 217.10.38.251
Bermruibiob dieryceritt@gmail.com 91.124.210.50
bitySala nihalkislarmalaila.r@gmail.com 78.157.143.166
Buberularor keecediogenot@gmail.com 78.26.179.253
Ceriemewelp insalianise@gmail.com 202.75.35.210
CherieAnn pharmasupplier@tips4seo.info 80.243.153.69
Dakarrica yourorderpharmacy@search-for-web.info 208.88.53.190
daverovan dave.rovan@gmail.com 65.75.243.110
doulmomiemi nustfoz@gmail.com 200.63.42.95
Drobtouts odonibrorce@gmail.com 67.212.189.146
Duegualatot veleszyandext@tmail.com 91.76.127.26
Edmanmn edmanbef@gmail.com 12.176.148.179
EdwardGY edwardgysme@gmail.com 68.49.217.148
EdwardMM drete@fensite.net 93.174.93.196
Elelobeaply vurabbarnic@gmail.com 200.63.42.147
embobiomofT kicelaskile@gmail.com 12.205.167.41
Enamircasia damsambum@gawab.com 65.88.237.51
Envenitty serjlocking@gmail.com 92.113.99.83
errosetup velesztexaxd@xmail.org 89.248.162.166
EvodiaS easenodevodia@gmail.com 91.124.243.93
fiooyti fiooyty@gmail.com 212.139.81.0
FreeMusicDownloads fanniemwhistler@gmail.com 193.46.236.234
GabGailia raightags@gmail.com 67.228.137.247
Genzo[Boy] patrickzcahvs@xmail.com 85.12.24.30
gevaDetekes errortert@gmail.com 67.215.231.26
gewedisaswaby flipper@36up.com 212.235.92.162
Godness godness@gawab.com 58.17.130.88
gollandicaa gollandica@inmail24.com 78.157.143.206
Gololoyaday illemsges@gmail.com 195.234.112.74
gorsunsuncany alexzswift@xmail.com 91.76.124.18
GreapsePede labceseeneete@gmail.com 90.2.88.94
Green Hawk xrum124@gmail.com 193.254.234.193
imibriben spiderman@viagrabe.com 78.157.143.215
Immumekag misdnessmisdeas@gmail.com 84.16.227.121
imnomalibyrabbit homenaina@search-for-web.info 208.88.53.190
infebabiblesk naceicole@gmail.com 78.106.228.243
inhincfoldife busdrop@gmx.us 200.63.42.147
Jewpowem dizzyzpitt@e-mail.com 85.21.245.11
jkkjkjjfhyaasass 23derrick723@gmail.com 72.241.92.128
Jzntscool jiznitscoo.l@gmail.com 78.106.60.105
ketslankfen sam@canamedic.com 87.85.157.103
Kneetamapfrm best@aibolit-discounts-meds.com 78.157.143.211 c
lactationclielt robertzjnr@gmail.com 87.118.106.56
lalkertieri patrickzpitt@xmail.net 89.149.236.60
LimiBriedia bnm444+20081002@gmail.com 89.18.189.52
lowiseglv lowiseglv@gmail.com 76.94.184.88
loxdraixaduro dorkknopy@gmail.com 67.212.189.146
LucyBigDummy obsecrets@gmail.com 195.60.174.21
lyndaTL lyndamontgomerytl@gmail.com 75.176.19.141
manbulois arguetaandy@gmail.com 94.25.22.21
Maria mariaurman@gmail.com 93.81.3.207
MariaThereseLjungtrom mariathereseljungtrom@gmail.com 83.233.180.36
MariaWannda mariawanda@jorishamail.com 91.124.163.231
MegranFuyis megranfuyis@mymail-in.net 85.12.24.156
merway-key merway-key@mymail-in.net 90.150.122.98
Musuolinsa pitzgooglet@hotmail.net 121.156.65.229
neownembeks MakattakStism@anionworld.info 88.81.249.215
NinaPauli nnpauli170@googlemail.com 92.48.118.220
NiplielOcet annazshulze@gmail.com 67.166.152.127
nurlrutle kajskanak@gmail.com 62.231.208.12
oldarata oldarata@web.de 92.112.133.226
ontoftMib vabfaubre@gmail.com 85.12.25.43
operlytoile waplive@inbox.ru 90.150.143.179
Oqiteflyerepe erymbobevom@gmail.com 92.112.151.107
Orderdrugs todaydrugs3@gmail.com 67.226.130.134
ordidgeJesJed shahemumpip@gmail.com 91.124.16.225
Orgapyjaboorp anny@canamedic.com 91.84.236.37
PathhocaPuppy nukolaxox@gmail.com 200.63.42.95
Peamsralmutsz leariadepaibe@gmail.com 195.149.90.85
Preopswisee trurrenianktm@gmail.com 91.122.98.147
prisorristodo petrpukov@rambler.ru 67.226.130.134
putanas buka@minivds.ru 78.157.143.140
Romakant defasolia@gmail.com 93.81.13.55
RonnyGeeks ronnygeeks1986@gmail.com 87.118.106.165
rvpiloted mwalsh323@gmail.com 71.99.114.43
Samaritozattatr elmobar200809@gmail.com 79.164.161.30
Samincarlream aroliblyfourb@gmail.com 94.102.49.81
SexyMissy sexymissy1988@gmail.com 85.15.188.236
snivioubs27 nick@horny-sluts-blog.com 85.12.24.24
soalparcase top@searches-top.info 91.76.86.24
SoitteWhego fattiodillae@gawab.com 90.28.242.213
Solicrox johnztop@gmail.net 85.21.245.11
Spomannonsume aniddense@gmail.com 93.174.93.50
Stexuatnela robertzgooglet@hotmail.com 88.147.212.96
Stooggila undodedem@gmail.com 70.142.52.59
susan-lucci-abc susanlucci909@gmail.com 195.60.174.21
susan-lucci-ran susanlucci99@gmail.com 195.60.174.21
SVetLAnkA bqrpb5dxc9@list.ru 94.75.193.168
Sypeviemi fafmayolodoei@gmail.com 91.124.60.120
Tarlmoomi honyfory@gmail.com 200.63.42.93
Tastaluct teepepoxy@gmail.com 91.149.224.252
tenKayaxySymn palkdeesk@gmail.com 200.63.42.93
the-officer theoffice099@gmail.com 195.60.174.21
thomasellton thomasellton@gmail.com 93.81.124.38
tixteelry bnm444+20081003@gmail.com 89.18.189.52
tmvrnru robertzjunior@xmail.net 85.113.133.126
Tobunfofs dart@36up.com 212.235.92.154
trixepibe freedom@36up.com 212.235.92.182
UnsannaAbnobe iminejeufemu18884@gmail.com 79.143.176.23
utteboatostam deptonede@gmail.com 76.107.204.95
valattich angelzswift@e-mail.com 85.12.24.171
vaniaandkiSheal gregorztts@gmail.com 217.78.182.15
Vewclaili mileszdark@tmail.net 87.118.116.86
ViagraBuying vigrassa@topmedicinesite.info 200.63.42.85
Viendaareprep xru777+20081004@gmail.com 89.18.189.52
Vurbaeronee keyloakemen@gmail.com 93.80.56.242
wragkneepeany seauller127@gmail.com 76.172.240.209
YFHarold slaboda@fensite.net 93.174.93.196
ZicePypeLoopy imponsnum@gmail.com 85.17.201.131
Zilsisonnailm yourmailnn@gmail.com 89.18.189.52
zotanetuate waycleacefele@gmail.com 87.248.181.211

[Nick]

I am just saying, why install a mod from vborg that does Q/A when it is a default feature?
Because you can only use one of the built-in human verification systems at a time.

So by installing the mod form vb.org, you can then use the built-in reCaptcha.

Without installing it from vB.org, you can either do just reCaptcha or just the Q&A.
Who knows why the devs made it a single-option rather than being able to use multiple. I am on my way to the Suggestion forum right now ;)

[Floris]

Ah, good reason. Yeah, I've already suggested in private that it might be nice to allow both.

[dklassen]

I'm running the latest release of VB and a couple of my sites have been getting hit pretty hard especially with porn.

1. Use question and answer verification.
2. List of known spam email domains in the Admin CP ban options
2. Check4Spam mod.

My spam has all but stopped.

Check4Spam is one of the best mods I have for vb. Even if they get through registration their post goes to a board only I can see and never makes it into the general population. You need to have x posts before you can post a link and under x posts it checks for a list of key words not allowed in posts.

When they try to post they see a Spam message you can write and they know right there they've gotten no where fast and are just waisting their time.

Bots or even real human spammers get nowhere on my boards now.

I've had one or two real members get caught but it's a small price to pay and you can just move their post back into a real board.

[Mrs Take 2]

The most recent spam to hit my board had now been from (GMT-12:00) Eniwetok, Kwajalein time zone instead of the Bejing time zone. These guys are actually posting on my board.

Foecopopolley
Heloyersss
CinkAccesee
ImiliaKaw
karakusars
cinatryVant
GausiaWhanuts
imnomalibyrabbit
ViagraBuying
MegranFuyis
basettasex
helloyers
Utintyanywown
impompiganuap
BibFesabselia


These are some recent ones from Bejing:

gaincoin
sadsadgd
baoerji9527

Newfoundland:

CepeSwoge

[RHarbison]

#mirunga123 cicmicevene@gmail.com 88.87.81.5
AllPhoneCardsei taitypequepay@gmail.com 89.232.124.100
AssicyWamydayyhms robmid@ua.fm 195.149.90.85
Attatahoormip tutacutty@gmail.com 168.187.87.54
Biliclasuam erunsenut@gmail.com 91.124.104.199
bitySala nihalkislarmalaila.r@gmail.com 78.157.143.166
bolikorsak bolikorsak98@gmail.com 193.192.36.193
BrollaJam spahwennave@gmail.com 77.87.158.13
casino casino1999@gmail.com 92.113.47.146
Clustycut daniel@cuthi.com 212.235.92.139
elena-tolstaja jababa@mymail-in.net 84.240.28.167
EnlarkWealk ovceeb2008@gmail.com 93.92.200.22
Ereceisee gomschams@gmail.com 78.106.228.243
FannaGofs roannonnarary@gawab.com 89.248.162.166
Fereexcetreva citsuececat@gmail.com 92.113.20.142
fererras yourmailstn@gmail.com 92.113.30.139
fluesealt foossenus@gmail.com 76.94.184.88
FreeForextrader forexfreenow@gmail.com 125.135.15.181
frekserrusex kattUnenryLar@onlinewomenhealth.us 92.113.29.241
Furnneuri imassaksheimi@gmail.com 91.124.193.70
gewedisaswaby utter@36up.com 212.235.92.187
GoldenCasinoToday goldencasinoonline@unlimail.net 91.124.247.142
hardladyliza hardladyliza@gmail.com 81.16.93.18
HeathUF fretys@fensite.net 93.174.93.196
helloyersss helloyers3@gmail.com 79.143.177.4
Histurcerie uttetefabitly@gmail.com 94.178.65.55
idpeps adamzjunior@tmail.net 217.146.240.8
jorbrun jorbrun@gmail.com 92.48.112.74
karakusars tyronehaynes02@yahoo.co.uk 78.110.175.13
key-denwers keydenwers@gawab.com 94.50.162.144
KninsPhinaVap liberttonim@gmail.com 92.114.187.57
LILLYJANES foededearge@gmail.com 89.18.189.13
litstypeappet litstypeappet@gmail.com 81.30.217.15
LoaliaQuoniff romocadocoign@gmail.com 79.172.79.135
Loortuttrak pitzswift@e-mail.org 75.106.251.130
lowiseglv lowiseglv@gmail.com 76.94.184.88
Lusarrask sunday@viagrabe.com 78.157.143.215
MikeLawre mikelawrenkp@googlemail.com 67.18.118.140
ooPassanger mulandurugupov@gmail.com 87.118.70.221
outliplon fixer@36up.com 212.235.92.133
panipatisk panipatisk@gmail.com 92.48.112.86
Patotrolo velsattitly@gmail.com 78.106.228.243
reTrjota yosdrwe1l@gmail.com 81.180.65.6
Rhymmellili hudsfyffffmnxcf@gmail.com 61.221.54.234
Samaritozattatr elmobar200809@gmail.com 79.164.161.242
Sleelacib mamba@viagrabe.com 78.157.142.5
snunkbaws gregorztexaxd@xmail.com 89.149.253.96
Somaliniky slipknotki@gmail.com 213.190.34.37
StetleGlaft smuckruch@gmail.com 200.63.42.75
system-of-a-down jwmozartcarrillo@gmail.com 195.60.174.21
talavera-tile-ran kennybowmanpk@gmail.com 195.60.174.21
thoulgeenunse xru777+20081004a@gmail.com 89.18.189.52
Tobunfofs dart@36up.com 212.235.92.154
TRAMADOL_Fast_Cheap biolleyimmefs@gmail.com 67.212.189.146
TRAMADOL_Online HCL dyclemowcow@gmail.com 93.174.93.50
triaxiadiaply drergocek@gmail.com 217.117.184.19
UniminlesePed penrepayzef@gmail.com 87.255.1.79
unofboymn jgjjkg@consolud.com 91.76.84.114
useltyneet pitztexaxd@hotmail.com 85.21.245.11
Utencevew cicealebish@gmail.com 85.29.204.193
ViagraBuying buyingviagra@besthotels4u.info 200.63.42.85
WhessyAssedly envikewhivy@gmail.com 78.106.228.243
wisconsin-band agwayburgessrc@gmail.com 195.60.174.21
XRumerTest yourmail@gmail.com 92.48.112.86
YFHarold slaboda@fensite.net 93.174.93.196

[Steveir]

I've had 70 in the last three days on a forum that is quite well hidden. I'm moving to the question/answer system as the forum supports a smallish group of paid members. We are supplying new members with an email that has a code to enter to sign up...fingers crossed this stops!

[RHarbison]

I've had 70 in the last three days on a forum that is quite well hidden. I'm moving to the question/answer system as the forum supports a smallish group of paid members. We are supplying new members with an email that has a code to enter to sign up...fingers crossed this stops!

It won't stop, it's only gotten worse in the years I've run forums...

However, you can greatly reduce it by doing a couple of things.

1) Upgrade to the latest version of VB and use the askimet system

2) Use the recaptcha system

I'm currently testing both on one of my forums, and spammer signups were very few, and spam posts were cut down to 1 in the last 5 days. That's much better than what it was getting before I did that.

[setishock]

The most recent spam to hit my board had now been from (GMT-12:00) Eniwetok, Kwajalein time zone instead of the Bejing time zone. These guys are actually posting on my board.

Foecopopolley
Heloyersss
CinkAccesee
ImiliaKaw
karakusars
cinatryVant
GausiaWhanuts
imnomalibyrabbit
ViagraBuying
MegranFuyis
basettasex
helloyers
Utintyanywown
impompiganuap
BibFesabselia


These are some recent ones from Bejing:

gaincoin
sadsadgd
baoerji9527

Newfoundland:

CepeSwoge

I've had visits by a few on your list. Have you noticed they have switched birthday dates and are now adding ICQ numbers to their profiles?
The ones I've dealt with over the last few days have a bday of July 25, 1963. That defeats an age limiter. They're getting a little smarter.

[The_Gismo_Man]

Am i missing something :confused: i have all new users set to moderation and not one spammer has been able to post on my site(s)
I am using image verification for registration, but, even if they use a legit e-mail address i still have to authorsie them.

I have set the usergroups "waiting for e-mail confirmation" and the "users awaiting moderation" such that they cannot browse my site, all they can see are the forum headers.
Not until i authorise them can they browse the forums.

My point is, aren't more folks adopting this method??
Ok you may reduce you're memer base, but at least it stops the bots in their tracks :)

[CareyCrew]

Am i missing something :confused: i have all new users set to moderation and not one spammer has been able to post on my site(s)
I am using image verification for registration, but, even if they use a legit e-mail address i still have to authorsie them.

I have set the usergroups "waiting for e-mail confirmation" and the "users awaiting moderation" such that they cannot browse my site, all they can see are the forum headers.
Not until i authorise them can they browse the forums.

My point is, aren't more folks adopting this method??
Ok you may reduce you're memer base, but at least it stops the bots in their tracks :)

Using email verification or admin approval is a very effective way of dealing with the spammer problem,the only difficulty is the time it consumes.

I make users verify their email which blocks anyone giving a false address and have adopted the new member usergroup where all new posts are moderated till they prove to be a genuine member.

There is a mod that was offered in this thread and if everyone posting here used it the spammers would be having a hard time as it would only be a few hours before each username and email they use would be banned from signing up at any forum.

Look at http://www.vbulletin.org/forum/showthread.php?t=176481

vbStopForumSpam - known spammer lookup for new registrations

use this and sign up for the API key so you can add any spammers to the database.

[RHarbison]

agofapaph admivibia@gmail.com 89.149.226.58
arriciamp bubaxioxy@gawab.com 89.248.162.166
becyunlillire sitemaps@gawab.com 217.10.38.251
bigboobtit bigboobtit@mail333.com 79.172.71.57
BoiliaKiz teeninsenda@gmail.com 92.113.87.42
Bupupsece bobybraun@isearchit.net 78.157.143.202
Buy viagra online harryharrissonford@gmail.com 94.50.199.104
casino online sboy2345k@gawab.com 89.149.227.252
chachiksin chachiksin@gmail.com 92.48.112.87
Clumsnumsib grourgicdibia1@gmail.com 94.102.60.74
Clustycut daniel@cuthi.com 212.235.92.139
Edilliltesk hilealiashy@mymail-in.net 87.118.70.20
EdwardCE samalis@fensite.net 93.174.93.196
erycleded hatbailla@gmail.com 200.63.42.75
ESSEBTEPE robertzjnr@e-mail.com 89.18.189.52
exhimiuplilia maittyfeave@gmx.us 200.63.42.147
FannaGofs roannonnarary@gawab.com 89.248.162.166
Feralisson dottikfred@gmail.com 93.81.11.94
fissifitlenna alexiniogerato@gmail.com 85.15.188.236
Gafsoathrosse mayopysow@gmx.us 200.63.42.93
gifeMigneby alexzpetrov@e-mail.com 91.76.127.242
gollandicc gollandicc@inmail24.com 78.157.143.206
gyboaberlygak temymnalley@gawab.com 62.212.74.20
HallyWill hallywill@gmail.com 90.189.23.86
Indichinharee sweeshice@gmx.us 200.63.42.95
inovesk taitypequepay@gmail.com 78.157.143.166
Jimmi adamztexaxd@hotmail.com 212.26.146.35
joymoundeno eveztop@e-mail.com 85.12.25.49
LAZYINTARLY preedacak@gmail.com 62.141.56.160
libertyexchangeorg qweqewawees@gmail.com 62.141.58.111
Lifeonmars lifeonmars1958@gmail.com 80.5.129.226
lksyrhdfkeh lksyrhdfkeh@mail333.com 79.172.89.99
Loonplept gaggigu@gmail.com 61.178.185.101
lottTrietle erinmina@gmail.com 75.152.17.96
MarkOR plenar@mocg.co.cc 93.174.93.196
mayncfava xyz@viagrabe.com 78.157.143.215
mebrartom wakeldececinc@gawab.com 93.92.200.22
mesnoinee todaydrugs2@gmail.com 67.226.130.134
Mikekonovisk sumxer13@ooozero.com 89.77.71.249
outliplon fixer@36up.com 212.235.92.133
polipolilipo alexzlittle@gmail.com 87.118.120.43
Pukanhez pukanhez@gmail.com 87.236.29.207
PXyLuis pxluists@gmail.com 87.236.29.207
Pydrardyfreer immosaula@gmail.com 222.66.47.115
rashyCaraf robertzlittle@email.com 81.88.121.30
RFRandall 25@zoneusa.net 93.174.93.196
sacrmionhb sacrmionhb@gmail.com 94.25.22.13
SicExcami maximzshtolze@e-mail.com 202.105.182.87
SilviaN.J. car-rental-usa@yandex.ru 78.29.58.137
Steeneoum tyruurh@concolid.com 91.76.86.18
StevenCM yhdfgdfg534@gmail.com 93.174.93.196
teaccinuincyfbd robgert@i.ua 195.149.90.85
Telequife freedmn@gmail.com 121.156.65.229
TizsciequeZic583 abopewittee@gmail.com 89.0.19.103
Tobunfofs dart@36up.com 212.235.92.154
TRAMADOL_Fast_Cheap biolleyimmefs@gmail.com 67.212.189.146
TureTroste mileszfrances@gmail.com 85.21.245.11
Ulcemelopbopsthsv sndjgtys@i.ua 195.149.90.85
unfoniBloople gdteyys@gmail.com 195.2.114.33
Usalocobflali elulfedia@gmail.com 200.63.42.75
VIAGRA_Fast_Cheap zegocuffeffen@gmail.com 93.174.93.50
watch-true-blood jsdovemodulus@gmail.com 195.60.174.21
william-ayers-ran chawpettyih@gmail.com 195.60.174.21
Zednedync lapemonaren@gmail.com 93.80.45.28
ZeenaWonders zeenawonders@gmail.com 189.104.79.212

[Unshra]

MynuQiruva bofuguwis@cantonchevrolet.cn 78.157.143.205
frekserrusex Gotaadvak@onlinewomenhealth.us 84.19.188.30

[evanshahriar]

some of the spammers in my site..



(http://www.shopnoranga.com/forum/member.php?u=1181)Acemidomveito (http://www.shopnoranga.com/forum/member.php?u=1181), addetbaxy (http://www.shopnoranga.com/forum/member.php?u=1178), alummaPailymn (http://www.shopnoranga.com/forum/member.php?u=1140), Anilsawaiva (http://www.shopnoranga.com/forum/member.php?u=1130), aporcePraicle (http://www.shopnoranga.com/forum/member.php?u=1174), argundSnina (http://www.shopnoranga.com/forum/member.php?u=1177), arrippeerry (http://www.shopnoranga.com/forum/member.php?u=1169), basettasex (http://www.shopnoranga.com/forum/member.php?u=1040), Boulouspisiny (http://www.shopnoranga.com/forum/member.php?u=1137), budirotronan (http://www.shopnoranga.com/forum/member.php?u=1017), casino online (http://www.shopnoranga.com/forum/member.php?u=1066), Ceredichkek (http://www.shopnoranga.com/forum/member.php?u=1180), chielledo (http://www.shopnoranga.com/forum/member.php?u=1168), chimera (http://www.shopnoranga.com/forum/member.php?u=64), cortlynctwIlt (http://www.shopnoranga.com/forum/member.php?u=1133), CRAROSTAIST (http://www.shopnoranga.com/forum/member.php?u=1127), dating (http://www.shopnoranga.com/forum/member.php?u=1166), Daydayscasofe (http://www.shopnoranga.com/forum/member.php?u=1128), derunise (http://www.shopnoranga.com/forum/member.php?u=1125), dff_jx (http://www.shopnoranga.com/forum/member.php?u=702), Dindmaink (http://www.shopnoranga.com/forum/member.php?u=1143), econypeOccale (http://www.shopnoranga.com/forum/member.php?u=1058), EMAWZOCABEALA (http://www.shopnoranga.com/forum/member.php?u=1161), emitleelart (http://www.shopnoranga.com/forum/member.php?u=1129), EnergYQueen (http://www.shopnoranga.com/forum/member.php?u=1158), enhallyexpile (http://www.shopnoranga.com/forum/member.php?u=1167), Envessunevy (http://www.shopnoranga.com/forum/member.php?u=1135), ErabobAllof (http://www.shopnoranga.com/forum/member.php?u=1151), Erolitatota (http://www.shopnoranga.com/forum/member.php?u=1165), ggsgsdsdgsd (http://www.shopnoranga.com/forum/member.php?u=1173), gollandicc (http://www.shopnoranga.com/forum/member.php?u=1149), HallyWill (http://www.shopnoranga.com/forum/member.php?u=1154), Hapavacle (http://www.shopnoranga.com/forum/member.php?u=1132), HeatheCagHash (http://www.shopnoranga.com/forum/member.php?u=1141), HingVeitdeedy (http://www.shopnoranga.com/forum/member.php?u=1142), Hoattytairm (http://www.shopnoranga.com/forum/member.php?u=1162), hoolferiory (http://www.shopnoranga.com/forum/member.php?u=1172), joekay (http://www.shopnoranga.com/forum/member.php?u=1175), Jzntscool (http://www.shopnoranga.com/forum/member.php?u=1003), Kathrynborlandbest (http://www.shopnoranga.com/forum/member.php?u=1156), KenRobertson (http://www.shopnoranga.com/forum/member.php?u=1122), Larderole (http://www.shopnoranga.com/forum/member.php?u=1124), libertyexchangeorg (http://www.shopnoranga.com/forum/member.php?u=1146), MartaVersadi (http://www.shopnoranga.com/forum/member.php?u=1182), MEDEISOLIthsv (http://www.shopnoranga.com/forum/member.php?u=1148), MerelinM (http://www.shopnoranga.com/forum/member.php?u=1139), meteo (http://www.shopnoranga.com/forum/member.php?u=791), MichealJU (http://www.shopnoranga.com/forum/member.php?u=1179), Nepshossy (http://www.shopnoranga.com/forum/member.php?u=1134), Nolasyclenela (http://www.shopnoranga.com/forum/member.php?u=1077), oblinleld228 (http://www.shopnoranga.com/forum/member.php?u=1144), Opiphetkitduh (http://www.shopnoranga.com/forum/member.php?u=1152), polipolilipo (http://www.shopnoranga.com/forum/member.php?u=1157), Premavarolo (http://www.shopnoranga.com/forum/member.php?u=1164), PruckcofeDuek (http://www.shopnoranga.com/forum/member.php?u=1131), Pukanhez (http://www.shopnoranga.com/forum/member.php?u=1153), quotteLitioms (http://www.shopnoranga.com/forum/member.php?u=1097), RonnyGeeks (http://www.shopnoranga.com/forum/member.php?u=1051), sacrmionhb (http://www.shopnoranga.com/forum/member.php?u=1150), Saictelia (http://www.shopnoranga.com/forum/member.php?u=1138), SaintBabysss (http://www.shopnoranga.com/forum/member.php?u=1009), Scierntic (http://www.shopnoranga.com/forum/member.php?u=1147), slettipping (http://www.shopnoranga.com/forum/member.php?u=1171), Steemsviovode (http://www.shopnoranga.com/forum/member.php?u=1119), suerroura (http://www.shopnoranga.com/forum/member.php?u=1170), Syncapponsusa (http://www.shopnoranga.com/forum/member.php?u=1159), tautNurpalf (http://www.shopnoranga.com/forum/member.php?u=1176), Topmusicworld (http://www.shopnoranga.com/forum/member.php?u=1126), Tropyorency (http://www.shopnoranga.com/forum/member.php?u=1136), Vabsitaks (http://www.shopnoranga.com/forum/member.php?u=1160), VotsaName (http://www.shopnoranga.com/forum/member.php?u=1183), watch-true-blood (http://www.shopnoranga.com/forum/member.php?u=1163), weareLig (http://www.shopnoranga.com/forum/member.php?u=1121), WeerPapse (http://www.shopnoranga.com/forum/member.php?u=1123), william-ayers-ran (http://www.shopnoranga.com/forum/member.php?u=1145), winrembo (http://www.shopnoranga.com/forum/member.php?u=1020) (http://www.shopnoranga.com/forum/member.php?u=1020)

[mac-warez.org]

Cstore
comtel05
are 2 that have spammed 3 of my forums before

[ElizeF]

bob83b - kicks10@kicksfans.com - 122.224.187.59
gatebig999 - gatebig999@gmail.com - 222.210.219.5

[Nick]

How many people here are actually using this mod?
http://www.vbulletin.org/forum/showthread.php?t=176481

Using it is much more effective than posting these lists here and will benefit many more people at once.

[DelphiVillage]

all submitted to stopforumspam :D fu******* the scumbag spammers

[Ernie Romers]

Floris, could you please point me to where I can find the built in q/a option? My forum has version 3.7.3 pl1 (http://forums.watchuseek.com).

Thanks in advance.

[Wayne Luke]

http://www.vbulletin.org/forum/showthread.php?t=176481

[CtrlAltDel]

Wayne, why not build a better registration form/registration.php instead of asking the customer base to maintain various addons to 'reduce' bot registrations.

Heck change the registration form each PL to keep bots on their toes.

[chaz7979]

For 2 years I have had no problems and then this week came. I have been getting killed with spam signups. I don't want to have to install mods or jump through hoops I just want to know that my VB software will be able to handle this new bot and block it. Please tell me that someone understands this hole and is working on fixing it.

[shahryar_neo]

i have this problem from 7 months ago ! it drives me crazy because after they register , they posting immediately ! they easily pass the all verfication methods and i don't know what can i do ! they have many users and we banned but this method like stupid method ! because we only deleted or ban some of them and after a while again they go and spamming ! so vbulletin should use some human verification method that they can not register !

by the way many users i've listed for you :

080903k
080907k
080910k
Bartirtuank
buyzestrilhere
davidsj888
ijkl087
Pukanhez
pkasko20
winrembo
vwxy112
vwxy734
Rixawaway

do you want more ?! :D about 90% of them is russian !

2- They go to some url that they have in their DB ...

Thanks
Shahryar

[Tetractys]

We've been attacked by some of those same spammers here in the past several weeks, also. The forums are under control now and we're adding some new code to make it tougher for them to register.

[shahryar_neo]

is there any responsible person here to answer and help about this problem ?

[Floris]

is there any responsible person here to answer and help about this problem ?
Please read this thread, we have been posting a link and details to the issue on every thread page on this topic. ( [vB 3.7] How to Reduce Spam and Registration Bots (http://www.vbulletin.com/forum/showthread.php?t=275800))

[Mike Vollmer]

These are from the recent invasion of one of my boards by Russian spam bots:

Abedsslabs billi506@mail.ru 10-02-2008 10-02-2008 0
Aspiffdig habador@gmx.us 10-01-2008 10-01-2008 0
Crardadia vurabbarnic@gmail.com 10-02-2008 10-03-2008 0
enumSaultable palkdeesk@gmail.com 10-02-2008 10-03-2008 0
enzymnfaime getfreehostnaw@gmail.com 10-02-2008 10-02-2008 0
eryclisse somefurs@gmail.com 10-01-2008 10-01-2008 0
esseskhom knossendbeela@gawab.com 10-02-2008 10-02-2008 0
Evemysele tichepigh@gmail.com 10-02-2008 10-02-2008 0
Faitcaufact existeprere@gmail.com 10-01-2008 10-01-2008 0
feerneiva trupsfreesk@gmail.com 10-02-2008 10-02-2008 0
FefbromoBob veptpreorgo@gmail.com 10-01-2008 10-01-2008 0
FreeMusicDownloads fanniemwhistler@gmail.com 10-02-2008 10-02-2008 0
GiggristTug honyfory@gmail.com 10-02-2008 10-02-2008 0
GomSoilia scohyncsows@gmail.com 10-02-2008 10-02-2008 0
hoituiche garurgedgenut@gmail.com 10-02-2008 10-03-2008 0
IceneIrrins accurfsar@gmail.com 10-01-2008 10-01-2008 0
invismike canada@viagrabe.com 10-01-2008 10-01-2008 0
mayolfral usa@viagrabe.com 10-01-2008 10-01-2008 0
mipephert0 mnas23ds2@gmail.com 10-01-2008 10-01-2008 0
Rarrarkestiami boinousiaj@mail.ru 10-02-2008 10-02-2008 0
Seafscensenox djkdllns07@gmail.com 10-01-2008 10-02-2008 0
Sofia_Magic info@hjklghjkl.co.cc 10-01-2008 10-01-2008 0
SotLalfdota sam@canamedic.com 10-02-2008 10-09-2008 0
spossyitentew inharahunda@gmail.com 10-01-2008 10-01-2008 0
swiptsith super@viagrabe.com 10-02-2008 10-02-2008 0
TurotynctoT staillaseaw@gawab.com 10-02-2008 10-02-2008 0
Varlkeegial youriiail@mail.ru 10-01-2008 10-01-2008 0
Veidlyteede biasufdrmiff@mail.ru 10-01-2008 10-01-2008 0
WakevaskHapfrm divestevimi@gmail.com 10-01-2008 10-01-2008 0
WeilmFeesyGem bnm444+20081002@gmail.com 10-02-2008 10-02-2008 0
ZlabirintezA rettanatsep@gmail.com 10-02-2008 10-02-2008 0
ZumoKillat zumokillat@gmail.com 09-28-2008 09-28-2008 0

[hipgirl]

Recently I got a lot of spammer registered. I deleted over 300 account last week. When I check for spammers, this thread helped a lot so I want to post here the IP and email I banned. Hopefully help others.

Banned these countries:

CZECH REPUBLIC
MOROCCO
MALAYSIA
UNITED ARAB EMIRATES
VENEZUELA
SERBIA AND MONTENEGRO
MONTENEGRO
Thailand
PAKISTAN
ROMANIA
LATVIA
LITHUANIA
AUSTIA
KUWAIT
INDONESIA
MOLDOVA, REPUBLIC OF
TAIWAN
China
PORTUGAL
RUSSIAN FEDERATION
PANAMA
SAUDI ARABIA
Turkey
ISRAEL
LUXEMBOURG
OMAN

Banned these emails:
@horny-sluts-blog.com
@mail.ru
@gawab.com
.cn
.ru
achine.cn
adult-friend-finder.biz
ameinfo.com
amorki.pl
babusya.com
bestquicksearch.info
bigmir.net
bk.ru
br1des.com
businessinfonews.com
careyblogautoblog.org
cashette.com
compare-credit-rates.com
dirxx.biz
e-doping.com
e-mail.com
e-mail.net
e-mail.org
email.com
email.net
fiuz.net
fivecash.com
gawab.com
goldwarez.org
greatbestbuys.info
hotmail.net
hotmail.org
i.ua
inbox.ru
inerted.com
inet.ua
inmail24.com
izmail.net
jetfix.ee
list.ru
luckyvid.we.bs
gmail.ru
mail.ru
mail15.com
mail333.com
mainru.com
mbeschica.info
mmail.ru
mobyportal.com
moviesandklips.cn
mymail.com
mymail-in.net
o2.pl
onetopcasino.info
perfectautosbuy.biz
rambler.ru
rupr.org
sddir.info
stylebrand.com
tenbit.pl
test99.com
tide67.com
topjobnet.org
topsearche.info
tristia.cn
trivas.cn
tropitone.cn
tvchix.cn
typecast.cn
ua.fm
ua-news.net
uastar.net
uganska.net
ukrmail.org
videogamebomb.com
vinbazar.com
wonderfulshoppinggalore.info
xmail.com
xmail.net
xmail.org
yandex.ru
youdealonline.org
zadonsk.net

Banned these IP:
91.199.129.
66.79.162.108
85.119.135.
76.17.93.26
84.243.197.
78.129.235.
92.48.127.
72.37.231.2
217.20.112.
118.100.93.
89.149.241.
194.165.42.
217.20.118.170
93.174.93.196
84.16.227.121
194.8.75.239
206.220.40.8
71.238.223.31
76.172.240.209
89.77.71.249
216.155.133.68
78.110.175.13
85.12.24.27
92.114.187.57
92.48.112.86
90.52.76.215
85.12.25.43
90.28.242.213
89.0.19.103
89.149.253.100
92.241.168.228
195.24.76.232
78.26.179.253
61.27.99.39
61.221.54.234
72.233.78.139
92.48.112.87
89.18.189.52
65.75.243.110
72.29.83.6
216.150.78.90
87.118.112.179
12.205.167.41
87.118.106.56
67.86.201.206
82.7.118.104
62.141.56.160
85.17.111.131
87.118.112.179
80.5.129.226
76.94.184.88
211.240.110.34
61.221.54.234
67.226.130.134
79.143.177.4
85.29.204.193
85.15.188.236
87.118.110.218
92.113.117.184
87.236.29.207
195.5.116.248
61.221.54.234
88.200.254.42
87.118.106.165
66.232.103.247
89.248.162.166
87.118.70.220
61.221.54.234
216.97.231.243
72.189.211.245
91.149.224.252
85.17.201.131
78.26.179.253
118.37.99.246
92.241.169.185
85.12.24.30
85.12.25.49
209.67.216.138
89.18.189.52
87.183.103.248
89.149.227.193
91.84.236.37
67.226.130.134
12.176.148.179
85.12.24.30
85.12.25.49
91.186.18.61
87.85.157.103
72.46.140.34
72.55.188.250
92.48.118.220
85.12.24.24
209.82.180.67
89.149.208.209
85.17.167.196
79.150.227.241
138.100.71.90
121.156.65.229

Thanks.

Michelle
www.hipgirlclips.com/forums (http://www.hipgirlclips.com/forums)

[Floris]

Official Announcement: Forum Robot Spam Prevention Recommendations (http://www.vbulletin.com/forum/showthread.php?t=288234)

[Mike Vollmer]

Recently I got a lot of spammer registered. I deleted over 300 account last week. When I check for spammers, this thread helped a lot so I want to post here the IP and email I banned. Hopefully help others.

Banned these countries:
Banned these IP:

Banning countries & IP addresses to fight this attack is pointless. They are using compromised computers all over the world. You won't win until you have banned the entire internet.

Take a look at vBulletin's official recommendations:


http://www.vbulletin.com/forum/showthread.php?t=288234

Implementing the profile question stops this current attack dead in its tracks and gives you time to take other measures as well.

[Chieftain]

I've installed the fix and it slowed things down, but it has hardly "stopped this in it's tracks".

Here's a quick example of what I've been doing that's proved effective.

Consider IP 83.0.0.0

If you run it through WHOIS...

http://www.networksolutions.com/whois/index.jsp

You get:

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL

ReferralServer: whois://whois.ripe.net:43

NetRange: 83.0.0.0 - 83.255.255.255
Notice the "Net range". that means the ripe Network has given this troll every single IP between 83.0.0.0 and 83.255.255.255.

If you go into the Admin Control Console, under "banning Option" and add 83.*.*.* to your IP ban list, that troll can come back with as many usernames as he wants, and he cannot get in.

I know what my local IP numbers are so I know what to look for when people sign up, and I've IP banned hundreds this month, and it has prevented untold thousands of active intrusions onto my site. I've been under assault, and there are so many bot hits now my stats are meaningless. I have one guy with RIPE's 194. series that hits me repeatedly during the day with at least 6 different IP's in that range that all start with 194.

I activated the mail notification on this thread and I'm open for suggestions.

Thanks!

[jmwking]

I've installed the fix and it slowed things down, but it has hardly "stopped this in it's tracks".

Here's a quick example of what I've been doing that's proved effective.

Consider IP 83.0.0.0

If you run it through WHOIS...

http://www.networksolutions.com/whois/index.jsp

You get:
Notice the "Net range". that means the ripe Network has given this troll every single IP between 83.0.0.0 and 83.255.255.255.

If you go into the Admin Control Console, under "banning Option" and add 83.*.*.* to your IP ban list, that troll can come back with as many usernames as he wants, and he cannot get in.

I know what my local IP numbers are so I know what to look for when people sign up, and I've IP banned hundreds this month, and it has prevented untold thousands of active intrusions onto my site. I've been under assault, and there are so many bot hits now my stats are meaningless. I have one guy with RIPE's 194. series that hits me repeatedly during the day with at least 6 different IP's in that range that all start with 194.

I activated the mail notification on this thread and I'm open for suggestions.

Thanks!

There are five Regional Internet Registries (http://aso.icann.org/rirs/index.html) responsible for handing out IP addresses: ARIN (North America), RIPE (Europe), APNIC (Asia Pacific), LACNIC (Latin America/Caribbean), and AfriNIC (Africa).

When you queried Network Solutions, it merely reported the address as being within RIPE's jurisdiction. You need to query RIPE's whois server to get a specific IP resolution. If you block an entire Class A subnet (e.g., 83.0.0.0 - 83.255.255.255), you block whole swaths of Europe.

You may want to do that; I don't know. I do know I have members on my board from scores of countries (regrettably, a list also including China and Russia).

Some whois resources:

http://www.db.ripe.net/whois
http://www.apnic.net/db/index.html
http://www.lacnic.net/cgi-bin/lacnic/whois
http://www.afrinic.net/cgi-bin/whois

-jk

[Chieftain]

Thanks for that info!

Unfortunately, my experience with these RIPE users has been that they sign up at my site, using some cute name involving either "Barbie" and/or "Viagra" and start posting links to other sites that sell knockoff pharma, cigarettes, or porn sites.

I've banned a user with a specific IP starting with 83, only to have him come right back and try it again with a new username another phony e-mail address and a different IP starting with 83.

I run a small board in Southwest Washington, dealing with local politics and issues. Nobody in Europe, Asia, Russia, or anywhere outside of Southwest Washington gives a hoot what we talk about there, so blocking them all together just isn't a problem for me.

[jmwking]

It's a rather blunt instrument, but if you want to block the non-ARIN RIR IP addresses, this is the list of AfriNIC, APNIC, LACNIC, and RIPE Class A assignments from IANA (http://www.iana.org/assignments/ipv4-address-space).

041.0.0.0/8 .. AfriNIC
154.0.0.0/8 .. AfriNIC
196.0.0.0/8 .. AfriNIC
197.0.0.0/8 .. AfriNIC

058.0.0.0/8 .. APNIC
059.0.0.0/8 .. APNIC
060.0.0.0/8 .. APNIC
061.0.0.0/8 .. APNIC
112.0.0.0/8 .. APNIC
113.0.0.0/8 .. APNIC
114.0.0.0/8 .. APNIC
115.0.0.0/8 .. APNIC
116.0.0.0/8 .. APNIC
117.0.0.0/8 .. APNIC
118.0.0.0/8 .. APNIC
119.0.0.0/8 .. APNIC
120.0.0.0/8 .. APNIC
121.0.0.0/8 .. APNIC
122.0.0.0/8 .. APNIC
123.0.0.0/8 .. APNIC
124.0.0.0/8 .. APNIC
125.0.0.0/8 .. APNIC
126.0.0.0/8 .. APNIC
133.0.0.0/8 .. APNIC
150.0.0.0/8 .. APNIC
153.0.0.0/8 .. APNIC
163.0.0.0/8 .. APNIC
171.0.0.0/8 .. APNIC
202.0.0.0/8 .. APNIC
203.0.0.0/8 .. APNIC
210.0.0.0/8 .. APNIC
211.0.0.0/8 .. APNIC
218.0.0.0/8 .. APNIC
219.0.0.0/8 .. APNIC
220.0.0.0/8 .. APNIC
221.0.0.0/8 .. APNIC
222.0.0.0/8 .. APNIC

186.0.0.0/8 .. LACNIC
187.0.0.0/8 .. LACNIC
189.0.0.0/8 .. LACNIC
190.0.0.0/8 .. LACNIC
191.0.0.0/8 .. LACNIC
200.0.0.0/8 .. LACNIC
201.0.0.0/8 .. LACNIC

062.0.0.0/8 .. RIPE
077.0.0.0/8 .. RIPE
078.0.0.0/8 .. RIPE
079.0.0.0/8 .. RIPE
080.0.0.0/8 .. RIPE
081.0.0.0/8 .. RIPE
082.0.0.0/8 .. RIPE
083.0.0.0/8 .. RIPE
084.0.0.0/8 .. RIPE
085.0.0.0/8 .. RIPE
086.0.0.0/8 .. RIPE
087.0.0.0/8 .. RIPE
088.0.0.0/8 .. RIPE
089.0.0.0/8 .. RIPE
090.0.0.0/8 .. RIPE
091.0.0.0/8 .. RIPE
092.0.0.0/8 .. RIPE
093.0.0.0/8 .. RIPE
094.0.0.0/8 .. RIPE
095.0.0.0/8 .. RIPE
141.0.0.0/8 .. RIPE
145.0.0.0/8 .. RIPE
151.0.0.0/8 .. RIPE
188.0.0.0/8 .. RIPE
193.0.0.0/8 .. RIPE
194.0.0.0/8 .. RIPE
195.0.0.0/8 .. RIPE
212.0.0.0/8 .. RIPE
213.0.0.0/8 .. RIPE
217.0.0.0/8 .. RIPE

-jk

[Chieftain]

I'm selective. I just bother with the ones that bother me. You should note the three "41" series IP's from the African Network Information Center. That was an early troll that shows how they keep coming back until that series is banned entirely.

I started out trying to individually ban these trolls, and you can see how my IP bans have become more and more inclusive.

Again, I woke up on October 1st this year and found 48 new signups at my site, and that is what started all of this. It's slowed down because of these group IP bans.

I had a troll make it all the way through ReCapcha just this morning, and the last two IP's on this list were added less than an hour ago. That one is from Asia, and they were just Admin Approval away from posting God knows what on my blog. What's interesting is that I've had bots from both of those IP series pounding on the door for several days, until early this morning when some person intervened and successfully got through.

Even if banned, they do not stop trying to get in, and are still generating enough visits to the site and hits as to render my stats completely meaningless. None of these IPs have ever contributed anything to my site except spam, so that's why they make the list, and banning a whole range is extremely effective.

Note: There are individual IP's that are listed here, many of them appeared to be hacked computers and those individual IPs had to be banned as well.

88.108.68.164
41.224.187.106
41.224.220.123
41.224.178.178
84.19.180.179
78.157.143.204
77.91.224.8
82.99.30.*
65.55.110.*
65.55.210.*
65.55.211.*
65.55.109.*
64.136.27.230
64.41.145.**
217.78.182.*
78.157.143.*
87.85.157.*
200.63.42.*
118.227.8.*
92.112.82.*
85.12.25.*
85.140.223.*
91.78.160.*
92.243.166.*
93.174.93.*
85.29.204.*
85.12.24.*
78.157.142.*
92.113.102.*
66.232.103.*
89.18.189.*
12.176.148.*
212.116.219.*
67.226.130.*
92.112.151.*
208.88.53.*
91.84.236.*
91.124.163.*
80.243.153.*
92.112.*.*
200.63.*.*
93.81.*.*
92.113.*.*
78.107.236.*
89.206.*.*
91.76.*.*
219.215.*.*
94.75.*.*
90.150.*.*
217.67.*.*
91.124.*.*
88.81.*.*
78.110.*.*
92.241.*.*
84.19.*.*
62.231.*.*
87.183.*.*
84.240.*.*
218.249.*.*
78.29.58.*
79.172.*.*
202.114.*.*
195.39.*.*
92.48.118.*
217.12.*.*
58.185.*.*
91.198.*.*
85.140.*.*
81.27.*.*
195.56.*.*
77.222.*.*
83.237.*.*
195.245.*.*
206.220.*.*
221.*.*.*
123.*.*.*
91.*.*.*
194.*.*.*
89.*.*.*
93.*.*.*
202.*.*.*
210.*.*.*
218.*.*.*
61.*.*.*
222.*.*.*
193.*.*.*
213.*.*.*
195.*.*.*
83.*.*.*
94.*.*.*
87.*.*.*
60.*.*.*
201.*.*.*
196.*.*.*
86.*.*.*
217.*.*.*
72.52.96.51
88.*.*.*
219.*.*.*
94.*.*.*
212.*.*.*
203.*.*.*
77.*.*.*
92.*.*.*
78.*.*.*
80.*.*.*
200.*.*.*
67.189.9.37
82.*.*.*
41.*.*.*
84.*.*.*
198.96.220.*
189.*.*.*
82.*.*.*
216.245.209.178
62.*.*.*
198.65.122.125
85.*.*.*
94.*.*.*
90.*.*.*
190.*.*.*
65.75.245.200
78.*.*.*
79.*.*.*
95.*.*.*
59.*.*.*
194.*.*.*
81.*.*.*
210.*.*.*
211.*.*.*

[yahsuah]

nickname:jack19780605
email:zhangjun1688@gmail.com
Birthday:25 may 1980
IP:221.206.36.162
GMT:+8

[yahsuah]

usernames:
XsXPo8o
wow996in
qrst487
pqrs474
pqrs445
gatebig999
liyanricaoqiyue1314
cobra4
bob83b

emails:
12530net@zyseo.com
goldmailwow8@gmail.com
xueyu02@wormseo.cn
huangjianyong324@gmail.com
kaoggtnnd@gmail.com
caoqiyue@aol.com
bobstiff8@gmail.com
kicks10@kicksfans.com

IP:
123.131.11.117
122.234.4.148
121.32.155.135
218.76.151.229
220.160.27.54
121.230.19.230
222.247.125.141
122.224.187.53

All bots have checked first radio button in profile field and filled "1" into all textareas

[Lenni]

People, we just need to convince the vBulletin developers to add a simple functionality to our forums and all spam problems be gone:
Check for a http-links in first post - if not on whitelist - move post to quarantine. From there the moderators can approve the post - or ban the spammer. Easy? It works for me and that's why I'd like this functionality to be officially added to the vBulletin code.
Since I use the modification I have NOT had any spam problems - because the posts are being fetched before they are posted into the public.

[fischermx]

I'd like to know which columns/tables in mysql tables are affected to mark a user as "banned".
I could delete all my spammers if I know how to mark this users banned at the database label.

[David Grove]

I'd like to know which columns/tables in mysql tables are affected to mark a user as "banned".
I could delete all my spammers if I know how to mark this users banned at the database label.
I think all you'd have to do is put them in a banned usergroup.

[Dave-M]

I think I should add my method of dealing with spambots. It clearly works as we rarely get any spammers at all, maybe one every 2 months and it's generally the pregnant woman selling nappies or the cheap Nike trainers guy.

I do not use captcha or recaptcha.

I use a single question and an example of this would be:

From the list of numbers, select the twelfth, first and seventh numbers "9856986596965976" So, the answer would be 696.

You can make the questions as complex or easy as you like, you can use letters to spell a word, but make sure you have a good selection of varied questions and update them every so often so they can't learn them all.

I hope this helps :)

[Lenni]

I dont annoy my members with captcha or long-to-think-about answers anymore.
I will just not let spammers post their garbage. Link in first post = spam. Link in first post = moderation queue. Easy as it is. And no need to annoy legit members anymore.

[David Grove]

I dont annoy my members with captcha or long-to-think-about answers anymore.
I will just not let spammers post their garbage. Link in first post = spam. Link in first post = moderation queue. Easy as it is. And no need to annoy legit members anymore.
For the most part it is that easy, although what if a spammer figures this out and post their first post without links and the second with links. You might also try Akismet.

[DanAuito]

Plug these Spam jerks into your ban list!

89.248.162.166
193.151.104.8
92.50.169.10
93.81.103.237
72.30.161.236
194.8.75.109
194.165.42.139
83.138.128.113
94.102.60.81
76.107.72.235
194.165.42.91
76.164.192.98
94.102.60.162
78.157.142.5
94.102.60.162
219.132.7.10
68.55.28.203
68.40.92.234
196.35.158.184
98.28.8.155
78.26.179.253
194.165.42.109
94.102.60.166
81.255.213.227
76.118.130.88
221.238.19.3
69.136.48.220
89.149.227.202
65.75.245.200
194.165.42.107
78.106.192.133
221.128.124.188
81.255.213.232
194.165.42.45
67.215.231.146
207.255.30.184
194.165.42.67
194.165.42.27
121.234.237.74
83.149.71.137
218.63.252.219
221.221.179.158
220.178.42.42
222.183.119.182
69.64.70.96
116.234.4.127
218.240.13.108
12.46.14.66
147.91.173.31
195.128.127.5
200.63.213.2
202.101.6.85
202.156.6.77
203.113.13.3
203.190.250.104
203.229.251.159
211.153.44.155
212.73.128.114
216.139.164.84
218.5.84.205
219.136.249.79
24.151.200.77
24.85.220.156
60.191.251.9
64.246.18.25
66.96.203.37
66.98.212.79
67.180.241.181
67.80.254.204
71.140.50.82
80.58.205.41
80.58.205.47
81.1.89.95
81.1.93.187
81.197.104.145
81.199.85.117
82.199.96.64
83.229.92.5
121.1.4.199
72.3.137.82
12.46.14.66
147.91.173.31
195.128.127.5
200.63.213.2
202.101.6.85
202.156.6.77
203.113.13.3
203.190.250.104
203.229.251.159
211.153.44.155
212.73.128.114
216.139.164.84
218.5.84.205
219.136.249.79
24.151.200.77
24.85.220.156
60.191.251.9
64.246.18.25
66.96.203.37
66.98.212.79
67.180.241.181
67.80.254.204
71.140.50.82
80.58.205.41
80.58.205.47
81.1.89.95
81.1.93.187
81.197.104.145
81.199.85.117
82.199.96.64
83.229.92.5
121.1.4.199
72.3.137.82
125.192.165*
67.169.44*
70.161.197*
68.36.45*
24.44.34*
68.106.181*
24.61.11*
68.49.106*
91.191.59*
68.106.181*
218.6.9*
99.140.113*
218.7.191*
78.157.143*
24.99.190*
211.117.62*
72.177.146*
61.178.185*
193.109.248*
87.118.122*
218.106.90*
68.199.62*
69.122.128*
211.142.116*
64.252.48*
203.113.86*
68.46.165*
219.159.199*
90.191.66*
222.183.120*
76.111.136*
80.81.40*
88.119.246*
208.110.73*
137.164.143*
79.35.3*
82.135.242*
80.252.250*
204.118.88*
79.143.176*
89.28.114*
219.240.12*
195.39.211*
219.240.12*
69.46.23*
75.127.109*
70.237.191*
83.228.51*
217.146.246*
78.129.203*
72.232.215*
211.94.188*
189.22.83*
212.54.12*
85.239.0*
128.146.93*
222.187.238*
91.124.13*
222.183.128*
116.234.10*
203.158.221*
78.57.34*
203.162.2*
89.28.3*
92.241.168*
193.46.236*
87.118.120*
208.72.168*
89.28.3*
92.241.168*
85.17.222*
62.42.52*
85.254.186*
59.151.53*
92.48.99*
202.114.66*
76.126.95*
206.53.51*
85.255.121*
62.244.55*
203.162.2*
78.129.199*
89.149.253*
59.96.143*
78.129.208*
24.62.127*
83.167.100*
87.118.124*
83.34.158*
70.83.113*
78.129.195*
193.238.213*
87.118.116*
78.129.202*
89.149.241*
78.37.246*
71.70.201*
91.122.18*
68.199.163*
66.98.212*
24.2.45*
59.149.165*
71.108.96*
91.122.117*
72.36.246*
66.199.231*
83.3.45*
89.178.52*
83.3.45*
218.106.244*
69.107.1*
91.124.194*
203.198.181*
125.46.36*
142.161.157*
190.16.129*
190.30.225*
194.44.141*
195.134.80*
195.149.90*
195.2.114*
195.244.128*
200.83.4*
200.88.114*
201.18.38*
201.243.227*
202.115.130*
202.28.27*
203.121.71*
203.144.144*
203.186.54*
203.69.39*
207.210.93*
207.232.25*
208.109.218*
209.47.94*
210.22.158*
211.97.70*
212.150.97*
213.114.21*
213.139.26*
213.220.192*
213.42.21*
213.65.170*
217.141.106*
217.147.29*
217.219.61*
218.249.83*
218.56.8*
218.57.11*
218.57.8*
220.130.112*
221.13.32*
221.2.243*
221.232.159*
222.235.64*
24.97.133*
38.117.88*
58.65.234*
58.65.235*
59.7.37*
59.77.21*
60.250.135*
61.132.90*
61.144.78*
61.152.145*
61.28.1*
62.141.50*
62.85.45*
62.96.106*
64.178.142*
64.27.28*
64.56.65*
64.86.69*
65.4.99*
65.98.11*
66.235.180*
66.45.251*
67.18.235*
67.187.229*
68.254.30*
69.112.161*
69.124.113*
71.253.254*
72.36.245*
74.208.44*
75.181.62*
75.69.76*
76.116.101*
76.30.53*
77.247.20*
77.50.7*
77.91.227*
78.83.206*
80.109.149*
80.235.65*
80.48.49*
80.76.124*
80.91.186*
81.100.176*
81.106.240*
81.164.118*
81.168.223*
81.95.146*
81.95.151*
82.144.197*
83.167.112*
83.211.3*
84.110.129*
84.16.224*
84.16.235*
84.47.171*
85.12.63*
85.140.4*
85.140.66*
85.255.120*
86.1.200*
87.118.110*
87.118.118*
87.118.98*
87.206.89*
87.240.15*
87.242.117*
87.248.167*
87.99.79*
88.227.74*
89.106.23*
89.173.17*
89.77.80*
91.122.25*
91.186.12*
12.46.14.66
147.91.173.31
195.128.127.5
200.63.213.2
202.101.6.85
202.156.6.77
203.113.13.3
203.190.250.104
203.229.251.159
211.153.44.155
212.73.128.114
216.139.164.84
218.5.84.205
219.136.249.79
24.151.200.77
24.85.220.156
60.191.251.9
64.246.18.25
66.96.203.37
66.98.212.79
67.180.241.181
67.80.254.204
71.140.50.82
80.58.205.41
80.58.205.47
81.1.89.95
81.1.93.187
81.197.104.145
81.199.85.117
82.199.96.64
83.229.92.5
121.1.4.199
72.3.137.82

[Lenni]

For the most part it is that easy, although what if a spammer figures this out and post their first post without links and the second with links. You might also try Akismet.
Well, in that case, just make the first 25 posts be checked for links and add a whitelist of links that can go through. If someone still posts a link which is not in the whitelist, moderators are there to quickly let the post through. And this is where I doubt that any spammer would try to post 25 legit posts on your forum just to be able to post his garbage - garbage like "WOW" which is of course on a blacklist - moderation queue. Now don't tell me that this is THE solution to all our problems?! :D

[xadoa]

ok ppl sensor this shiz out .. i got this for my board..

ideewomen.com letitbit.net canalshipping.net abusimbl.com strefa.pl hostshield.com studentische-mitte.de formobile.biz nvnews.net freeones.com camaro5.com freesextut.ru dvd-store.com od.ua djyw.org vids247.cn faves.com bravehost.com bangtusuong mongmo mongmo.com coimongmo thienbong thienbong.com thangbomvn quannhala quanlavn coithienthai gailoan doctruyen tinhdonphuong chotinh dithocpho dithocphocap vn3 quanla quanhala quanlavn hamvuiclub hamvui tinhyeutrenmang lunarpages rotten.com AdultBouncer thangbomonline dynamix.net tuoitho.net vietvoice.net vietcyber.com vietcyber trungtamgiatri.net sexmoviepost lhsol tuoitrequay conheo a4u asian4you asian4u knakezooi port5 port5.com vietphongluu vietphongluu.com lonelyghost vinad.com adultmetal A4Y tinhyeutimthay sungsuong thangcuoi tronhoc iaproduction ebaumsworld vietsex sextourismasia vnexpress vietsingle vietfun www.cuocsong.net conchim tinhduc chat121 sexthai thienha khattinh monghoatrang cuongsong thangcuoi bacbaphi muaban.sg muaban dieukydieu thoinayws vtv4 vtv4-online truongdangnhatyen vietsupermodel bianca.com votacthien tinhmotdem trehoangdai baibang hocsinhdienbien hvaonline vnthuquan appznet tipsofbookies xemphim xemphim.tv vinahosting vinahosting.biz vietloving.net vietloving the-best-online-poker truyenviet giacmongdem giacmongdem tialia greenpaltalk paltalk linhku echo.cx thanhnien vuonongbuom tieubachlang tuoitrequay datviet tosimco tuoitre xanga filmcuaban thegioidudon vieclam.uni xuantinh lang3x vietsweet xcompaq foreverlovingu kieptinhchung online4fun honguyen anhchoi180 vietnamnet phimtap ngoisao elitemodelvn vuthibichtram zoomshare tathy kimbinhmai thacloan vuonghong khaokhat CALITODAY take2tango rmitportal 1900585819 toiyeu vnsex telepolis clbthangbom thangbom freewebs achnclub it4vina xuanhong giotnuoc khm3r sonic200 freewebtown easy-sharing filegone langthangmang uychxongte web-space uploading.com dantri.com badongo ngovuong vui4mua 4ever3x freewesb chiloan.net homeip baitamtien 3xforum blogspot picfury whatvn film4vn namsachol vietkieuanchoi wetasiangirls machsong vnkronline laklakclub vuonthuonguyen imagefap linkbux usercash mekiep free-hoster vnunderworld Vietnam.net xthost vndichvu tienve pic2m vinafilms imagecash giaitrithegioi phimhot phimnhac hinhsexviet vuontinhnhan yeuvn tintucvietduc sendspace luyenphim chongthamnhung thegioidudoan chongthamnhung webmuaban forumer.com vietmusiclover vietbox vietdjclub krazyshow pimpshare imgfree vinafilm cafetinh gaigoi i4vn webtretho 500cents-500dollars vdc.com trungtamquangcao raovat mocxi bacphuong ngothanhvanxao tinyurl opera.com yourfilehost hangdep.com mekiep khiep.com uploadphim myfreepaysite coitien thegioiao invisionfree good.to gaixinhvietnam ggvn.tk dudoantrung.com tinypic.com mexanh imagehigh.com imagespot.com nhay.net hstoday tin44b conchim hocsinhvinh uploadnhac.biz flurl.com iuphoto.com fapomatic.com nothingtoxic.com photobucket 6x.to 3xthoinay vnnphim websamba phimclub turboimagehost congan.com theimagehosting blogspot.com quicksharing.com hotsexvn googlepages.com freeimagehosting.net lepages.com kieplangthang.net mtech-vn.com vietnamxxx wearevietnamese mynhan.com mynhan.net phimnguoilon vuichoi thichphimheo mavantai vominhduc.info web1000.com gainhaysanhdieu anh-em-club boxviet ******.com 69bbs.com phimhot.net baomatvn vnhack lequydondanang viettech.org lauxanh.us naphalong-forum ToNuVietTrinh.com photoll.com www.cuu www.danch nhay.net birlavn noobvn.com birlavn.com e-gold.com duypham.com Volunteer.com VPRX.COM hiv.com ekhoanet.com vnn.vn ttvnol.com rogepost.com lachtray.biz babeunion.com innocentdream.com youngerbabes.com easyvn.com avsnonline.net avsnonline.com gso-media.com film4hvc thiettinh.com .go.to imagepile.net cynosura.org thegioiao vuongbao 8m.net imageshack.us 5phut.com fileave.com mypicsfolder.com danchoiviet.com myfreefilehosting filespacer.com theonhauxuongpho slide.com adultpics.h.fc2.com cba.pl aventertainments.com vnupload.com trafficholder.com imgplace.com degia.us girl24.us hoadongnoi GaiSang.NeT sgdam.com thegioivideo.com vuilen.com nhacso.net gidrometall.neo.to any.to imagefly.info manhhieu.com 360.yahoo.com anchoiviet noobvn nguoitinh 450mb.com anonywebproxy.com imgspot.com yeu-ghet.com thaiphienphoto freeimgs.com vietson.com anchoiviet.net anchoiviet.com photoamp.com forumphim.com vncentral.com imagebanana.com nhathuy.xm.com sevenload.com vietdongtam.com photoamp.com nhathuoconline.com x-men.vn freerapidaccount.com adbux.org worldthugian.com gaisang.com cashfiesta.com 72.232.123 vipgirl.tk vn-world.com daitu.info vndam.com tangmaythutam tialb.biz tangmaythu8.com serverhc.com ntol.web.aplus.net vocvitinh.com webso1vn.com webso1vn uongsua.com vn-world.com 90movie.com vngogo.com vngogo diendan.vn vno.vn steve-prirate.info filepixie.com 38.119.88 gaisang gaisang.com uploadpk.com 49mb.com langson.bz greenhorse.com saigonnet.vn takehost.com upload32 upload69 tretoday.net kute.pro codoi.net freewebtown.com fedho viraldownload.com filehost.gr 550mb.com archive.org vozforums.com xanh.us viet_nam_net thanh_nien.com vitinfo.com.vn kiss.to oidanba.com freebyte.com thetend.com coiyeu.com uploadaz.com kiss.vn Image1337.com t35.com thangnho.com imagepile.net kiss.to oidanba.com coiyeu.com notrix.net image4you.org swahl.com picscrazy.com easy-share.com shooshtime.com vietfun4you yahuz.com 850mb.com netup.us imagevenue.com totalverueckt.com freeimagehost.eu imagebam.com sendthispic.com pdaviet.net shareapic.net baoanhadv.net upload2world.com uploadxp.info vntruyen.com truyen.com giadinh.net Thongtinlaptop.com xxxviet.com VnMedia upviet boithu.com hoimegai.net hoimegai.com picburst.com forumrotic.com uploadhouse phimhongkong vdjx.net yian20 thaiminhtri aitinhviet.com vietvuive mekiep anhdep greenupload lauxanh phim88 imageupload vietmaisau truongton newsexviet.com newsexviet.net newsexv ĂnChơiViệt anchoiviet NEWSEXVIỆT vuilen.info vuilen.com vuilen.net gaiviet.info gaiviet.com gaiviet.net 123phang.com 123phang.net 2chip.com 2chip.net raumamxanh.com tangmaythu dunhau anchoiviet newsexvi noobvn emhangxom xitin.in kute3x.com hangdep missvn.us 6vn.biz tuyentap gainhay so1.in vuonchuoi urlcash kidmannicole.com monicabelluccifans.com lovebritneyspears.net lavigneavril.net loveparishilton.net vn.org cliponline tinhyeunamnu dubaimlm.com zjjzgl.com yy121.com stk-interlining.com gamezmoney.com shzgpv.com snownes.com cltruck.com dfspv.com huiyish.com yc-dx.cn hzjb.com hbclqc.com hbdfzy.com truckcl.cn 3815555.com dfclqc.com zhuanyongche.cn dfclqc.com 21cn.com brogame.com girlhanghieu wowgold1000.com MaxManga.com wowgoldlive.com gamelee.de aocgoldweb.com aocpowerleveling-gold.com wow-powerleveling.org top-bearing.com powerleveling sf10001 igsstar goldweb runescape shop.com power-leveling u4game rannybossblog shemales.com fisted.com -jobs.com asses.com 6scenes milflessons69 assparadediary preggolicious 8tm.org zhongguo watchez watchesreplica atitrade.com pharma3.org nakedgirlonline fateback 77.222 sexyalise aokhost 87.118 cyworld shakira-sextape canamedic avast.com bitdefender eset.com kaspersky sexmamba nakedgfs bloglines videomovie real18girls msn.com 91.203 buchanan spip-epona mourayre talkaboutpc wohlers rippedmass tripod.com ****sexadult realgf.com norigaesoft.com raindown.com pytalhost.com inventforum.com jakereport.com coolpage.biz sale4soft.com freehostia.com hi5.com weebly.com google.com.ua videos-movie.com virgin-x.com loveangelinajolie.com deppjohnny.com alpacino.net bradpitt.net robertdeniro.net vnvista.com nhacpro.info plus.vn pornmate 7blogs orderdrugs buyphentermineonline furosemide l-carnitine antabuse rollyo.com lovelysin.com kostenlosie freewebhosting letitbit.net pharmacy.com besthardporn.com petsamaritans.co yandex.ru techgsm.com tierstadt.de shophowto.com govietgo.com eclipseusers.se philipperaskin.com mail.ru insurance.searches-top superintop uva.nl sibang.ac.in slu.edu sfu.ca nsw.edu.au miyazaki-mic.ac.jp hum.iit.edu tu-berlin.de heacademy.ac.uk earnonline.ie sharif.edu met-elearning.org alquds.edu upmin.edu classpage.org elearning.com careerlauncher.co mans.edu epath.ca sixsigmaonline.org avicenna.hu acupuncturist.edu unctad.org materialsknowledge.org eshikshaindia.in cytrap.org cumberlandcollege.sk.ca fct.unl myomet.com earcos.org jaltcall.org discoveryeducatorabroad.com itcnetwork.org tag-board.com tetongravity.com pokrivdim.com alexandermcqueen envy.nu www.adultporn phreesite.com www.incestklick yourfreehosting.net www.incestporn hostevo.com www.incestik 110mb.com www.incest obxhost.net www.drocheram 007sites.com www.anuglya 8tt.org www.incestik 150m.com freetzi.com www.momson callvipgirls.com okmassage.net noordlaren.eu allcafe.info zacefronforum.com indiarealjobs.com battlehacks.info debts-solved.co dynastymu.com memfis-club.info itjedis.org gogoer.com netlog.com item4u.com sharedonline.net invisionplus.net esquerraunidabunyol.org uniberlin.com wastelandonline.org cmberatung.com mathayom.com inmspa.it maku.webd.pl newfairplay.net 99k.org mad-uk.org suddenmove.net antwerp2stroke.be guestbook.com.tw invisionplus.net boltz-thunder.com .2966.com livropontoarte.com freephpnuke.org game-elite.com mazikastore.com radomirovic.net gunit-hq2.net cuttingcorneronline.com lempire.uw.hu rapidboards.com findrides.net modules.php?name santipromphat.com komta.com juststephen.com nowhere01.org rapidboards.com svitgardyn.com religionsphilosophie.org laguildedulac.com prizedrawgenerator.com ramsredson.com bieleroffiziere.ch bliuzonaktys.lt scouttechnology.com itam.ws jaone-twizzy geekmilitia.com .pp.ru vkorobke.ru innercityallstars.com sport-kickit.com thephotocircle.com ecoportal.com snspa.info fixhomecomputer.com rq2007.cc courier.co wilburn-solutions.com sky-ink.net nsgals.com silvia-saint.us path.to suggestion.net linuxforen.de scoresummit.com youth.sg thptcampha.net cleveland.com uforum.org blogcheese.com xxxdosug.ru gidddroperrrrrit.com bebo.com sashawww.com freevids4you steadfast.net discount-pharmacy stimulhosting.com xgenstudios.com getk2.com coolest-gadgets.com onlinelevitra designerstalk.com roleplayerguild.com ion-audio.com nukemods.com nationalrepublicans.org mikhailtech.com webdesignforum.com macnn.com numark.com nationalrepublicans.org northcyprusforum.com tvinjapan.com down-south.com onmac.net onmac.net aocsource.com buysellsearch.info my-free-forums.com nfe.go.th turkforum.gen.tr sexyandfunny.com sewer.sk xbox-skins.net ibrahim-kendirci.com ghost-riders.ch hardcore.lt nudist-resorts.org yulechengbao.bbs cctv.com xnview.com kalbass.net phpbb9.com allwatchers.com bsplitter.com beachnbikes.com burnsmart.com wallpaper-base.to austinhighschoolclassof67.com poolsidechats.com proboards51.com porn-o-quebec.com hacking-masters.net omicronlab.com proboards74.com satweb.org stumbleupon.com www.nezavisim red-y.info models.powergirls me.uk lipills.com royalrxdrugs.com epaxx.com favgames.com lazque. sitebooth.com hostaim.com bidsex.net fusedtree.com my3gb.com fizwig.com timnhanh.com milkomoodle.de milkomoodle.de liciniosilva.com redesdeconvivencia.es ilam.org ddbainbridgeassoc.com interlinkconsult.de ebimsal-m.ccems.pt jbarros.com nclmoodle.org.uk distanciavirtual.edu.bo sagan.ajusco upn.mx nieto fices.net espe-m.ccems.pt 3zsmt.cz dusausoit.com cimeformacio.com schakelbw.nl iescotesbaixes.org huehnlein.info bu.edu byethost31.com radikal.ru byethost24.com geocities.com sts7.com minhhue.net phapluan.org falundafa.org static.flickr.com corkd.com yedda.com freewebpage.org bestblogssite.net librarytechnology.org planetphotoshop.com chinhphap.com clearwisdom.net haveyourplace.com bbc.co.uk abcmedstore.com fcpages.com accesshost.com .co.cc buykamagraonline yuku.com justfree.com planetmaks.info spscentru.ru ************** myprivatefotos.net granderomans.com osu.edu awardspace.com menshealthwiki.info ursupermen.info filedownloader.net edenica.ru amerohealth.info mylounge.com scam.com daytre.com sonypictures.com tvgasm.com dirtragmag.com indya.com somaliactionalliance.org cherokeewolfclan.org ethiox.com nodo50.org ucc.nau.edu drugaera.org aqua-art.org chemart.org skcentral.com dslruser.co.uk dotnet-addons-training.com somali-youth.org kongregate.com ibelgique.com iespana.es ifrance.com isuisse.com iquebec.com ourweb1.net easyweb2.net easyweb4.net easyweb3.net easyweb5.net weblook1.net weblook2.net weblook3.net weblook4.net weblook5.net topsites1.net topsites2.net topsites3.net topsites4.net topsites5.net topsites6.net cyberweb1.net cyberweb2.net cyberweb3.net cyberweb4.net cyberweb5.net porscheshop.co.uk

[Snowman872]

Am i missing something :confused: i have all new users set to moderation and not one spammer has been able to post on my site(s) I am using image verification for registration, but, even if they use a legit e-mail address i still have to authorsie them. My point is, aren't more folks adopting this method?? Ok you may reduce you're memer base, but at least it stops the bots in their tracks :)

Not quite. I use this system and my forum was flooded today by someone I manually approved and passed the image verification with about 250+ posts in different threads before I discovered the problem.

I had some trouble trying to delete them all in one pass -- vBulletin got a "time out" fatal error since it took more than 30 seconds. It appears the messages were deleted from the database, but the indexes on the home page still look like the spammer was the last poster.

I would like to see a "Max Post" per day limited added. Some type of system where unknown newbies on the forum can be set to a low number such as 10. Although some spammers might still get through, it would stop flooding in its tracks. Perhaps after a certain number of real posts, the member would be promoted to a higher security limit or the limit would no longer apply.

The user name today was "eylem1970." A few days ago they tried the same thing as "melisa".

88.226.219.151

[Lenni]

Well, in that case, just make the first 25 posts be checked for links and add a whitelist of links that can go through. If someone still posts a link which is not in the whitelist, moderators are there to quickly let the post through. And this is where I doubt that any spammer would try to post 25 legit posts on your forum just to be able to post his garbage - garbage like "WOW" which is of course on a blacklist - moderation queue. Now don't tell me that this is THE solution to all our problems?! :D
;)..

[cache]

my IP list is:
12.153.207.115
121.230.10.
122.109.31.
122.240.84.
142.162.56.
190.30.24.
190.49.104.
190.49.109.
190.50.122.
192.89.77.
193.180.104.
194.165.42.
200.127.207.
200.45.95.
200.49.156.
201.213.182.
208.107.8.
212.100.250.
216.139.164.
218.212.255.
219.132.208.
219.148.119.
24.127.45.
24.176.146.
24.19.29.
24.19.67.
24.247.94.
24.78.235.
24.96.247.*
58.49.234.
59.56.32.
59.58.138.
61.140.108.
64.191.91.
64.5.62.
64.62.138.
65.24.38.
65.93.153.
66.139.27.
66.156.32.
66.199.246.
66.229.17.
67.168.100.
67.168.152.
67.170.120.
67.183.226.
67.185.236.
67.201.38.
68.13.160.
68.196.134.
71.14.33.
71.14.40.
71.162.181.
71.227.170.
71.38.30.*
71.80.181.
71.87.205.
74.184.186.
75.126.219.
75.176.182.
75.84.36.
76.1.164.
78.129.214.
79.119.145.
80.164.29.
83.233.86.
86.196.29.
88.196.184.*
89.214.123.*
89.178.182.
91.142.206.
91.121.21.
99.234.28.
99.244.129.

[Lenni]

People, stop this stupid IP address banning already...

[1996 328ti]

Maybe people should just ban *.*.*.* and be done with it.

[andrew johnson]

hi - i had one person join few days ago - but i checked her other places - she posted a odd message so i need know if she is spammer or something - her nickname = farina450 = her ip is 121.120.49.69

[ac1d1dty]

This is pissing me off >_>

Have had 162 spammers in just a few days. I only have a hundred or so members >_>

[funnyspo]

We dont do much knowing the usernames thats the easiest thing to change.

[schwab2clarkson]

If you ban the names of the bots put an asterix at the end of there name so that they can't register with the same name.
Also try putting up the question answer thing to stop the spammers from coming on to your forums and spamming it.

Don't ban ip addresses unless you know that that particular person has exhausted every other option.

You can make it so that guests can't see your forum.
Go to admincp> vbulletin options left hand side menu > usergroup manager> edit access marks > can view forum > no

[flynnibus]

been getting lots of random registrations with emails of moreprobe.com of the last two days. Looks script generated - who knows what they are doing for the recaptcha stuff.. but the account details are certainly automated.

I really wish vb had a block IPs from registering option that didn't block all access to the site. Then you could be much more aggressive in IP banning (like taking out most of asia, etc)

[kgroneman]

been getting lots of random registrations with emails of moreprobe.com

Can you just put @moreprobe.com in the banned email list to kill that one?

[flynnibus]

Can you just put @moreprobe.com in the banned email list to kill that one?

Yes. My post was to ID another website that is a common problem, not that I needed help blocking them.

[musclenexus]

Is there anyway to ban every IP from Asia (AU) and netherlands (NL)?

Almost all spam bots I see come from those places.

[mbteam]

I would like to suggest all coders to work on something better to prevent automated spammers. I get them every day. I hate them especially when they post pornography to my forum which is solely for general users. This is one of the main reasons I transfered from phpbb.

[sv1cec]

In our site, I have implemented several counter-measures against spammers. For example, I have an automatic filter that traps some predefined words. If someone enters 10 times the word Nokia in a post, he is automatically banned and his IP blocked. Some other spammers are registering with their country defined as Argentina (we have a list of coutries registering members can select from). If their time zone doesn't match Argentina's, they are again banned. And of course, we have several spammers captured by our moderators, which are issued a special warning, which comes with a permanent ban and their IP getting blocked. Oh yes, we also have a "Guestbook" which is open to the public, and of course attracts spammers, even though we tell them that their messages will never be displayed until approved. They get banned as well.

With all those measures, I have collected several pages of banned IP addresses. Sure, some times we ban a dial-up server for AOL, but other members let us know and we unban that IP. If someone is interested in that list, please pm me or email me, I'll be more than happy to share it. Oh, yes, when an IP gets banned, the email address of the user get banned too. So I have some more pages of banned emails.

In the past, I posted those IP here (there isn't one single IP which is not a spammer IP) and some people got wild, so I am not posting it again. But you can verify who I am here and in vbulletin.org.

[Kneginja]

been getting lots of random registrations with emails of moreprobe.com of the last two days. Looks script generated - who knows what they are doing for the recaptcha stuff.. but the account details are certainly automated.

I really wish vb had a block IPs from registering option that didn't block all access to the site. Then you could be much more aggressive in IP banning (like taking out most of asia, etc)

I have problems with the same moreprobe.com. Can somebody tell me how to put moreprobe.com in the banned email list? I can't find where is that list

[sv1cec]

I have problems with the same moreprobe.com. Can somebody tell me how to put moreprobe.com in the banned email list? I can't find where is that list

AdminCP -> vBulletin Options -> User Banning options

[hsantal]

AdminCP -> vBulletin Options -> User Banning options
Sweet. I was looking for that today also. Had 4 from moreprobe in the last few days.

[cnredd]

Sweet. I was looking for that today also. Had 4 from moreprobe in the last few days.I just got hit with them, too...

[Sanjiyan]

A few more for us to ban:

eventsZ (http://www.sanjiyan.co.uk/forums/admincp/user.php?do=edit&u=466) - xt5wf7fjk@moreprobe.com - 193.151.244.10
pV8n1WR - u5saqx8gk@moreprobe.com - 58.8.194.216
H4qkmLz - m0k5zg56h@moreprobe.com - 95.79.219.3
shoes159 - shoes159@live.cn - 59.58.139.226

[Chelf12]

All the user names were spam. So I blocked the domain, since it was a throwaway domain.

Users 1 to 9 of 9

DRCFYymdt
eXaphiTxN
rsCqVrVyg
SKoJnmKNp
SlzPzwMHD
WfoyiOJNO
WNSlSDvJi
yIWCkXCkU
YmQmdneMc


Yeah. I cheated. I just banned the domain, which was @maillier.com

[oldengine]

Google this one: MysterialSEO

[obmob]

XRumer spam

The user(s) who posted the spam are:
MysterialSEO

The IP addresses used to post the spam are:
91.76.221.202

[obmob]

User: BorisExpress
IP: 95.67.141.241

[obmob]

Well... it seems i'm under siege -.-

phottoshop
IP 194.8.75.151

LevitraES
IP 194.8.75.109

Banned IP and domain @accommodationresearh.info

[ChandlerDog]

Same here
PhottoShop.....AutoCad download ad.

[Shadab]

81.88.230.47
85.53.23.19

Didn't register on my Forum. Rather, they came in swarms of 100-150
and started leeching. These two IPs ate about ~1.5 GB of my bandwidth. :(

I ended up banning them via .htaccess

[Floris]

Well... it seems i'm under siege -.-

phottoshop
IP 194.8.75.151

LevitraES
IP 194.8.75.109

Banned IP and domain @accommodationresearh.info
These two just spam flooded my reCAPTCHA powered forums. I had a fun time removing their crap from my 10+ sites.

I really wish vBulletin took anti spam more serious.

[Floris]

These two just spam flooded my reCAPTCHA powered forums. I had a fun time removing their crap from my 10+ sites.

I really wish vBulletin took anti spam more serious.
Does anybody have a script that lists all the IP's used by all the banned users? And if an IP is used more than once to increment a counter for it? So we can see the most offensive / return IP and manually block them in .htaccess?

[testbot]

These two just spam flooded my reCAPTCHA powered forums. I had a fun time removing their crap from my 10+ sites.

I really wish vBulletin took anti spam more serious.
they got past recaptcha on my site too but they didn't make any posts or PMs. i'm pretty sure akismet caught them.

[Carnage-]

The latest version of my advanced ip ban manager product comes with a list of about 100 ip blocks that are associated with Chinese spammers that one of the other admins on my forum put together.

Even if you don't use the product, the list may be of use to you. As far as i'm aware, since i added the list; we've only had one spambot. (i'm now going to find that 10 have registered in the past 5 mins. . . :p)

[testbot]

These two just spam flooded my reCAPTCHA powered forums. I had a fun time removing their crap from my 10+ sites.

I really wish vBulletin took anti spam more serious.
in vBulletin's defense, compared to most boards they do great. especially with the akismet option.

the bigger and better any company gets the more their products will be targeted. if anything it's a sign of success as weird as that is.

just a few years ago apple use to say "we have no viruses". well that was because nobody used the damn things. after they launched massive marketing campaigns and started selling guess what's topping the news... "Evidence suggests first zombie Mac botnet is active" (http://arstechnica.com/apple/news/2009/04/evidence-suggests-first-zombie-mac-botnet-is-active.ars).

anyway, i think the best way to keep bots and spam from posting on your board is to follow the following steps.

To keep bots from sending PMs to your users:
1. Rename the default Registered group to Newly Registered
2. Create a new group named Fully Registered based off of Newly Registered
3. Edit Newly Registered
4. Set 'Maximum Stored Messages: 0' and save
5. Go to Promotions> Add New Promotion
6. Change 'Posts' to a number that you feel will justify a user is real (2-5 should be fine)
7. Promotion Strategy: Posts
8. Promotion Type: Primary Usergroup
9. Move User to Usergroup: Fully Registered

To moderate new users first posts(for the paranoid):
1. Follow the steps above
2. Edit: Newly Registered
3. Change Follow Visitor Message Moderation Rules: No

Enable Akismet:
1. Register for an account at http://wordpress.com
2. Get your API key from your WordPress conformation email
3. AdminCP> vBulletin Options> Spam Management
4. Anti-Spam Service: Akismet
5. Enter your API key from step 2
6. Set the scanning threshold. I personally don't think this needs to be too high because bots can't normally get past the first post so why add the extra load for the rest of your users.
7. Save

reCaptcha or Question and Answer
I can't decide which is better so I'll leave these steps out but make sure at least one is selected.


Hope this helps someone out there. Just keep in mind that since this is laid out in different places the enemy will find it and figure out a way to bypass it.

[Chelf12]

I attached a list of spam domains and users.

http://www.vbulletin.org/forum/showthread.php?t=134856&highlight=Spam+Calorie
^Is that something you are looking for, Floris? It's a huge list of domains.

I couldn't attach the TXT, since it's 600kb in size. So I zipped it and uploaded it.

[TomJames]

phottoshop
IP 194.8.75.151

Have this guy on my site, not tried to spam anything yet. *Goes to ban*

[obmob]

MagicOPromotion
IP 94.142.128.140

has to be a person, even edited signature and avatar. -.-

[TomJames]

MagicOPromotion
IP 94.142.128.140

has to be a person, even edited signature and avatar. -.-

Had that person register as well, checked them on Google and seems to have mass registered on lots of forums.

[50calray]

ancetrySync 194.8.74.65 I can not count how many times I've banned that one IP address :mad:


birbirboo 195.248.234.132
Ideobeonece 211.239.124.90
superaffiliate 65.2.149.197

PS, how do you proactively ban a non user?

[andrew johnson]

Well... it seems i'm under siege -.-

phottoshop
IP 194.8.75.151

LevitraES
IP 194.8.75.109

Banned IP and domain @accommodationresearh.info

i had two that had same name one so i banned them after checking the e-mail address
but the phottoshop had online01@1berlinaccommodation.info
and also you haven't checked their signtures - they had a profile linked to sites
i had clean out their sigs

[obmob]

oh, thanks andrew :)

[oldengine]

Anyone get this one?

Nina Amelove

[hosting-talk]

jack2009
priya123

These two were actually using some sort of combination of human registration and yahoo/google results bot to post just to get their count up, since I have it set so that you have to have 10 posts to create links anywhere. Made me look twice at their posts, but they were all spam.

These guys are getting more and more difficult to catch ;)

[andrew johnson]

banned General Issmus because he was spammer and making hatred posts and etc relating about 911 threads and murders etc
please ban this user from all forums

60.242.9.157
docker01 at dockersunion.com

and also please report him as his website is illegal too

its from australia

[hosting-talk]

anna2009, ip of 122.164.116.108
Massive spamming, trying to build postcount by C&P'ing completely irrelevant content from sites like yahoo, etc.

[50calray]

Just zapped one a few minutes ago.

ForexOnlineTrue
89.149.244.91

[obmob]

This is very peculiar, searched for it and it has been registering tons of sites in the past days, but he attacks not just vB, but IPB and phpbb as well.

Mazzurbaf
194.8.74.11

[obmob]

GodVIAGRA
IP Address: 81.222.206.2

[Steve Machol]

GodVIAGRA
IP Address: 81.222.206.2
GodVIAGRA just tried here (it was caught by the Akismet spam filter) using IP: 194.8.75.151

[Biker]

Heh. That one was terminated with extreme prejudice a couple of hours ago on my site. Prolific little bugger, ain't he? :D

[jfazio]

Is there anything proactively we can do? godviagra, Byworkevevort, Mazzurbaf, LODDESSEFAB, smyrnite1 - we are right now under full blown attack.

[jfazio]

ha, just realized what i wrote. this would not be a proactive fix.

[Chelf12]

Another awsum email address.


accommodationresearh.info

[David Grove]

GodVIAGRA just tried here (it was caught by the Akismet spam filter) using IP: 194.8.75.151
Same here, and same IP.

[andrew johnson]

GodVIAGRA just tried here (it was caught by the Akismet spam filter) using IP: 194.8.75.151

i found him at my site which i banned him and same ip

[qubed]

here is a complete list in a rtf file from my forum www.pilo.me (http://www.pilo.me) of spammer isp's and domains, this list is quite comprehensive - these are sorted and easily ready to be copy and pasted into your vbulletin banning options under banned isp's -

the credit of isp's and domains goes to stopforumspam. the breakdown and sorting goes to me for this file. the first file below is the list of ip's

http://mirrorcreator.com/files/FZWL4NTO/www.PILO.me_-_IP_List.rtf_mirrors



the list below here is for the domains

http://mirrorcreator.com/files/1AIQCBHJ/www.pilo.me_-_domains.rtf_mirrors (http://www.mirrorcreator.com/files/1AIQCBHJ/www.pilo.me_-_domains.rtf_mirrors)

[mamahues]

94.178.9.59
Maliksandr
maliksandr@view-3gp.com

They also included a website in their profile but I figured I shouldn't post it as it is an attack site.

[MindFixxer]

OemSOFT / 194.8.75.151 / Hostname not resolvable.

Posted as guest today in a forum guests shouldn't be allowed to post in... :confused:

[andrew johnson]

OemSOFT / 194.8.75.151 / Hostname not resolvable.

Posted as guest today in a forum guests shouldn't be allowed to post in... :confused:
i found him on my forum but he didn't get through to posting because the forum rules hack which i installed on stopped him in tracks

BTW: adamzgooglet@xmail.com is his e-mail

[andrew johnson]

OemSOFT / 194.8.75.151 / Hostname not resolvable.

Posted as guest today in a forum guests shouldn't be allowed to post in... :confused:
i found him on my forum but he didn't get through to posting because the forum rules hack which i installed on stopped him in tracks

BTW: adamzgooglet@xmail.com is his e-mail