03/11/2010 (5:24 pm)
Spam-borg ban list: forum owners please post recent spammer usernames here...
I suspect these are Asian game addicts. My nephew in Jakarta told me that the internet cafes there stay up all night for the teen and pre-teen game addicts. I have seen news reports of special treatment programs for game addiction in China. It is the same all over Asia. A private internet connection there is often expensive, but an internet cafe is cheap. Children go to play unsupervised.
In general, playing these games is like pinball, it does not make any money. These children seem logical targets for a local geek who can convince them that they can make money, or to help him in exchange for internet time, or game points he wins illegally with his robot skills. Most of these new spammers advertise WOW gold from the popular game World of Warcraft. Some are branching out with youthful enthusiasm to amateurish celebrity sites such as KidmanNicole.com, LoveBritneySpears.net, etc. (Click here for my spam archive thread (http://starnectar.com/showthread.php?t=63).)
There are many ideas to filter this spam, as discussed in the thread Spam Bots Defeat Recapcha (http://www.vbulletin.com/forum/showthread.php?t=272439). Meanwhile, I would like to start this thread for reporting the usernames of these 'Spamborgs'. They reuse the same usernames at hundreds of forums. But banning someone who has not even done anything at my forum is touchy. I prefer to wait until I find a WOW gold ad or a previous banning. But that is tedious. Instead, here is my idea.
1. Forum owners please make a habit of posting usernames here of any new spammer.
2. They can then be banned proactively at dozens of forums.
3. This also just might throw a wrench in their operation.
Notes:
It may be most effective to ban spamborgs after they register--instead of preventing them from registering. The spamborg method is to join dozens of forums and do nothing for some time--then suddenly start a spamming spree. If we ban a spamborg at the start of a spree--but after registering--they have wasted much effort in useless registrations. Whereas, if we attempt to prevent a spamborg from registering--they immediately know this, and can more readily respond by changing their methods.
Subscribe to this thread (http://www.vbulletin.com/forum/subscription.php?do=addsubscription&t=275885) with instant email notification to be notified of each new spammer.
In case of error, include in the one-line 'reason' for the ban that the bannee can be reinstated via your Vbulletin 'contact form'--or give a temporary email address. Also please report here if any listing is in error.
You can probably ignore any numbers appended to these usernames.
If you suspect a username--but it has not spammed your forum--please search Google first to find:
a. numerous forum memberships showing "Total Posts 0"
b. AND two "Banned" profiles OR one "WOW Gold" ad OR a listing at StopForumSpam.com (http://www.stopforumspam.com)
...If both of the above are found, then please list the username here.
Total posts and bans can be found as follows:
a. StopForumSpam.com/search?q=[username] (http://www.stopforumspam.com/search?q=[username])
b. Google: "View Profile [username]" +"Total Posts 0"
c. Google: "View Profile [username]" +Banned
d. To Google for posts that have NOT been deleted:
"View Profile [username]" -"Total Posts 0"
Caution: please confirm the 2 bans by clicking on the Google listings.
(My personal method to ban these borgs is to give a custom 12-point user infraction (http://www.vbulletin.com/forum/showthread.php?p=1569135#post1569135) of 'very obvious spam', meanwhile my auto-ban setting is permanent for 12 points. Meanwhile a forum-wide announcement of etiquette says that a banned member can simply apologize and be reinstated manually. For me, this is easier than going to the admin panel. For the bannee, this sends an automatic PM explaining the ban reason in one line. My browser remembers that one line so it's just one more click. Incidentally, my forum disallows numbers in usernames (http://starnectar.com/showthread.php?p=100). This is mainly a matter of taste but does make things easier for me and harder for them. If there are any spam posts, I 'show all posts by...' and move these with another click to a single spam archive thread (http://starnectar.com/showthread.php?t=63).)
We can start with this list from COPIERTALK at 'spam bots defeat recaptcha' (http://www.vbulletin.com/forum/showthread.php?p=1580646#post1580646):
beijmanli
jklm292
joshbob
KaiyreBoy
KevinFlys
lovebeijgo
lovemaryii
Pereftiyo
weiwei
Try this other plugin to reduce spams.
http://www.vbulletin.org/forum/showthread.php?t=135094
here (http://www.vbulletin.org/forum/showthread.php?t=176481)is a mod that integrates vBulletin into the stopforumspam service.If anyone in the spamdatabase trying to register it will be denied it needs cURL for the remote functions (you can check that through)
phpinfo();
?>
if the output shows a cURL section you have it ...
myphpbb@gmail.com
222.187.236.141
Do you offer anyone free services ........................... er ,thought not.
and yes I kepy copies and screenshots of your handywork before I blew you off the forum:mad:
----------------------------------------
mylegafriend
info@mylegalfriend.com
91.104.108.249
www.mylegalfriend.com
---------------------------------------------
ok0510@126.com
221.6.182.50
Banned on many other forums: Google: ok0510 + "banned" (http://www.google.com/search?client=firefox-a&rls=org.mozilla%3Aen-US%3Aofficial&channel=s&hl=en&q=ok0510+%2B+%22banned%22&btnG=Google+Search&aq=f)
--
crack
crackwee@yahoo.com
83.138.172.79
NoSpam! --an alternative to capcha images (http://www.vbulletin.org/forum/showthread.php?t=124828).
Thank you for the tip K4L. I like the NoSpam system and I have referenced it in the other thread. This enables people to use simple questions, either to replace or add to image verification. I believe this can help because Spamborgs do not seem to speak English... However... I just realized that Vbulletin 3.7 has Q&A verification. I am going to upgrade and try that first. NoSpam might be better, but I like to avoid hacks as much as possible.
*************************
I just banned Spetertoi, with 36 Google results for +"0 Posts"... 2 Google results for "Spetertoi is offline" +Banned... 1 StopForumSpam.com listing... and 2 previous listings in this thread :o
*************************
Spamborg join dates for Starnectar Free Forums (http://starnectar.com). (A new forum, not advertised, with 62 Threads, 130 Posts, 20 Members, standard non-Capcha image verification on low settings, and numbers disallowed in user names.)
2008.05.20 KaiyureBoy
2008.05.21 beijmanli
2008.05.22 lovebeijgo
2008.05.28 loveumaryii
2008.05.31 dreamath
2008.06.04 Tcrubuyuuie
2008.06.10 weiwei
2008.06.11 Pereftiyo
2008.06.17 socanvz
2008.06.18 Springbirdoo
2008.06.25 Lovingttu
2008.07.04 Spetertoi
My conclusions so far.
In May, I suspected that the spamborgs were more attracted to my forum because I was lax in banning them.
In June, I developed systematic pre-emptive banning. This "maybe" was responsible for slowing them down but has not stopped them.
Currently I receive one spamborg weekly like clockwork.
It is possible to predict the next spamborg and what his name will be. Spetertoi joined SOCKWATER's forum June 30, then Starnectar Forum July 4.
Using such predictions, a "stealth cookie" might ID a spamborg computer, then trigger a special reaction the next time that computer is used to join a Vbulletin, regardless of the user name. To prevent the borg-master from countering with a format, this reaction must be invisible. (Such as allowing his spamborgs to join, but confining them to a phantom subforum.)
However, my strategy for now is simply to upgrade to Vbulletin 3.7 and use the new Q&A verification.
(If after installing the Q&A system, I still get spamborgs, I will not ban them. Instead, I will attempt to divert them to a phantom subforum. I would like to see how this works out, and also whether "allowing" spamborgs to believe they are posting successful messages may or may not encourage a flurry of additional spamborg sign-ups...?)
do yourself a favor and under USER BANNING in the ADMINCP ban the email address @21cn.com
socanvz is my only spamborg who used @21cn.com to join Starnectar Forums. All others used @gmail.com. 21cn.com (http://21cn.com) appears to be a major Chinese language website. So, banning @21cn.com sign-ups may be equivalent to banning Gmail sign-ups or Chinese IP's. I am no expert but I surmise that this might discourage real Chinese members, while the spamborgs would simply change to all Gmail accounts.
socanvz
email: cavanza@21cn.com
ip: 218.6.9.101
birthday: Jan 1 1980
timezone: +8 Beijing
Spetertoi
Email: sof8op@gmail.com
IP Address: 222.183.129.47
Birthday (d-m-y): 1-1-1980
Timezone: 8
got this one just now
222.183.122.160
I'm glad I have the mod that sends me security token mismatch errors.
It's usually caused by a spammer.
Array
(
[do] => updatesignature
[wysiwyg] => 1
[MAX_FILE_SIZE] => 10485760
[sigpicurl] => http://www.
[url] => /forum/profile.php?do=editsignature
[s] =>
[message] => free games
[securitytoken] =>
[ajax] => 0
)
Request URI
Funny thing is, just yesterday we got an admin post wondering why one of them could not register, so that proves that there is a human in there someplace.
You don't have to change anything. You simply enter in a simple question(s) and your done with it. How long can that take.....5 minutes? Like I previously said, I was getting an average of 12 or more a day. It's just been over two weeks now and not a single one! Now I have more time to devote to other more important things. One of them is certainly not making and placing spammers on a list as I simply don't have any more! I'm sure the occasional one may slip through here and there but it seems as though they will be very few and far in between. It seems to me that checking and making lists of spammers is far more time consuming than simply implementing a simple safe guard. But, if you insist on doing so by all means be my guest.
http://www.vbulletin.org/forum/showpost.php?p=1568961&postcount=45
~Phil
Spetertoi
Email: sof8op@gmail.com
IP Address: 222.183.129.47
Birthday (d-m-y): 1-1-1980
Timezone: 8
Updated list:
akgame
alexwm1234
bcde889
beijmanli
bobo891x11
coinnetnet
crack
defg070
fff123r
freegood
gamelee
lkky00245
jeep1688
jklm292, jklm160
joshbob
KaiyreBoy
KevinFlys
lovebeijgo
lovemaryii
loveumaryoo
LRTIMKEN
ok0510
Pereftiyo
socanvz
Spetertoi
Springbirdoo
tonilovekelly
twelve2008
warren123
weiwei
wowgold2008, wowgold1000
wwwzhudan
zhangfanfan001
I get around 10 people all signing up within minutes. All different names, emails. All real estate related. My forum is about motorsports in San Diego... not real estate in Virginia. The only thing that seems to be the motivation is that they all have sigs with real estate urls.
I deleted all of them, 2 days later 10 new ones.
This site appears to be pretty effective at helping me manually determine if a user who is attempting to register is a SPAMMER (or is LIKELY a spammer). It will show you what other forums he has registered on and when ... found a bunch where they have registered for six forums within a one hour period, or where something else is suspicious (like country of origen). You can then google the user name, and see if they are banned elsewher
I have been trying to figure it out but can't seem to find a way to do it.
As for adding any spammers to the list here I'm afraid but, very happy, that I cannot contribute as I don't get them any more with the "No Spam" plug in! Not saying that it will never happen again but it seems as though even the human assisted spam bots do not wish to take the time or effort to answer any question I have placed in for the registration procedure. With that I still fail to see the need for this time consuming list. I can handle the occasional one that may slip through the cracks every few months as opposed to the 8 to 14 a day I was getting but other than that.....what's the purpose of it all when it can so easily be cut down by 99%! as I have done?
~Phil :)
http://www.vbulletin.org/forum/showpost.php?p=1568961&postcount=45
~Phil
you are rite and we have it already added not the vb.org but the one suggested via profile field manager
I would never entertain myself to be your guest :p
Don't you think it would be easier if all users that fail the CAPTCHA process at registration time were marked as SPAMMERS, and then all their posts placed into a moderated queue, until removed from the SPAMMER list?
What posts? On most forums, a member can't register without passing CAPTCHA. Furthermore, they cannot post without being registered.
Therefore, anybody who fails CAPTCHA cannot post... thus, there would be no moderation queue for them.
If spamborgs start using popular names, this may make listing them rather pointless. I just received a suspicious sign-up from 'Stephanie'. I can not ban her or put her on the list because this is such a popular name. There are numerous Google results for Stephanie, but clearly including many different and real people. There is one StopForumSpam listing with the same email address, so I do have a probable spammer. But is this a spamborg or a real person who misbehaved once? StopForumSpam does not supply links to archives of alleged spam, so I can't tell.
Meanwhile, let's soldier on. I never promised this would lead anywhere. Just an experiment for those who are so inclined, or have a bit of insomnia. To reduce the screen length of the spamborg list, let's put all names beginning with the same letter on one line, as below.
July 5, 2008 Alleged Spamborg List.
akgame, alexwm1234
bcde889, beijmanli, bobo891x11
coinnetnet, crack
defg070
fff123r, freegood
gamelee, Global
lkky00245
jeep1688, jklm292, jklm160, joshbob
KaiyreBoy, KevinFlys
lovebeijgo, lovemaryii, loveumaryoo, LRTIMKEN
ok0510
Pereftiyo
qrst436, qrst747
socanvz, Spetertoi, Springbirdoo, stuv021, stuv454,
tonilovekelly, twelve2008
warren123, weiwei, worthtosee, wowgold1000, wowgold2008, wwwzhudan
zhangfanfan001
P.S.
I have updated my methods of searching for Ban listings.
a. StopForumSpam.com/search?q=[username] (http://www.stopforumspam.com/search?q=[username])
b. Google: "View Profile [username]" +"Total Posts 0"
c. Google: "View Profile [username]" +Banned
d. To Google for posts that have NOT been deleted:
"View Profile [username]" -"Total Posts 0"
:D Thank you for the note below, COPIERTALK. (I hope Stephanie is a raving Buddhist fanatic. I could use a few on my forum. That would go well with all the WOW Gold ads.)
:D Thank you for the heads up SOCKWATER. (I think our defenses against PM spam could be improved with a 'daily limit'. Click here for my strategy against PM spam (http://www.vbulletin.com/forum/showthread.php?p=1590647#post1590647).)
JMHO but I still don't see the sense in all of this wasted time in posting spammers. Just install "NoSpam (http://www.vbulletin.org/forum/showthread.php?t=124828)" as a plug-in and you're set to go as far as subjecting a registrant to a question(s). I went from an average of 6 to 14 or so a day and it stopped dead in it's tracks after I installed it and only entered in one very simple question although I believe you can enter more.
~Phil
A note to others: can this thread be limited to just Chinese spamborg users? Thanks.
Just seen associated with Chinese MMORPG spam on other sites:
gamelee
wwwzhudan
warren123
twelve2008
akgame
freegood
fff123r
bcde889
jeep1688
I ended up banning all of China and India since I have yet to get a honest member from those countries. Ever since I banned those 2 countries my spam has been down to 1 spammer a month. Before I was getting 3-5 new spammers a day.
alexwm1234
Email: javaalexme@gmail.com
IP Address: 218.104.68.244
Birthday (d-m-y): 1-1-1980
Timezone: 8
zhangfanfan001
Email: zhangfanfan001@gmail.com
IP Address: 125.71.130.65
Birthday (d-m-y): 1-1-1980
Timezone: 8
/PP
That's the nuclear option, which I don't advise using unless one is getting hit really hard.
Like I said, I don't ban Chinese IPs. I divert selected IPs away from register.php. This is my latest list. Of course, it can be uncommented and cut in half; down to 100 lines or so. EDIT: If you downloaded the attachment the first day I posted it, it included a Telstra IP block. I made some corrections since then, and re-uploaded the list.
If you're referring to the list in this thread, that list is unnecessarily long. Most of those subnets can be combined to larger ones resulting in a list only half as long but still containing the same information. Still - over 500 rows of ip-blocks in .htaccess is rather extreme...
/PP
Since this is a v3.7 forum I presume that you are using v.3.7+
- I downloaded nospam! plugin for 3.7+ (http://www.vbulletin.org/forum/showpost.php?p=1548655&postcount=765) and installed
- akismet plugin from vbulletin.org to detect spams by human / also try the new built-in akismet feature in 3.7
- turned off "Q & A Human Verification" and changed it to "Image verification".
- links not allowed to post for new members.
Just 2 cents.
Here's a copy of the username the spammer tried giving:
{cigarettecheap cigarettediscount cigarettemarlboro cigarettecamel cigarettecigarette storecigarette casesbuy cigaretteonline cigarettecigarette smokingcigarette couponcigarette smokenewport cigarettewholesale cigarette cigarette holdercigarette lightercigarette girlcigarette boataccessorie cell cheap cigarette phonebuy cigarette onlinecigarette pricescheapest cigarettedoral cigarettecigarette machinecheap cigarette onlinefree cigarette coupon coffee and cigarettemarlboro cigarette web siteclove cigarettecheap marlboro cigarettefirst cigarettewinston cigarettecamel cigarette web sitecigarette fag smokingsalem cigarettecigarette rolling machinekool cigarettedirt cheap cigarettecigarette cheapercigarette tobaccocigarette salewoman cigarettecigarette taxmarlboro cigarette couponbuy cheap cigaretteeffects of cigarette smokinglight cigarette cigarette brandcig cigarette smoker smokingfree cigarettecigarette adsleather cigarette casescandy cigarettecigarette ingredientromance and cigarettenewport cigarette coupondiscount cigarette onlineamerican spirit cigarettemarlboro cigarette official web sitecigarette filtercigarette packbasic cigarettedunhill cigarettecamel cigarette official web sitecigarette boxcigarette cartonduty free cigaretteseneca cigarettecigarette lighter adaptercheap newport cigarette quit smoking cigarettelucky strike cigaretteparliament cigarettebuy cheap cigarette onlinesmoking cigarette tobaccoingredient in cigarettein cigarettecigarette saleslong cigarettecigar cigarettegirl smoking cigarettecigarette paperscigarette cardtax free cigarette}
The IP address is 68.41.219.232
Errrr..... Can I just point something out...?
Seems as though no one is listening to what "K4L" has said! Posting a list of spammers is a bit absurd and, if nothing else, a lot of unnecessary work... Simply use [Q&A] human verification and put an end to it and spend time with other things... [The NoSpam hack (http://www.vbulletin.org/forum/showthread.php?t=124828) enables the use of both Q&A and Image Verification.]
All this means that a possible SpamBot has attempted a registration on your forum and has not been entirely successful. However, patt of the registration process HAS been successful, because a username has been logged -> see Paul M (http://www.vbulletin.org/forum/member.php?u=63698)'s Mod Track Guest Visits (http://www.vbulletin.org/forum/showthread.php?t=167278).
If you find it hard to see what relevance my gripe has with Spammers, then you should install the Mod Track Guest Visits (http://www.vbulletin.org/forum/showthread.php?t=167278) by Paul M (http://www.vbulletin.org/forum/member.php?u=63698), as it shows pages that have been viewed and by whom, primarily by IP address (so I can spot SearchEngine Bots). But, more to the point, the Track Guiest Visits mod shows what usernames have attempted to register through the registration page; this latter part is interesting, because it means the username that someone has tried registering with has been logged somewhere.
And, yes, before you go pointing out that the SpamBot has been unsuccessful, don't you thnk it a tad likely that the human equivalent can come back and finish the registration job off under the same username?
The best way to stop the attempted spamming is to do it at the registration process, so that the username is logged, and later that username can be placed into a moderation queue should a post be made. This will stop any posts being placed in any of your forums, and differs from any AntiSpam mod out there now in that the AntiSpam mods wait for a spam post to be made, and then they delete or whatever.
A lot of people have completely misunderstood the discussions I've posted about this subject, so here's two threads that bring it all to light:
http://www.vbulletin.com/forum/showthread.php?t=276686
http://www.vbulletin.com/forum/showthread.php?t=276709
The key here is to log and track all usernames, which vBulletin doesn't do, unless you're registered, hence you're a member. It won't take up any more space in your database than a single post (just look at the length of this one!) There would be a comparison against such a list of usernames made at re-registration (and possibly a notice shown and an alert to the Admin), or allowed to register and then moderated (useful for possible legitimate users).
Seriously, the only thing that I've found useful is the Track Guest Visits by Paul M, because it actually shows the username and IP address that has tried to register with my forum, whereas everything else doesn't. If a username that isn't registered on your forum can be shown on the Track Guest Visits page, then why can't these usernames be logged to a database and then tracked? For some reason, this doens't seem sensible to a lot of people (probably spammers).
Spammers /borgs do register and verify......... then they post spam.
Bots are easy to stop ,manual spammers are not.
Posting a list of spammers is a bit absurd and, if nothing else, a lot of unnecessary work. After all, trying to put up with spammers is a lot of work and is that what you're trying to avoid is it not?
I've had email verification for sometime so as not to let them in. It got to the point that they were quite easy to spot but at yet there were times of doubt as to someone being legitimate or not. Simply stop the idiots in their tracks and don't waste any more time trying to sort them out and waste valuable time making lists!
I was getting an average of 8 to 12 a day until I got sick of it!
Simply use human verification and put an end to it and spend time with other things. When I placed this in it stopped immediately!! Not ONE single spammer since I used this method. Either use the link "K4L" gave you or simply use this: http://www.vbulletin.com/forum/showthread.php?t=205214 or this: http://www.vbulletin.org/forum/showthread.php?t=124828
No more spammers……no more lists! End of it!!
~Phil
At the very least I strongly recommend you install this. It doesn't stop them all, but it stops a lot of them.
Thanks for that tip. Less than an hour after installing this it blocked the first spam bot.
I get around 10 people all signing up within minutes. All different names, emails. All real estate related. My forum is about motorsports in San Diego... not real estate in Virginia. The only thing that seems to be the motivation is that they all have sigs with real estate urls.
I deleted all of them, 2 days later 10 new ones.
check out their IP's and email registrars you might find a similarity if they are coming from same location
221.221.12.102
seems to be pretty much content just sitting there banned.
worthtosee
117.26.202.197
worthtosee @ 163.com
Email - greettt@gmail.com
IP - 125.82.22.46
Time Zone - +8 Beijing (Surprise surprise)
Had 3 of these so far and just deleted them. God knows how they found my site as it's not even been submitted to the search engines yet coz I'm still working on it :confused:
Our public forums have been hit by 70 spam accounts from 2/08 - 17/08 today! 35 accounts per week!
I forced a sign up field (Additional Required Information - profile) and the spam bots have fallen for it and keep using the same name in the field!!! Thus this is a good reason to force the bots to use so you can get an idea who is signing up and if it’s genuine. As a result I am certain it’s the same bot / human signing up as the required field is the same every time!
Image Verification... I have tried all three and all don’t seem to stop them from registering.
Can’t we have a random sign up URL after the Image Verification and drop down boxes to answer a maths question? Then a 2nd Image Verification option after the random sign up URL? If the maths question is wrong force a new start up!
Great site: http://www.stopforumspam.com/downloads/ (http://www.stopforumspam.com/downloads/)
Here are some of the sign up accounts:
bifikoza
Email Address : misha007@terbuny.net
Birthday : August 25, 1988
IP Address: 74.50.108.111
Powerhorse
Email Address : alfa-de-villa@ua-news.net
Birthday : March 27, 1960
IP Address: 66.232.114.56
Mifikko
Email Address : minerals@rupr.org
Birthday : September 19, 1967
IP Address: 74.50.108.219
muyinoa
Email Address : muyinoa@gmail.com
Birthday : October 12, 1960
IP Address: 222.74.200.2
browsing address: 2.200.74.222.broad.hh.nm.dynamic.163data.com.cn
pataagusata
Email Address : pataagusata@greatfreemail.net
Birthday : February 26, 1971
IP Address: 78.157.143.212
LagkawCeask
Email Address : juioluil@gmail.com
Birthday : April 19, 1969
IP Address: 92.48.127.93
benderkoz
Email Address : benderkoz@gmail.com
Birthday : June 21, 1986
IP Address: 87.236.29.207
germibv
Email Address : germibv@gmail.com
Birthday : February 17, 1978
IP Address: 68.230.44.234
bymnOppotoror
Email Address : nempoesywew@bimgir.net
Birthday : October 13, 1983
IP Address: 70.168.2.5
freevideom
Email Address : freevideom@mail.ru
Birthday : January 9, 1980
IP Address: 72.36.132.226
oveseeTootrum
Email Address : sdthrhtrj@gmail.com
Birthday : June 23, 1982
IP Address: 92.48.127.93
sernivaz
Email Address : sernivaz@gmail.com
Birthday : May 28, 1976
IP Address: 24.63.222.23
chunpula
Email Address : chunpula@gmail.com
Birthday : October 3, 1988
IP Address: 89.136.133.67
kekphefly
Email Address : noviidor@mail.ru
Birthday : January 28, 1979
IP Address: 195.188.174.182
Nearreonoum
Email Address : zextneurece@xsecurity.org
Birthday : May 15, 1974
IP Address: 91.121.95.104
BuyCheapest
Email Address : viagra-cheapest@your-best-holiday.info
Birthday : June 19, 1981
IP Address: 200.63.42.147
hamnigam
Email Address : hamnigam@gmail.com
Birthday : February 21, 1960
IP Address: 216.9.106.147
guehoutbath
Email Address : rtgdrghhrth@gmail.com
Birthday : July 9, 1967
IP Address: 92.48.127.93
EVEXTTUMEXCAT
Email Address : advodaexabete@gmail.com
Birthday : July 15, 1973
IP Address: 200.63.42.107
Joymnallemolo
Email Address : stoxdoomb@gmail.com
Birthday : February 17, 1968
IP Address: 200.63.42.71
EVEXTTUMEXCAT
Email Address : advodaexabete@gmail.com
Birthday : April 19, 1984
IP Address: 200.63.42.107
dedAppobresew
Email Address : playncunacy@gmail.com
Birthday : February 21, 1974
IP Address: 200.63.42.105
kinokitla
Email Address : kinokitla@gmail.com
Birthday : October 12, 1971
IP Address: 83.141.213.197
Nearreonoum
Email Address : zextneurece@xsecurity.org
Birthday : May 15, 1974
IP Address: 165.193.47.4
bervedas
Email Address : bervedas@gmail.com
Birthday : September 8, 1981
IP Address: 64.69.36.205
TulpSueld
Email Address : asfgsdfh@gmail.com
Birthday : October 8, 1964
IP Address: 200.63.42.105
cogpadicill
Email Address : deragaz@gmail.com
Birthday : July 6, 1975
IP Address: 92.114.187.20
maeijuh
Email Address : maeijuh@gmail.com
Birthday : October 6, 1962
IP Address: 98.161.6.246
Lapysapsefs
Email Address : zexorbire@gawab.com
Birthday : October 14, 1961
IP Address: 85.255.120.58
ademansderty
Email Address : ade@worldmp3songs.com
Birthday : August 11, 1966
IP Address: 193.164.132.17
polinapus
Email Address : polinapus@gmail.com
Birthday : August 13, 1985
IP Address: 92.48.112.74
lominerad
Email Address : lominerad@gmail.com
Birthday : October 12, 1962
IP Address: 63.199.245.151
bigroda
Email Address : bigroda@gmail.com
Birthday : April 3, 1961
IP Address: 92.48.112.74
dedugan234
Email Address : kuartova@ukr.net
Birthday : April 25, 1982
IP Address: 92.113.29.168
labudash
Email Address : labudash@gmail.com
Birthday : June 5, 1965
IP Address: 87.236.29.207
GydayTainvawn
Email Address : dokmdall@gmail.com
Birthday : September 6, 1961
IP Address: 89.41.71.85
DoctorMensentDornt
Email Address : doctormens@mail.ru
Birthday : October 11, 1979
IP Address: 87.118.96.94
mwerima
Email Address : mwerima@gmail.com
Birthday : June 1, 1981
IP Address: 209.254.236.210
derimna
Email Address : derimna@gmail.com
Birthday : October 20, 1965
IP Address: 81.203.169.89
enazitarefteric
Email Address : remyimichehow@metaping.com
Birthday : September 6, 1961
IP Address: 78.157.143.211
yaskazala
Email Address : yaskazala@gmail.com
Birthday : May 21, 1987
IP Address: 85.86.146.119
chichapa
Email Address : chichapa@gmail.com
Birthday : June 21, 1977
IP Address: 76.172.118.92
solovekaaqw
Email Address : mail@worldmp3songs.com
Birthday : September 13, 1985
IP Address: 193.164.132.17
FogincBiorn
Email Address : pochta5@honent.ru
Birthday : April 4, 1965
IP Address: 93.80.245.131
Keegan Skky
Email Address : xxxspicegirls@mail.ru
Birthday : June 3, 1960
IP Address: 91.77.6.60
prosoxa
Email Address : prosoxa@gmail.com
Birthday : September 8, 1983
IP Address: 211.178.32.231
liaggrailikek
Email Address : stepbystepik@mail.ru
Birthday : February 18, 1970
IP Address: 92.48.84.208
sukecal
Email Address : sukecal@gmail.com
Birthday : March 18, 1967
IP Address: 74.192.85.240
xxlmegasex
Email Address : drehopxxl@googlemail.com
Birthday : June 15, 1976
IP Address: 68.9.119.52
Rathovezeta
Email Address : nedgeunelebog@mainru.com
Birthday : February 23, 1971
IP Address: 70.189.2.152
dernima
Email Address : dernima@gmail.com
Birthday : January 19, 1970
IP Address: 69.116.22.240
Vidaluxa
Email Address : internationalp@gawab.com
Birthday : June 11, 1974
IP Address: 69.46.28.225
Faruhabib
Email Address : kumar.habib@gawab.com
Birthday : March 28, 1982
IP Address: 74.50.99.140
chinchinat
Email Address : chinchinat@gmail.com
Birthday : August 28, 1967
IP Address: 97.85.145.34
Veneciano
Email Address : milanot@gawab.com
Birthday : August 5, 1966
IP Address: 66.232.114.56
Megustas
Email Address : bumbarash@gawab.com
Birthday : September 2, 1975
IP Address: 206.51.229.102
solovekazs
Email Address : 777@worldmp3songs.com
Birthday : April 28, 1975
IP Address: 193.164.132.1
nicesitess
Email Address : leonardcooper62@yahoo.co.uk
Birthday : April 25, 1981
IP Address: 92.48.127.90
jkkjkjjfhyaasass
Email Address : 23derrick723@gmail.com
Birthday : June 4, 1986
IP Address: 72.241.88.30
cimuren
Email Address : cimuren@gmail.com
Birthday : October 23, 1966
IP Address: 65.29.124.75
fluenibeimb
Email Address : evilkildvug@mail.ru
Birthday : August 27, 1986
IP Address: 93.80.160.174
!abcodygz
Email Address : joddy@ringrate.com
Birthday : August 20, 1962
IP Address: 84.16.252.77
weopima
Email Address : weopima@gmail.com
Birthday : June 21, 1988
IP Address: 61.40.48.15
etibasa
Email Address : etibasa@gmail.com
Birthday : March 25, 1978
IP Address: 189.47.170.203
serniuma
Email Address : serniuma@gmail.com
Birthday : January 6, 1967
IP Address: 24.99.29.117
trevosemtree
Email Address : trevosemtree@greatfreemail.com
Birthday : April 25, 1960
IP Address: 195.245.119.76
Britney Speers
Email Address : xxxspicegirls@mail.ru
Birthday : January 9, 1965
IP Address: 91.77.225.132
dazvenginzks
Email Address : coothewhomoo@gmail.com
Birthday : May 4, 1973
IP Address: 12.192.82.59
Reynold78
Email Address : acilliozzy@mymail-in.net
Birthday : September 4, 1960
IP Address: 72.9.99.34
TimEricsson
Email Address : tim@drugshome.org
Birthday : August 11, 1976
IP Address: 190.10.18.118
"Global" was his username, posted two iphone ads.
122.234.54.127
Try my method. It has stopped for me.
http://www.vbulletin.com/forum/showpost.php?p=1585600&postcount=18
Don't you think it would be easier if all users that fail the CAPTCHA process at registration time were marked as SPAMMERS, and then all their posts placed into a moderated queue, until removed from the SPAMMER list?Maybe it's too early in the morning for me to understand,
but if a registration fails because of CAPTCHA, didn't CAPTCHA do it's job?
I can't tell you how many times I fail and need to re-enter the image when I register on sites.
Can this thread be limited to just Chinese spamborg users?
I agree that we do not want to list spam from real people who also post discussion messages, i.e., people who are at least competent to be real forum members. However I think we do not need to worry about spam from traditional bots, because I do not think they are getting through Image Verification.
My idea is to list anything that gets through Image Verification that is evidently a spamborg. Maybe they are all Chinese but I am not following that assumption. As CYBURBIA has pointed out, these are software-assisted humans. These are not, for example, webhosts who advertise in the non-advertising subforums. They don't start new threads. They don't pick relevant threads that might be seen by potential customers. They obviously don't even understand what they are posting. Obvious and pointless spam is all that they do. This is why I can verify them by Googling for +"Total Posts 0"--and 12 or more Google results indicates a probable spamborg.
The reason for this thread is that these spamborgs are like antibiotic-resistant viruses. They can not be stopped with automatic software. It might not even be the best strategy to stop them. If you could automatically recognize them and prevent them from entry, then they can just retry with a different name or whatever. It may be better to allow them to join, then quarantine them to some invisible subforum. There they can leave their dirt, without messing up your real forum. However for the time being I am just banning them.
My own forum is new, will not be officially open for about 6 months. (I am busy working on related websites.) My forum has only 3 real members, and disallows numbers in usernames. Therefore, my forum is like a testing laboratory. I use standard Image Verification, not Recapcha, and there is no reason to advertise in my forums. Traditional Bots are not getting through in my forum, and perhaps not even trying. Yet the spamborgs are coming. So, perhaps you can even determine how often a new spamborg is created from how often I post in this thread. I am hoping they will peter out from timely banning. But if not, then I will experiment with a quarantine.
( :rolleyes: If the puppetmasters of all this spam were a bit more clever, they could easily find ways to post effective signature ads in major forums, that would not even be detected as spam! But it seems that all this is like just another game to them. They seem to be the result of a Western-invented Computer Mom upbringing, combined with an Eastern-invented post-communist survivalism. I.e., the East and the West have met and the result is not exactly Tai Chi. These are real-life teenage mutants, who are not even human enough to understand what a 'discussion forum' is about.)
Suggestion: Keep the list of usernames updated in the first post, so people can copy and paste one list. :)
There may be a time limit for editing the first post. Also I might not get to it sometimes. So...
Here is a complete list of all spamborgs posted here so far.
Anyone: if your browser shows a new page and nobody has yet posted a total list, feel free to do so.
Please use the size=1 VB code for the smallest font size for this list.
Maintain alphabetical order please.
akgame
alexwm1234
bcde889
beijmanli
bobo891x11
coinnetnet
defg070
fff123r
freegood
gamelee
lkky00245
jeep1688
jklm292, jklm160
joshbob
KaiyreBoy
KevinFlys
lovebeijgo
lovemaryii
loveumaryoo
LRTIMKEN
Pereftiyo
socanvz
Springbirdoo
tonilovekelly
twelve2008
warren123
weiwei
wowgold2008, wowgold1000
wwwzhudan
zhangfanfan001
Last night Google could not find this name.
http://www.google.com.au/search?hl=en&q=bobo891x11&btnG=Google+Search&meta=
http://www.vbulletin.org/forum/showthread.php?t=135094
Off-topic: I've got that plugin installed. It's actually based on a concept I posted a while back, but couldn't code. I noticed that xrumer (a Russian spam bot) would hammer register.php four or five times in rapid succession; far faster than a human could possibly complete the registration form.
The Chinese borgs are getting through register.php on the first try, without retries. I had custom fonts used for the captcha, and they still got through on the first try. This tells me that part of the registration process (decoding the captcha) is done by a human that is somewhat familiar with the Roman alphabet, while the rest (filling in the profile fields) is done by a script. If the new captcha and recaptcha were truly broken, we'd be seeing a lot more than just MMORPG spam from China.
My moderately-successful "Great Wall" has been:
1) In .htaccess, redirecting trouble-prone Chinese IPs to a placeholder page. This blocks about 90% of them. I add new blocks to .htaccess on a regular basis. Do a search for user to find details about how I do this.
2) Blocking certain free email addresses. Blocks a bunch more.
3) MonkeyStop Keyword and URL Moderation plugin and a good list of keywords. For the few that register, this mod directs their posts to the mod queue.
I have legit Chinese users, so this allows them to view the board, but keeps spambots from registering; legit users from China are directed to send me email if they want to join. For those with no legit Chinese users, there's the nuclear option; blocking the entire country through .htaccess.
Back on topic. FWIW, I've noticed that most of the IPs have been from Chinanet provincial network blocks.
akgame
alexwm1234
bcde889
beijmanli
bobo891x11
coinnetnet
crack
defg070
fff123r
freegood
gamelee
lkky00245
jeep1688
jklm292, jklm160
joshbob
KaiyreBoy
KevinFlys
lovebeijgo
lovemaryii
loveumaryoo
LRTIMKEN
ok0510
Pereftiyo
qrst747
socanvz
Spetertoi
Springbirdoo
stuv021
tonilovekelly
twelve2008
warren123
weiwei
wowgold2008, wowgold1000
wwwzhudan
zhangfanfan001
Email : baifeng79110@gmail.com
IP Address : 216.108.229.68
Time Zone : (GMT+8) Beijing,Perth
qrst747
60.175.220.137
efgh433/ gangannilao@21cn.com/ 60.166.122.121
callbbryant/benwalec@gmail.com/121.204.36.130
stuv564/wiuhetgdd@21cn.com/60.166.107.13
bro4golds/dellusa@21cn.com/60.166.109.250
BaBeBiLaaaa/a182402666@gmail.com/123.131.108.173
stuv021
221.200.211.135
I found 18 memberships with 0 posts by googling:
Springbirdoo +"Total Posts 0"
AND I found 2 bans by googling:
"Springbirdoo is offline" +Banned
P.S. I also found Springbirdoo listed at StopForumSpam.com (http://www.stopforumspam.com/country/cn)
Caution: to confirm 2 bans, right-click on the Google listing and 'open in new tab'. For example, here are some Google results that are not Ban listings:
Registered Today : 2. This Hour: 0. This Month: 29. Total: 436. Banned: 0 ...
BANNED !!! bilboyfrodo. View Public Profile .... Springbirdoo
... French President Albert Lebrun immediately banned all future public executions. .... Welcome to our newest 5 members, mnop584, Springbirdoo ...
loveumaryoo
wowgold2008
tonilovekelly
lkky00245
Caught them before they could spam. All are from Chinese IPs. (On my site, they also enter the word "Array" into custom profile fields.)
FWIW, the word "love" is far more common in the usernames of my legitimate Chinese users than those from English-speaking countries. My advice: if you get a user with "love" in the username, or certain keywords related to MMORPGs (wow, warcraft, power, level, gold, coin, rune, etc), investigate.
http://www.vbulletin.org/forum/showthread.php?p=1548655#post1548655
Question to those still getting hit hard with spam: do you have any MMORPG spamborgs that are not in a Chinanet, CNC Group (also Chinanet), Oriental Cable, China Education and Research Network or Beijing Education Information Network IP block?
Basically, if I divert every Chinese IP block in .htaccess, the IP list would be unbelievably long. If i get the biggies listed above, which comprise about 95% of the country's IP space -- and from what I've seen so far, all of the spamborg sources -- the list would be much, much shorter.
(FWIW, I don't blacklist Chinese IP blocks, because I have many legit users in the PRC. I'm diverting visits to register.php from certain IP blocks to a placeholder page, which ask those who are interested in joining the message board to send me an email with pertinent details.)
No new spammers or, no new accounts! One is not the other! lol
For me the "question" upon registering has seemed to stop the spammers cold albeit there might be the occasional human assisted spammer that might possibly wiggle in but even then they don't seem to want to take the time or effort to answer the question. Hey....whatever works to keep the creeps out of ones site!
~Phil ;)
Emails / awoomo44@yahoo.com : awomobilesss1@hotmail.com
DOB / September 5, 1970 (37)
IP address 72.3.137.82
http://www.google.com/search?client=opera&rls=en&q=iphone27&sourceid=opera&ie=utf-8&oe=utf-8
jklm292
joshbob
KaiyreBoy
KevinFlys
lovebeijgo
lovemaryii
Pereftiyo
weiwei
lol, I know all of them:D
Will submit, when will have a free time;)
uf9p9o@gmail.com
jan 1. 1980
222.183.131.90
Went right to modifying signature right after registration.
Lovingttu
email: ccc32o@gmail.com
b'day: Jan 1 '80
IP: 222.183.121.112
Timezone: Beijing
same
I have picked up several members with out valid email as well.
LRTIMKEN
email: liushuai3366@sina.com
b'day: Jan 1 '80
IP: 221.201.208.86
Timezone: Beijing
Lovingttu
email: ccc32o@gmail.com
b'day: Jan 1 '80
IP: 222.183.121.112
Timezone: Beijing
I think the spamborg problem may be solved by upgrading to Vbulletin 3.7. (As I said in an edit of my last message.) With creative use of the new Q&A verification system...
Seems as though no one is listening to what "K4L" has said! Posting a list of spammers is a bit absurd and, if nothing else, a lot of unnecessary work... Simply use [Q&A] human verification and put an end to it and spend time with other things... [The NoSpam hack (http://www.vbulletin.org/forum/showthread.php?t=124828) enables the use of both Q&A and Image Verification.]
:D Thank you PHIL for supporting, with your direct experiece, what I surmised myself, and also the benefits of the NoSpam system. I personally suspect it is more friendly for real members to use just the questions, as available in Vbulletin 3.7, and it's not necessary to mix questions with pictures as is possible with NoSpam. But time will tell. Meanwhile, for those who feel inclined to make this spamborg list, it is a nice little reference and there is no telling how this may help to refine our future strategies.
:D Evidently, the new Vbulletin Q&A feature was inspired by NoSpam. Which is the ultimate kudo for a hack, to be made a standard feature. However as PHIL has also said, NoSpam still has greater versatility and is evidently quite stable.
:D I just banned Easyforpp: 36 profiles with "total posts 0", 2 previous bans, listed in StopForumSpam.com, and also in this thread 2 days ago. I believe this says 2 things.
PHIL is right, listing and banning does not slow down the spamborgs. They are now definately coming faster if anything. One of my reasons for starting this thread was to find this out and it is now found out.
But RIDERBOOK is not quite right. These spamborgs are so far not so intelligent as not to reuse their usernames. (Except of course to the extent that probably only a few people are responsible for our entire spamborg list. Maybe even just 1 wiseacre.)
;) Please note that this thread is about spamborgs who are as unlike traditional spammers as a suicide 911 hijacking is unlike the traditional hijackers who wanted to land somewhere such as Cuba, etc. The spamborgs are more of a potential problem for more forums because they are without rhyme or reason. But by the same token their bag of tricks is limited. Hopefully PHIL is right and with Q&A we will be rid of this phenomena.
41.209.165.39
141.84.28.20 a020.lmu.vpn.lrz-muenchen.de 72.187.141.211 74.6.18.218 125.234.112.239 .adsl.viettel.vn 222.252.219.114 141.84.23.130 74.6* 74.6.18 74.6.18*
Googled the name, and found Italian WoW gold farming spam associated with it.
At the very least I strongly recommend you install this. It doesn't stop them all, but it stops a lot of them.
qrst436
Email: goldsmaker@gmail.com
IP Address: 59.56.7.82
Birthday (d-m-y): 1-1-1980
Timezone: 8
stuv454
Email: bbsone@pc136.com
IP Address: 60.171.227.0
Birthday (d-m-y): 1-1-1980
Timezone: 8
Hopefully PHIL is right and with Q&A we will be rid of this phenomena.
Well, all I can say on my part/experience thus far is this.
I was getting an average of 8 to 14 spammers a day and it seemed to be snow balling out of hand! Since I implemented the question and then later, the question with the image verification of "NoSpam" I've not had a single one since! That is well over one month now with not even one spammer!
As I said before I'm confident that there will indeed be the occasional one who may slip through the crack but I think I can handle one every few months rather than what I was going through before every singe damn day! It's now a pleasure to turn on the computer each morning rather than the dread I had before knowing I would have to deal with a crap load of moron spammers!
~Phil :)
Posting a list of spammers is a bit absurd and, if nothing else, a lot of unnecessary work. After all, trying to put up with spammers is a lot of work and is that what you're trying to avoid is it not?
I've had email verification for sometime so as not to let them in. It got to the point that they were quite easy to spot but at yet there were times of doubt as to someone being legitimate or not. Simply stop the idiots in their tracks and don't waste any more time trying to sort them out and waste valuable time making lists!
I was getting an average of 8 to 12 a day until I got sick of it!
Simply use human verification and put an end to it and spend time with other things. When I placed this in it stopped immediately!! Not ONE single spammer since I used this method. Either use the link "K4L" gave you or simply use this: http://www.vbulletin.com/forum/showthread.php?t=205214 or this: http://www.vbulletin.org/forum/showthread.php?t=124828
No more spammers厖no more lists! End of it!!
~Phil
this is pretty good suggestion but you don't expect all spammers to be wierd there will be some clever and.... spammers around so itz not of 100% guarantee and personally changing text is highly impossible for some of the busy admins around
Don't you think it would be easier if all users that fail the CAPTCHA process at registration time were marked as SPAMMERS, and then all their posts placed into a moderated queue, until removed from the SPAMMER list?
An automatic system that marks unsuccessful registrations (ie, BOTs that fail the CAPTCHA image) would save you having to chase SPAMMERS and their posts through your own boards.
To prove how successful an automatic SpamMarking system would be in stopping spam on your board, simply register yourself on your own board. Take note:
that you have to provide a username to register with;
when you fail the CAPTCHA image, you are doing exactly what the BOTs do;
every part of your registration process can be logged, but isn't!
The method of creating a list of usernames is helpful, just so long as the list doesn't get too long, becuase the Admins will have to check each name on their own boards against the names in this Spammer Username list.
An automatic Spammer Marking system would be more effective in prevention.
This thread --> http://www.vbulletin.com/forum/showthread.php?t=276686 <-- marks out the system that I am, and I believe everyone else will be, after.... but, if you're going to read it, please remember that it is not asking for a list of usernames, nor is it providing a means to code your own boards. This thread is asking for instructions on how to create, or for someone to do the job of creating a system (a MOD, or a way of editing templates) that moves new registrations that fail the CAPTCHA image recognition procedure at registration time into a moderated queue, and then for usernames in this moderated queue to be flagged whenever a post appears under that username.
I think it should already be a part of the vBulletin system, anyway, but that's my own opinion.
socanvz
email: cavanza@21cn.com
ip: 218.6.9.101
birthday: Jan 1 1980
timezone: +8 Beijing
do yourself a favor and under USER BANNING in the ADMINCP
ban the email address @21cn.com
i have had well over 10 registrations from that domain in 1 week!
all with random usernames.
email xiaotiansmile@163.com
username xiaotiansmile
net range 60.166.0.0 - 60.175.255.255
#If you have any other info about this subject , Please add it free.# |