Jump to content
Sign in to follow this  
Lking

Latest Dumb spam

Recommended Posts

In this morning's batch of comment spam on one of my forums I found the following. The extortion was posted by two users. This format is the output of a my utility that scrapes the phpBB data base to find all the new post needing review. If I think it is comment spam, with one click I report it to StopFormSpam and knujon.

Username: SpamStopcred
User email: vladik_3x{AT}mail.ru
and
Username: StopSpamtig
User email: seiky-kun{AT}mail.ru
User IP: 62.210.124.236

(Project Honey Pot query)
Results: 3 days 39 score Suspicious Comment Spammer 62.210.124.236

number of Post: 1
Profile website:
SUBJECT: forum administrator.
TEXT: Dear site administrator ,
you are in my base spam forums that would keep your site from spam you need to transfer to my account 10 $ , and you will not get spam advertising messages on your forum!
payment requisites: PayPal.com - stopspamscript[at]gmail.com
After your payment in the amount of 10 $ you need to write the address of your site and send it to my e-mail: stopspamscript{AT}gmail.com and I will remove your site from its list of spam advertising messages on your forum .
All important questions you can send me on my e-mail: stopspamscript{AT}gmail.com

Share this post


Link to post
Share on other sites

Priceless - spamkiller spam served with a straight face/no evident conception of irony.

That user-registration e-mail domain was the first ever banned on these forums, back in early 2006. With the evolution of spammer methods (and of counter-spam resources to match) we should probably reconsider that restriction for this forum. Can't see that the domain is currently particularly "toxic", whatever the situation might have been more than eight years ago. Anyway, it is possibly better to allow instances of spam and remove/keep it from public view so to authoritatively report the perpetrators' credentials for subsequent alerts to the wider internet community about current spam "campaigns" (exactly as you have done). That would/should be more effective in limiting the (supposed) profits of spam and its proliferation than will simple denial on an individual, isolated forum/bulletin board basis.

Will consider ...

Share this post


Link to post
Share on other sites

That IP, 62.210.124.236, has a long history with SFS. The threat score of 39 from Project Honey Pot with activity in the last 3 days does indicate he is currently active.

Share this post


Link to post
Share on other sites

Different forums, different fleas. That IP address (iliad-entreprises.fr/poneytelecom.eu) not banned "here", no cause - well, probable cause maybe - but the registration e-mail domain (once) a different matter.

Latest IP banned "here" (an IP address range) is 193.201.224.0/24 (193.201.224.*), part of Alpha-Telecom-NET (UA), due to continuing use by a reputed spammer - and no regular members (just 1/27 unbanned and that "he" is a 'known spammer' as well) - using a variety of aliases and credentials, ever since the last implementation of this forum. That one likes to register with an account from any of the major free e-mail providers and seems to be into scraping this board, not spamming it as such (so no reportable activity here).

In time he will go away/find new proxies and I can lift the restriction. Or maybe not - it is a spectacularly abused range, the owners must be complicit or dead. But goodness knows what exactly that spammer/associate has been doing here and why for the past several months (collecting the phoney backlink stats that SEO agencies use to bill their clueless clients, maybe?) but frustrating the ungodly is a duty gladly undertaken by the ... erm ... not so ungodly :)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×