You are not logged in.
Half of my spam registrations come from this IP (78.129.195.105) And, personally, i'm just waiting for him to stop. I havn't banned the IP though because i'm quite intrigued by his spamming pattern. Today i got about 10 spam registrations from that IP and (luckily) the anti-spam ACP caught them when they went to post URLs 
And seeing as my site has 33 registered members, that's a hell of a lot of spam.
The more confusing thing is, he uses a nonsense name, and uses a nonsense email adress, making it almost impossible to detect patterns in this spammer, apart from the fact they ALL come from the same IP... The thing is, i've never met a nonsense spam username before. At least some of them had original usernames like enambanis etc. but's it's quite depressing to see Vywzukdk in the spam log when i log in...
And his spam isn't even spammer-cliché content. Lawyers, banks, games sites, supernatural, i've had it all from this one IP.
I think we have a unique bot here.
Anyone else encountered this spammer?
Offline
Do you have email verification enabled?
Offline
pedigree wrote:
Do you have email verification enabled?
No, because my host's email servers run like sloths
Offline
Suprise suprise ....... tis our friends at RapidSwitch (I hate these feckers!);
inetnum: 78.129.195.0 - 78.129.195.255 netname: EUKHOST-26 descr: EUKHOST_Ltd country: GB admin-c: RK3101-RIPE tech-c: RK3101-RIPE status: ASSIGNED PA mnt-by: RAPIDSWITCH-MNT source: RIPE # Filtered person: Robert King address: EUKHOST Ltd address: 24 Clarence Street address: Bowburn, address: Durham, address: DH6 5BB address: England, UK phone: +44 (0)7753 341080 e-mail: sales@eukhost.com nic-hdl: RK3101-RIPE mnt-by: RAPIDSWITCH-MNT source: RIPE # Filtered % Information related to '78.129.128.0/17AS29131' route: 78.129.128.0/17 descr: RapidSwitch Ltd origin: AS29131 mnt-by: RAPIDSWITCH-MNT source: RIPE # Filtered
I argued with them myself recently due to one of their customers hosting an Opera (hxxp://www.operasoft.info/uk/) and IE (hxxp://www.i-explorer.info/uk/) scam site (amongst others). With the help of Opera, we had the Opera scam site shut down, but the others remain online and active unfortunately 
http://hosts-file.net/misc/operasoft_in … t_info.gif
http://hosts-file.net/misc/operasoft_in … ll_com.gif
http://hosts-file.net/misc/operasoft_in … r_info.gif
http://hosts-file.net/misc/operasoft_in … t_info.gif
Ticket I posted to their system ....;
https://myservers.rapidswitch.com/Abuse … rrgvsfteml
There's a lot more to it, but thats the basics of it ...... RapidSwitch are also currently involved in hosting malware. I can't post ref's for this atm as the only info is posted in staff forums, not public one's.
Offline
the123king wrote:
Anyone else encountered this spammer?
Yup, 2 registrations on our forum today....so far....
Offline
the123king wrote:
The thing is, i've never met a nonsense spam username before.
You haven't? That's how I spot them at a glance most of the time. Here's some of the ones we've had...
rtegdgfdhtr
przwae
urmntwkso
ghjksjkadasssaaa
ooystmoly
Then we got ones like this...
mntwksour
sourmntwk
And...
yolystoom
stoomyoly
Do they really think we don't notice idiotic stuff like that? I mean it's a dead giveaway... Even your average run of the mill forum trolls don't pick stupid names like that.
Offline
Usevammanom
zeweedype
TrireSahanene
greageunson
HepeDeart
Roamreato
Thay all make sense, even if they have no meaning.
Last edited by the123king (2008-04-25 1:39 pm)
Offline
