78.129.195.105 - GAH!

the123king · 2008-04-23 3:39 pm

Half of my spam registrations come from this IP (78.129.195.105) And, personally, i'm just waiting for him to stop. I havn't banned the IP though because i'm quite intrigued by his spamming pattern. Today i got about 10 spam registrations from that IP and (luckily) the anti-spam ACP caught them when they went to post URLs And seeing as my site has 33 registered members, that's a hell of a lot of spam.

The more confusing thing is, he uses a nonsense name, and uses a nonsense email adress, making it almost impossible to detect patterns in this spammer, apart from the fact they ALL come from the same IP... The thing is, i've never met a nonsense spam username before. At least some of them had original usernames like enambanis etc. but's it's quite depressing to see Vywzukdk in the spam log when i log in...

And his spam isn't even spammer-cliché content. Lawyers, banks, games sites, supernatural, i've had it all from this one IP.

I think we have a unique bot here.

Anyone else encountered this spammer?

pedigree · 2008-04-23 4:35 pm

Do you have email verification enabled?

the123king · 2008-04-23 4:51 pm

pedigree wrote:

Do you have email verification enabled?

No, because my host's email servers run like sloths

MysteryFCM · 2008-04-23 5:58 pm

Suprise suprise ....... tis our friends at RapidSwitch (I hate these feckers!);

inetnum: 78.129.195.0 - 78.129.195.255
netname: EUKHOST-26
descr: EUKHOST_Ltd
country: GB
admin-c: RK3101-RIPE
tech-c: RK3101-RIPE
status: ASSIGNED PA
mnt-by: RAPIDSWITCH-MNT
source: RIPE # Filtered

person: Robert King
address: EUKHOST Ltd
address: 24 Clarence Street
address: Bowburn,
address: Durham,
address: DH6 5BB
address: England, UK
phone: +44 (0)7753 341080
e-mail: sales@eukhost.com
nic-hdl: RK3101-RIPE
mnt-by: RAPIDSWITCH-MNT
source: RIPE # Filtered

% Information related to '78.129.128.0/17AS29131'

route: 78.129.128.0/17
descr: RapidSwitch Ltd
origin: AS29131
mnt-by: RAPIDSWITCH-MNT
source: RIPE # Filtered

I argued with them myself recently due to one of their customers hosting an Opera (hxxp://www.operasoft.info/uk/) and IE (hxxp://www.i-explorer.info/uk/) scam site (amongst others). With the help of Opera, we had the Opera scam site shut down, but the others remain online and active unfortunately

http://hosts-file.net/misc/operasoft_in … t_info.gif
http://hosts-file.net/misc/operasoft_in … ll_com.gif
http://hosts-file.net/misc/operasoft_in … r_info.gif
http://hosts-file.net/misc/operasoft_in … t_info.gif

Ticket I posted to their system ....;

https://myservers.rapidswitch.com/Abuse … rrgvsfteml

There's a lot more to it, but thats the basics of it ...... RapidSwitch are also currently involved in hosting malware. I can't post ref's for this atm as the only info is posted in staff forums, not public one's.

Ramrod · 2008-04-24 6:10 pm

the123king wrote:

Anyone else encountered this spammer?

Yup, 2 registrations on our forum today....so far....

Ax Slinger · 2008-04-24 9:03 pm

the123king wrote:

The thing is, i've never met a nonsense spam username before.

You haven't? That's how I spot them at a glance most of the time. Here's some of the ones we've had...

rtegdgfdhtr
przwae
urmntwkso
ghjksjkadasssaaa
ooystmoly

Then we got ones like this...

mntwksour
sourmntwk

And...

yolystoom
stoomyoly

Do they really think we don't notice idiotic stuff like that? I mean it's a dead giveaway... Even your average run of the mill forum trolls don't pick stupid names like that.

the123king · 2008-04-25 5:39 pm

Usevammanom
zeweedype
TrireSahanene
greageunson
HepeDeart
Roamreato

Thay all make sense, even if they have no meaning.

Last edited by the123king (2008-04-25 5:39 pm)

#1 2008-04-23 3:39 pm

78.129.195.105 - GAH!

#2 2008-04-23 4:35 pm

Re: 78.129.195.105 - GAH!

#3 2008-04-23 4:51 pm

Re: 78.129.195.105 - GAH!

#4 2008-04-23 5:58 pm

Re: 78.129.195.105 - GAH!

#5 2008-04-24 6:10 pm

Re: 78.129.195.105 - GAH!

#6 2008-04-24 9:03 pm

Re: 78.129.195.105 - GAH!

#7 2008-04-25 5:39 pm

Re: 78.129.195.105 - GAH!

Board footer