Lemmings Forums

Site Boards => Site Discussion => Topic started by: MC Marshy on February 05, 2006, 10:44:22 AM

Title: SPAM ALERT!
Post by: MC Marshy on February 05, 2006, 10:44:22 AM
Somebody keeps on spamming this forum. It happened a few days ago but it's happening again today. What is happening?  :o

http://forum.lemmingswelt.de/cgi-bin/yabb2/YaBB.pl?num=1089129620/870#870
http://forum.lemmingswelt.de/cgi-bin/yabb2/YaBB.pl?num=1089136533/555#555
http://forum.lemmingswelt.de/cgi-bin/yabb2/YaBB.pl?num=1109817901

These 3 topics have been spammed.
Title: Re: SPAM ALERT!
Post by: Lomay on February 05, 2006, 11:28:27 AM
Quote from: MC Marshy link=1139136262/0#0 date=1139136262
Somebody keeps on spamming this forum. It happened a few days ago but it's happening again today. What is happening? &#A0;:o

http://forum.lemmingswelt.de/cgi-bin/yabb2/YaBB.pl?num=1089129620/870#870
http://forum.lemmingswelt.de/cgi-bin/yabb2/YaBB.pl?num=1089136533/555#555
http://forum.lemmingswelt.de/cgi-bin/yabb2/YaBB.pl?num=1109817901

These 3 topics have been spammed.
that dude gonna go to hell!  >:(
Title: Re: SPAM ALERT!
Post by: MC Marshy on February 05, 2006, 01:37:18 PM
I hope he goes to hell the bastard!

Andi could you possibly ban guests from entering the forum and make people register if they want to post on the forum?
Title: Re: SPAM ALERT!
Post by: Lomay on February 05, 2006, 02:11:07 PM
but if andi removes the comments for the guests, that might also means "ccexplore" can't comment in the guest comments, becauses their has to be another way.
Title: Re: SPAM ALERT!
Post by: Leviathan on February 05, 2006, 04:10:44 PM
Grrr something has to be done against this...wish I was mod so I could instantly delete the spam on the first moment I notice it :P

I guess it's best to have people require to register before posting...it's a shame that it's necessairy but that's the way it goes all the time: the good people have to be penalized too for the things the bad people do :(
Title: Re: SPAM ALERT!
Post by: JM on February 05, 2006, 04:20:33 PM
Quote from: Leviathan link=1139136262/0#4 date=1139155844
I guess it's best to have people require to register before posting...it's a shame that it's necessairy but that's the way it goes all the time: the good people have to be penalized too for the things the bad people do :(

I agree with you Leviathan. That happened on Garjen's forum ages ago. It's best to have people require to register before posting :)
Title: Re: SPAM ALERT!
Post by: Lomay on February 05, 2006, 05:02:59 PM
to all members

I've notice that the spammer's e-mail address keeps changing, so this might mean that their are more that just one spammer or just one, meaning he/she/it's IP logging might be weird.
Title: Re: SPAM ALERT!
Post by: JM on February 05, 2006, 05:39:29 PM
Quote from: Lomay link=1139136262/0#6 date=1139158979
to all members

I've notice that the spammer's e-mail address keeps changing, so this might mean that their are more that just one spammer or just one, meaning he/she/it's IP logging might be weird.


If their e-mail address is changing they are probably using other e-mail addresses to stop people finding out who they really are.
Title: Re: SPAM ALERT!
Post by: Lomay on February 05, 2006, 05:42:23 PM
Quote from: JM link=1139136262/0#7 date=1139161169
Quote from: Lomay link=1139136262/0#6 date=1139158979
to all members

I've notice that the spammer's e-mail address keeps changing, so this might mean that their are more that just one spammer or just one, meaning he/she/it's IP logging might be weird.


If their e-mail address is changing they are probably using other e-mail addresses to stop people finding out who they really are.
oh
Title: Re: SPAM ALERT!
Post by: MC Marshy on February 05, 2006, 05:58:17 PM
I'm sure that the spammer is using different e-mail addresses to try and impersonate other people. To see if it's the same person or not we need the moderators to check the I.P addresses from all the posts the spammers have made.
Title: Re: SPAM ALERT!
Post by: Lomay on February 05, 2006, 06:00:10 PM
Quote from: MC Marshy link=1139136262/0#9 date=1139162297
I'm sure that the spammer is using different e-mail addresses to try and impersonate other people. To see if it's the same person or not we need the moderators to check the I.P addresses from all the posts the spammers have made.
yeah!
Title: Re: SPAM ALERT!
Post by: tseug on February 05, 2006, 06:26:36 PM
Block his IP range.
Title: Re: SPAM ALERT!
Post by: Mr. K on February 05, 2006, 06:32:34 PM
Somebody, do SOMETHING!

Changing email address could be randomly generated by a computer program to avoid capture.  I'm betting this is automated, since it's trying to put in HTML code and says random nonsense.

There should be a law about this that could make them pay a fine or something.
Title: Re: SPAM ALERT!
Post by: tseug on February 05, 2006, 06:51:26 PM
post moved from a different thread:

Quote from: tseug link=1134444191/0#8 date=1139164220
Quote from: JM link=1134444191/0#4 date=1139155069
Wished I could hack their PC so they couldn't do this again.
I'll see what I can do. ;) I'm not very good but I might be able to do something.

EDIT: The IP Andi mentioned appears to be a PC running windows NT V3.90 (on second thought I'm not so sure if 3.90 is right). Andi it would help if you posted more IPs.
Title: Re: SPAM ALERT!
Post by: Mindless on February 05, 2006, 06:54:52 PM
There's no reason to reply to spam posts, people.  Spambots don't listen, they spam.

We need one of the following:
Title: Re: SPAM ALERT!
Post by: Anatol on February 05, 2006, 09:06:00 PM
As a side note, the guestbook on my Lemmings page has been getting spammed a ton with messages almost identical to these. Every time I look back at my guestbook, it seems there's about 40 more spams, so it must be a bot of some type. I don't know how to stop it either, besides requiring registration. :-/
Title: Re: SPAM ALERT!
Post by: tseug on February 05, 2006, 11:16:36 PM
Would changing the address help? The old one could point to a sentence explaining the new address. The bots from this particular website seem vicious though. Of course if someone launched a DDoS attack on the server it would help, but the problem is that that could get you in trouble. ;)

EDIT: A whois lookup shows email is:
domainnameregistration@cassava.net
server IPs are:
64.49.213.233
64.49.213.241

EDIT2: All of the bot's posts contain mangled html (well, just different from this board's format). So maybe it would be possible to block posts that contain that stuff?
Title: Re: SPAM ALERT!
Post by: ccexplore on February 05, 2006, 11:31:50 PM
Quote from: tseug link=1139136262/15#16 date=1139181396
EDIT2: All of the bot's posts contain mangled html (well, just different from this board's format). So maybe it would be possible to block posts that contain that stuff?
That has been on my thoughts all along, to disable posts containing common HTML tags (eg. <a href...></a>, <img> etc.).  That way it would at least force the bot to be more YaBBC-tags aware, which I think should cut down on the likelihood of getting these posts.
Title: Re: SPAM ALERT!
Post by: MC Marshy on February 06, 2006, 10:35:03 AM
Spambots should be destroyed!
Title: Re: SPAM ALERT!
Post by: Lomay on February 06, 2006, 04:28:23 PM
Quote from: MC Marshy link=1139136262/15#18 date=1139222103
Spambots should be destroyed!
yeah!
Title: Re: SPAM ALERT!
Post by: Andi on February 06, 2006, 05:45:55 PM
Quote from: tseug link=1139136262/0#13 date=1139165486
Andi it would help if you posted more IPs.
Another one: 202.71.106.121
Anyway, what to do now? Shall I disable guestposting or do you want to collect more IPs to erm... do something with them? ^^

@Anatol: I'm sorry for you. What GB do you use? Propably it has an anti-flood feature.
Title: Re: SPAM ALERT!
Post by: MC Marshy on February 06, 2006, 06:05:18 PM
I think guestposting should be disabled on this forum. That could stop spambots.
Title: Re: SPAM ALERT!
Post by: Anatol on February 06, 2006, 06:07:31 PM
My guestbook is a project called Openbook. I found it on Sourceforge, but the project page seems to have died long ago. So there are guestbooks out there that help prevent this sort of thing? Where can I find them?
Title: Re: SPAM ALERT!
Post by: MC Marshy on February 06, 2006, 06:09:51 PM
Anatol, all that spam on your website on the guestbook is awful. Couldn't you make it log the I.P address of the person who posts on your guestbook?

It's been done 100 times in a row or so  :o
Title: Re: SPAM ALERT!
Post by: JM on February 06, 2006, 07:37:23 PM
I just looked at the guestbook. Somebody must do something about this. I guess it was spambots that spammed all over Garjen's forum.
Title: Re: SPAM ALERT!
Post by: MC Marshy on February 06, 2006, 08:54:31 PM
I'm sure spambots are doing that elsewhere. All forums need to have people register before they can post.
Title: Re: SPAM ALERT!
Post by: tseug on February 07, 2006, 12:13:45 AM
The IPs seem utterly random. So I guess you should make something filter out that kind of html. The bot itself has no way of knowing what happens to what it sends because it is sending from a different IP. It might ping the server before sending, I don't know if you have any way to find out.

EDIT: Or you could just look for anything sent from either of the sever IPs.
Title: Re: SPAM ALERT!
Post by: ccexplore on February 07, 2006, 01:55:29 AM
Quote from: MC Marshy link=1139136262/15#25 date=1139259271
I'm sure spambots are doing that elsewhere. All forums need to have people register before they can post.
This makes it difficult for people who simply wants to ask for Game Help or Technical Questions, it would be a hassle to expect random people to have to register just to do that.

Though certain other parts of the forum may conceivably be registered-only. &#A0;I would rather not though. &#A0;Especially keep in mind also that if the bot is truly YaBB2 aware, registration is unlikely to stop a bot from creating new accounts to SPAM. &#A0;After all, currently there isn't even an e-mail verification for registering new accounts here, much less the CAPCHA-type verification found on, say, Yahoo account registeration. &#A0;Thus I think the HTML filtering approach combine with IP-address blocking would be best. &#A0;The miniscule amount of SPAM here is hardly that big a deal when you consider the dozens (possibly even hundreds) of SPAM that goes into your e-mail inbox (though nowadays e-mail filters do a good job) daily.
Title: Re: SPAM ALERT!
Post by: MC Marshy on February 07, 2006, 11:03:20 AM
Quote from: ccexplore (not logged in)(Guest) link=1139136262/15#27 date=1139277329
This makes it difficult for people who simply wants to ask for Game Help or Technical Questions, it would be a hassle to expect random people to have to register just to do that.

Though certain other parts of the forum may conceivably be registered-only.  I would rather not though.  Especially keep in mind also that if the bot is truly YaBB2 aware, registration is unlikely to stop a bot from creating new accounts to SPAM.  After all, currently there isn't even an e-mail verification for registering new accounts here, much less the CAPCHA-type verification found on, say, Yahoo account registeration.  Thus I think the HTML filtering approach combine with IP-address blocking would be best.  The miniscule amount of SPAM here is hardly that big a deal when you consider the dozens (possibly even hundreds) of SPAM that goes into your e-mail inbox (though nowadays e-mail filters do a good job) daily.[/color]

I don't get much spam in my e-mail inbox. If the bot registered for a username so it could spam we could easily ban it from the forum for 10 years. Some people who just want help who are guests may want to come back for more help or to have a look around the forum and find interesting things. If I find the e-mail address of the spambot then I'll give it lots of spam.
Title: Re: SPAM ALERT!
Post by: ccexplore on February 07, 2006, 12:11:40 PM
Quote from: MC Marshy link=1139136262/15#28 date=1139310200
If the bot registered for a username so it could spam we could easily ban it from the forum for 10 years.
You don't get it at all.  The point is right now registration is so easy on this board, a YaBB-aware bot can automate it and register a new username for every piece of spam it wants to post.

Quote
Some people who just want help who are guests may want to come back for more help or to have a look around the forum and find interesting things.
Statistically speaking I'm not sure that's the case when it comes to the Game Help and especially the Technical Help forums.

Quote
If I find the e-mail address of the spambot then I'll give it lots of spam.
That's what tseug proposed essentially (except what tseug said would actually work) when he talked about the DDoS attack.

Incidentally, even if you do somehow get hold of a real e-mail address of a spammer and spam him, I'd think spammers are the people with the least negative reaction to spam.  After all, they make their living off it. ::)
Title: Re: SPAM ALERT!
Post by: Timballisto on February 08, 2006, 12:24:55 AM
What the heck is a DDoS attack?
Title: Re: SPAM ALERT!
Post by: Mindless on February 08, 2006, 01:34:09 AM
Quote from: Timballisto link=1139136262/30#30 date=1139358295
What the heck is a DDoS attack?
Distributed Denial of Service (http://en.wikipedia.org/wiki/DDoS) Attack
Title: Re: SPAM ALERT!
Post by: JM on February 08, 2006, 05:07:03 PM
The spambots have returned  :o :o :o :o :o
Title: Re: SPAM ALERT!
Post by: Leviathan on February 08, 2006, 07:10:24 PM
Please don't react on those spammed topics as nobody even reads your reactions...and it gives the mods extra work.

Just let the mods do their work to delete the spam right after they discovered it and in the meantime,maybe we could try to automatically delete any post or thread containing the word "casino".

I don't know if it works,but maybe the program thinks the spam was posted but actually it was automatically deleted a second or so afterwards ;)

Title: Re: SPAM ALERT!
Post by: Timballisto on February 08, 2006, 08:05:08 PM
We need to get some of the mods to come back who haven't been around - namely Lem'ka an TW. &#A0;I'll give them emails...

EDIT: Both of them have locked emails.
Title: Re: SPAM ALERT!
Post by: JM on February 08, 2006, 08:10:22 PM
It's only Lomay who seems to get aggravated by the spam.
Title: Re: SPAM ALERT!
Post by: Timballisto on February 08, 2006, 08:15:13 PM
Actually it bothers me too.  It's annoying and this isn't the place for it.  I'm not one for letting it sit around and create clutter.  It seems to get longer after it spams a couple times, obviously enough.  You know, I don't understand it.  All that does is deter people.  Why do they think that gets people to come to their website?  The only reason I'd do that would be to get their address and fill IT with spam.
Title: Re: SPAM ALERT!
Post by: tseug on February 09, 2006, 01:47:43 AM
There were several very lengthy SPAMS (3 I think) in random topics. Blocking "<a href" may be the way to go.

EDIT: Or maybe DDoS. That site deserves it.

EDIT2: Especially since it somehow found this forum, which means that there are probably tons of other bots roaming around.
Title: Re: SPAM ALERT!
Post by: Mr. K on February 09, 2006, 02:27:55 AM
Quote
EDIT: Or maybe DDoS. That site deserves it.

You say we should do a DDoS to them?  That would just be like being worse than the spammer.  We need to try figuring this out in a more civilized way.

Blocking posts with ANY html is the way to go.  I'll bet this bot doesn't even know that we don't support HTML.  Maybe blocking the username that the bot uses would be good too, as it wouldn't be able to do anything.  Someone could maybe register under that name, making it unable to use it?

EDIT:  Anyone have a clue why this bot seems to post fragments of sentences somewhere in the HTML?  I can't see what it's supposed to be.  The sentences can't be connected either, like it's just a buncha rambling.
Title: Re: SPAM ALERT!
Post by: Lomay on February 09, 2006, 07:55:10 AM
Quote from: JM link=1139136262/30#35 date=1139429422
It's only Lomay who seems to get aggravated by the spam.
me? &#A0;:o

Edit: i'm sorry  :-[
Title: Re: SPAM ALERT!
Post by: JM on February 09, 2006, 10:15:58 AM
Lomay it's ok. I'm sure I have discovered a spambots e-mail address and I could try and hack it so it couldn't work again.

The e-mail address is something like this spambot5000@hotmail.co.uk
Title: Re: SPAM ALERT!
Post by: Andi on February 09, 2006, 05:34:50 PM
T stop the spambots for now I disabled guestposting and every account must be activated within 24 hours by email. I'm sorry I had to do this. But remember something? Slightly the same situation as we had once on LUDB. Only diference: back on LUDB it were actually humans.
Title: Re: SPAM ALERT!
Post by: JM on February 09, 2006, 06:00:37 PM
There's still several topics containing spam. Delete the posts that contain the word "casino"
Title: Re: SPAM ALERT!
Post by: MC Marshy on February 10, 2006, 11:38:09 AM
Yes there's still a few posts that these casino guy posted that need deleting! I'll find the posts and post them here for moderators to sort out.

http://forum.lemmingswelt.de/cgi-bin/yabb2/YaBB.pl?num=1116111874/21#21
http://forum.lemmingswelt.de/cgi-bin/yabb2/YaBB.pl?num=1132961704/1#1
http://forum.lemmingswelt.de/cgi-bin/yabb2/YaBB.pl?num=1089242774/790#790

They still  contain the spam that the casino guy posted.
Title: Re: SPAM ALERT!
Post by: Andi on February 10, 2006, 12:51:20 PM
Has been deleted.
Title: Re: SPAM ALERT!
Post by: MC Marshy on February 12, 2006, 11:02:27 AM
The spammers have not returned  :)
Title: Re: SPAM ALERT!
Post by: Lomay on February 12, 2006, 11:13:45 AM
Quote from: MC Marshy link=1139136262/45#45 date=1139742147
The spammers have not returned &#A0;:)
yay!!  ;D ;D ;D
Title: Re: SPAM ALERT!
Post by: Lomay on February 12, 2006, 11:16:26 AM
evil is gone, lemming land has restored peace!  :)
Title: Re: SPAM ALERT!
Post by: MC Marshy on February 17, 2006, 12:19:57 PM
If a spammer registers to try and spam the forum then we can just block their username from the forum &#A0;:)
Title: Re: SPAM ALERT!
Post by: Liebatron on March 07, 2006, 09:19:13 PM
would it be possible to make people have to register to guest post, but with only one requirement? I had an idea that before guest posting, this site would make you look at a graphic with a word written in it and ask the person to type what the word says. If you made the word unreadable by a text recognizer program, would a spambot be able to get through that?
Title: Re: SPAM ALERT!
Post by: Andi on March 08, 2006, 08:06:16 PM
U donno. But I prefer members. You can talk to them directly and send them PMs. They are easy to ban and you don't have to mess with IP ranges.
Title: Re: SPAM ALERT!
Post by: MC Marshy on March 25, 2006, 09:54:46 PM
Members are better. Guests leave fake e-mail addresses.