Log in

View Full Version : So, anyone else getting the album spammer?

therogueforums
02-04-2009, 04:59 PM
Right. We've been getting about 5 accounts a day for the past few weeks, all (I assume) from the same guy, who has one hell of a proxy.

What the person/bot does is post links to pr0n sites, as well as phising sites, in his user albums. Just wondering if anyone else has been getting this guy or guys like him, and how you're dealing with it.
TNCclubman
02-04-2009, 09:01 PM
Do you have a custom question on registration? Guarantee you its a bot and that will stop it. Try it and get back to us.

Make the question something everyone knows like...

What is the opposite of cold?

answer: hot
therogueforums
02-04-2009, 10:19 PM
Oh, I'm running a registration mod. Works well (I think). I'm thinking it's a human registering, and letting the bot do the work, as quite a few of his accounts have had no activity at all yet, while others have.

All have a common email address, and all link to the same sites.
NeroObsedian
02-04-2009, 11:41 PM
I had some issues with adult posting in threads. My fault though as I never updated the CAPTCHA. 90% of the SPAM was coming from RIPE network in Amsterdam, blocked what IP ranges I could and it seemed to have taken care of it. I was getting anywhere from 3-12 accounts per day, some would post one thread some would post two pages worth.
Alfa1
02-05-2009, 01:52 AM
90% of the SPAM was coming from RIPE network in Amsterdam, blocked what IP ranges I could and it seemed to have taken care of it.
RIPE is the internet hub for Europe and more. You may have blocked off a large part of the world. I suggest you start using another IP tracing service.
NeroObsedian
02-05-2009, 04:07 AM
RIPE is the internet hub for Europe and more. You may have blocked off a large part of the world. I suggest you start using another IP tracing service.

I went off www.arin.net, any other suggestions?

I also backed out to only banning the main IP most of the accounts were registering under.

Not to hijack the thread or anything..
TNCclubman
02-05-2009, 02:17 PM
use my suggestion if you want it to stop.
calumn
02-05-2009, 03:18 PM
NeroObsedian, you blocked out a huge chunk of europe if you blocked the RIPE IP ranges.
Alfa1
02-06-2009, 01:49 AM
I went off www.arin.net (http://www.arin.net), any other suggestions?

I also backed out to only banning the main IP most of the accounts were registering under.

Not to hijack the thread or anything..
The strange thing is that ARIN, often gives inaccurate results outsides its domain. ARIN is only for North American IP's. If you trace European IP's trough RIPE, then you will get the real results.
http://www.apnic.net/images/rirs/region_map.jpg