vb.org Archive - Getting lots of spammers recently.. all emails from one domain

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=111)

- - Getting lots of spammers recently.. all emails from one domain (https://vborg.vbsupport.ru/showthread.php?t=117924)

kall	06-07-2006 07:16 PM

Getting lots of spammers recently.. all emails from one domain

Anyone else seeing lots of signups from people with the domain 'cashette.com' for their email?

I have seen 20 in the past 2 days.

Gonna ban that domain now.

keithl

06-07-2006 08:30 PM

Me too :( I'm SysAdmin on two systems, both have been hit by fake registrations with cashette.com email addresses.

Solutions anybody?

Keith L

Marco van Herwaarden

06-10-2006 01:11 PM

Block mail addresses with that domain from registering maybe?

BryceI

06-10-2006 01:21 PM

Is there a built-in way to do this? I'm not seeing it.

Looks like cashette is an email service that tries to get spammers to pay to let their email through -- looks like someone is trying to get "spam" emails sent to their account, hence the fake registrations.

Marco van Herwaarden

06-10-2006 01:33 PM

You can find it under:
ACP->vBulletin Options->User Banning Options->Banned Email Addresses

BryceI

06-10-2006 02:13 PM

Quote:

Originally Posted by MarcoH64

You can find it under:
ACP->vBulletin Options->User Banning Options->Banned Email Addresses

Thanks!

OKIHost

06-11-2006 04:52 AM

I am getting these also, I thought image verification would prevent this?

Either way thanks for the info should clear things up for me, had about 10in the past 72 hours.

theSicilian

06-12-2006 05:31 AM

Have been getting these as well - strange thing is that they got through even though I set up -"moderate new registrations". Normal users needed to be moderated while cashette.com just went through - now that is a bit worrying...

Have now banned any e-mails from that domain

Freesteyelz

06-12-2006 08:38 AM

It would be cool if vB had a Bayes filter of some sort as spam e-mail change and disguise itself quite well now days.

KevinL

06-12-2006 12:49 PM

Yeah Ive been getting a lot of these also.

OKIHost

06-13-2006 01:21 AM

got a few from hotpop.com today going to just keep adding them as they come in.

Annie^.^

06-13-2006 02:00 AM

Not only that, but they take admin's e-mail address and send spams there. It upsets me so much I wish I know what else to do other then keep banning them ...

JD45	06-14-2006 05:24 PM

I've been getting them a lot and from mail.ru...

I sent a complaint to their abuse email and here's the response:

Quote:

Dear Jason:

Thank you for contacting Cashette. We are an anti-spam email provider. Most
of the accounts reported to us are not valid email addresses. If you send us
your list, we will check them out. If they are valid accounts, we will close
them.

Please note these are spammers, who registered with you at the same time
they registered on our site or not even bother to register on our site at
all. We have no more control over them than you have.

We have a strong system blocking out-going spam. However, in this case, the
spam was not sent from our site. It was posted directly on your site. It is
originated from your site. So only you can block it so neither you nor us
can be their victims. You should review all your postings before allowing
them to be posted. At the minimum, you should use keyword blocking or more
sophisticated spam-blocking system. By not doing so, you are enabling
spammers to spam your users and damage our name.

Your lack of spam-blocking/site security is the cause of the problem. It's
only a matter of time when the spammers take advantage of your
vulnerability. Blocking any domain will not solve the problem since the
spammers can arbitrarily choose any free email domain to register with you.

Sincerely,
Cashette Anti-Abuse

BryceI

06-15-2006 03:35 PM

Quote:

Originally Posted by JD45

I've been getting them a lot and from mail.ru...

I sent a complaint to their abuse email and here's the response:
.
.
.
.
We have a strong system blocking out-going spam. However, in this case, the
spam was not sent from our site. It was posted directly on your site. It is
originated from your site. So only you can block it so neither you nor us
can be their victims. You should review all your postings before allowing
them to be posted. At the minimum, you should use keyword blocking or more
sophisticated spam-blocking system. By not doing so, you are enabling
spammers to spam your users and damage our name.

Your lack of spam-blocking/site security is the cause of the problem. It's
only a matter of time when the spammers take advantage of your
vulnerability. Blocking any domain will not solve the problem since the
spammers can arbitrarily choose any free email domain to register with you.

This is a BS response. The Cashette model incentives users to receive "spam" from legitimate sources by trying to get senders of spam to pay for their messages to get through. If a few board administrators decide that it's worth it to pay a couple of cents to let their automated registration emails get through to such users then Cashette and the Cashette users win.

Is anyone getting actual posts from cashette accounts, or just registrations? I suspect it's the latter.

kall	06-15-2006 07:04 PM

Quote:

Originally Posted by BryceI

Only registrations..all with either pornographic or drug URLs for their location. Probably thinking they will get linked?

sportsoutlaw

06-15-2006 08:54 PM

I have been deleting registrations for both of these domains for 2 weeks on 3 of my forums. I finally just banned the email addresses this morning.

gmatrix

06-16-2006 06:11 AM

I have also been getting a lot of registrations from the cashette and mail.ru addresses. Setting new registrations to confirm email addresses seems to have stopped them posting so I'm guessing they are fake addresses. I just banned those addresses to cut down the amount of accounts I have to keep deleting.

I think this is being done so that they can then post a spammy posts with links to their sites as I found a username 'buy-prozac-online' on another forum and it was just a keyword loaded spam post.

My question is, do you think these accounts being auto generated, and if so, why isn't the image verification putting a stop to this? Have people found a way to get round it?

keithl

06-21-2006 02:21 PM

I've given up and put a block on cashette.com, mail.ru and inbox.ru - on the forums that I manage I've never seen a valid post from any of those domains! I am seriously thinking of blocking all .ru domains.

Keith L

zooki

06-21-2006 10:10 PM

Quote:

Originally Posted by keithl

you wont get any russians then :pirate:

Blue-Inc

06-23-2006 07:50 PM

Quote:

Originally Posted by kall

Anyone else seeing lots of signups from people with the domain 'cashette.com' for their email?

I have seen 20 in the past 2 days.

Gonna ban that domain now.

Yes, I got two of them today, I emailed cashette today, still awaiting there reply though. :cool:

curry684

06-25-2006 10:48 AM

I've also blocked Cashette.com and Mail.ru from registering a while back, didn't know it was such a global problem.

All this discussion aside: are these manual or automatic registrations? And in the case of the second, how do they get past CAPTCHA?

I'm getting lots of other "spam" registrations as well, which kind of makes me worry about vBulletin's CAPTCHA implementation.

jwbond

06-28-2006 01:53 PM

I'm getting tons too! Does turning "image verification" on stop it?

I tried to do so, but the images are not popping up in the "User Registration Options". It says " If you do not see an image below then your Image settings are wrong or not enabled."

Can anyone help me? I am going on my honeymoon this weekend and don't want porn spam on my forums unmoderated for a week!

OKIHost

06-28-2006 07:52 PM

Quote:

Originally Posted by jwbond

Not really, I still get about 10 a week on my VERY dead forum. Enabling requiring new users to verify email address does help some. vb 3.6 is supposed to have an improved image verification system which should help.

I have also noticed a few from @fromru.com in the past few days.

curry684

06-28-2006 08:15 PM

Quote:

Originally Posted by jwbond

I'm getting tons too! Does turning "image verification" on stop it?

No, I have it enabled. Hence my question why they still get in despite CAPTCHA. Some people are doing bored manual registrations it seems.

Quote:

I tried to do so, but the images are not popping up in the "User Registration Options". It says " If you do not see an image below then your Image settings are wrong or not enabled."

Check your GD install.

Quote:

Can anyone help me? I am going on my honeymoon this weekend and don't want porn spam on my forums unmoderated for a week!

Get a moderator :)

mrrockford

12-30-2006 06:06 PM

Howdy,

there is some new bot program that is reading the captchas and answering the opt-in mails, sometimes even throwing up a post. I have been getting 2 or 3 a day and up to 10. At least the forum is small enough that I can catch them. I have it down to 3 main ISPs now, cashette.com, mail.ru and gawab.com all spamming one forum which is now invisible. I'm also looking at a new captcha system based on this:

http://www.mshp.dps.mo.gov/CJ38/search.jsp

the forum that is getting hit has the highest google hits.

All times are GMT. The time now is 05:50 PM.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01291 seconds Memory Usage 1,791KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (10)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (25)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: