|
|
Post by Erich on Mar 26, 2009 11:02:32 GMT -5
For the last few days I've seen in the security log deleted postings coming from someone who is apparently here on a regular basis and spamming the forum using the title "Current Offers". Our Moderators have been on top this and the postings are all getting deleted...
Here is what I have seen recently in the security log:
Deleted post titled Re: Current Offers posted by DESAGYSR
Deleted post titled Re: Current Offers posted by FDHGK
Deleted post titled Re: Current Offers posted by REYEWTYU
Deleted post titled Re: Current Offers posted by DFHGFH
Deleted post titled Re: Current Offers posted by TRTR.
Deleted post titled Re: Current Offers posted by FRFRE.
Deleted post titled Re: Current Offers posted by GTRTR.
Deleted post titled Re: Current Offers posted by FREER.
Deleted post titled Re: Current Offers posted by GTRTR.
Deleted post titled Re: Current Offers posted by RGTR.
Deleted post titled Re: Current Offers posted by GTRGTR.
Deleted post titled Re: Current Offers posted by FRERE.
Deleted post titled Re: Current Offers posted by FRERE.
I checked for accounts for who ever is using these capital letters and there are no accts for any of them??? Unfortunately, I have not seen the actual posts for any of these...
Obviously the same person is doing this and I'd like to ban him but he doesn't have an acct. If any of you see anymore of this please get the IP address from the post and send it to me so I can ban the IP.
Thanks
Erich
|
|
|
|
Post by Bob on Mar 26, 2009 13:53:29 GMT -5
Hi Erich,
Glad to help if I can, But how do I see the IP address of the post?
Bob
|
|
Lori G.
Long Time Member 
Love life and life will love you back.
Posts: 2,429
|
Post by Lori G. on Mar 26, 2009 18:09:10 GMT -5
Erich,
Maybe they have already been banned. If I see excessive spam postings by the same individual, I will ban them while deleting their posts. Out of curiosity, if a member is banned, will there still be a record of their account?
I'll keep my eyes peeled.
Lori
|
|
|
|
Post by Tom "CloudHand" on Mar 26, 2009 21:22:31 GMT -5
Erich,
I remember these as I deleted most if not all of them. Strange thing is they were all posted by a "guest" account and all had different IPs and all had the same spam content. Since they were all posted by a guest account, it makes sense that you cannot find any accounts associated with the posts. Unfortunately I did not save any of these posts for future reference and just wanted to eliminate them as fast as possible.
Next time I see one of these I will save it for further investigation.
Tom
|
|
|
|
Post by troyzone on Mar 27, 2009 5:56:14 GMT -5
Hi Erich,
I deleted several of these over the past week...I did so in a hurry on my way out the door to work so I didn't notice the IPs, but they were just pages and pages of gibberish, unreadable characters that were linked to countless random sites and nothing else so they were obviously garbage posts. The reason they had that subject line was they were often being posted in reply to the Current Offers thread in the BizOpp board. I didn't see any this morning, but if I notice any more I'll make note of the poster's IP and so forth.
Bob - You can only see the IP of a poster if you are a Moderator or Forum Manager, and can only delete posts if you are in one of those groups. The IP appears in the lower-right corner of posts for those who have the authority to view it.
Troy
|
|
|
|
Post by talfighel on Mar 27, 2009 8:26:25 GMT -5
Erich,
I have deleted a few posts in the past week or so. Next time I see a new spam message, get the IP and send it to you.
Tal
|
|
|
|
Post by Erich on Mar 27, 2009 9:00:01 GMT -5
Thanks Everyone... It makes sense that they used a "Guest Acct" since I could not locate the poster. When someone is banned... their forum acct is still accessable to me thru admin . I have used the option to not allow guest postings on some of our categotries but will need look further into not allowing guests to post on all of the Boards. I think I have allowed guests to post in the "First Time New Visitor" category.
Erich
PS: I only need to IP if the user is a "Guest" and persists in spamming us like the guy who used the subject line "Current Offers" in all his spam postings.
|
|
|
|
Post by Tom "CloudHand" on Mar 28, 2009 21:50:07 GMT -5
3 more or these nonsense posts were made tonight:
Current Offers posted by wetrtrt, ertyert, and q3rrt. All 3 had IP of 123.120.68.243 and was nothing but really long posts of unreadable characters. Once again these were posted using a guest account.
Please ban this spammer!
Tom
|
|
|
|
Post by troyzone on Mar 28, 2009 22:05:02 GMT -5
Tom, I was just in the process of PMing Erich about these spam posts and deleting them when they disappeared. I guess you were deleting them at the same time I was looking at them. lol Stupid spammers, I don't know why they bother...they sure don't last long around here, maybe a few minutes on average  Troy |
|
|
|
Post by Erich on Mar 29, 2009 9:06:30 GMT -5
Thanks everyone for your emails and postings on this... I have banned 123.120.68.243.
Hopefully he doesn't have access to other IP's.
Erich
|
|
shing
Long Time Member
"Opportunity is missed by most people because it is dressed in overalls and looks like work."
Posts: 1,682
|
Post by shing on Mar 31, 2009 17:16:10 GMT -5
I am so sorry. I usually go to the 30 latest posts and saw a very irritating spam post. I immediately deleted it without getting the tracking number. I will check that and report it from now on.
Shawna
|
|
|
|
Post by troyzone on Apr 1, 2009 5:52:38 GMT -5
Erich, I just deleted three more of those gibberish posts from a guest in the Bizopp board's Current Offers thread again. One used the guest name wererwer, one used the name qwrrer, and one used the name werrwer. It just seems like they're putting in random characters for the name. The IP this time was 123.120.71.192.
You may have to go so far as to ban 123.120.*.* since only the first two octets are the same...the last two numbers keep changing. Most people get dynamically assigned IPs from a set range supplied by their ISP when they sign on to the Internet so it's different each time, within the range owned by their ISP of course...this one appears to be no different.
The other option is to disable guest postings in that and the other remaining boards that aren't intended for guests to post in. If the spammer had to make a new account each time because we kept disabling their prior spamming accounts then they might get discouraged and stop bothering us. The BizOpp reps posts here sometimes as a guest, but they can easily be instructed to create a forum account to post from...they really should be using one to post anyway.
Troy
|
|
|
|
Post by Erich on Apr 1, 2009 9:15:22 GMT -5
Erich, I just deleted three more of those gibberish post from a guest in the Bizopp board's Current Offers thread again. One used the guest name wererwer, one used the name qwrrer, and one used the name werrwer. It just seems like they're putting in random characters for the name. The IP this time was 123.120.71.192. You may have to go so far as to ban 123.120.*.* since only the first two octets are the same...the last two numbers keep changing. Most people get dynamically assigned IPs from a set range supplied by their ISP when they sign on to the Internet so it's different each time, within the range owned by their ISP of course...this one appears to be no different. The other option is to disable guest postings in that and the other remaining boards that aren't intended for guests to post in. If the spammer had to make a new account each time because we kept disabling their prior spamming accounts then they might get discouraged and stop bothering us. The BizOpp reps posts here sometimes as a guest, but they can easily be instructed to create a forum account to post from...they really should be using one to post anyway. Troy Hi Troy Either the ProBoard program isn't working properly or else this spammer knows how to get past the controls. I have set all categories to only allow registered members to post... So I don't know how or why the guest postings are getting thru. I hesitate to ban the IP 123.120.**** because their may be some legitimate members within that range. I will first ban the 123.120.71.192 and if we continue to get more from this idiot... I will do as you advise. Thanks Erich |
|
|
|
Post by Erich on Apr 1, 2009 9:18:49 GMT -5
Oh what the heck... I went ahead and banned all 123.120......
Erich
|
|
|
|
Post by talfighel on Apr 1, 2009 9:23:40 GMT -5
Oh what the heck... I went ahead and banned all 123.120...... Erich That's OK Erich. You did the right thing. A lot of people don't come back after they register so no big deal. Tal |
|
|
|
Post by troyzone on Apr 1, 2009 17:30:37 GMT -5
Hi Erich,
I just took a quick look online and the IPs in question apparently belong to an ISP called CNC Group based out of Beijing, China, and I have seen others online report getting a lot of their spam from that and several other sources. While it is possible that a legitimate member of our forum falls in the banned IP range, I imagine that the likelihood of this is rather low.
I just tried going to the BizOpp board (biz2) and posting there as a guest, and I was able to successfully do so. I then logged back in and deleted my own guest post. I noticed that many of the boards were accessible as a guest.
Has it been quite a while since you disabled the ability of guests to post in most boards? I seem to remember Proboards updating their forum script software at one point last year...if the forum settings for certain boards like BizOpp's haven't been changed since before Proboard's last update then maybe the settings need to be reconfigured before they will work properly.
Perhaps you could try to turn guest posting back on, save the settings, then turn guest posting back off and then save the settings again, just to reset the configuration of your boards. If that doesn't work, then we might have to contact a Proboards admin if we wish to get the guest posting issue resolved.
Erich, I just logged in as a guest on one of my other computers and went through the entire forum, making note of what boards were accessible to guests for viewing and/or posting and what boards weren't. I have PM'd you the list.
Troy
|
|
|
|
Post by Erich on Apr 2, 2009 10:44:18 GMT -5
Troy
I recd and responded to your PM. I have closed the Bizopp board to guests posting and turned off and on again the guest posting on the "First Time Visitors" board. I think I'll wait and see if we get anymore spams from guests before I do the Guests Off and On with the rest of them...
Thanks for your help!!!
Erich
|
|
|
|
Post by troyzone on Apr 3, 2009 5:25:12 GMT -5
Hi Erich,
I checked by logging in as a guest and it appears that you have fixed the BizOpp board so that guests can no longer post there. Hopefully that will put an end to what I have nicknamed the "gibberish spammer".
Like many other boards, the First Time New Members To Forum board allows guests to view it, but only members can post in it, as before. If this was your intention then it's fine...if not, then guest posting is not yet enabled for it. I'm not sure if you wanted it on or not for that particular board.
The rest of the boards seem to be working fine now, so as you mentioned, there is no need to toggle their settings off and on at this point. The BizOpp board is now fixed in any case. Thanks!
Troy
|
|
|
|
Post by Erich on Apr 3, 2009 8:45:48 GMT -5
Thanks again Troy... I think we'll make all visitors register in order to make postings. That makes it a bit more tedious for spammers.
Erich
|
|
|
|
Post by femmes07 on May 20, 2009 1:42:10 GMT -5
Sure I wanna help too..! Just count me in..  NO TO SPAMMERS!!! |
|
NO TO SPAMMERS!!!