spammers and crashers

tonight saw unusaul usernames:

xavery
xavery4104

sampled article comment postings, they were scripted all the same words... looked like they were spawning porn meta-tags

unfortunately I used wrong procedure and deleted them before deleting the comment posts

 

Petty, keep deleting such people. Mike informed me last week about such members. Unfortunately, I have not been on the site as much this weekend as I have been gone. Thanks for deleting those members.

Mike, what are the signs to tell if we should delete a member?

Thanks!

 

Hey Jim,
Its been getting a lot worse in the past couple of weeks and when I do an upgrade this won't be a problem.

For now, as a rule for newly registered users if you check them keep this in mind.

If their emails come from 'chashette.com', end in '.info' or come from a mortgage company ending in '.info' then just delete them.

 

another 2 'guest post' with the 'phish type url links,
form china... attempted to ban all ip from china

{posting host} 121.27.150.232

inetnum: 121.24.0.0 - 121.27.255.255
netname: CNCGROUP-HE
descr: CNC Group Hebei province network
descr: China Network Communications Group Corporation
descr: No.156,Fu-Xing-Men-Nei Street,
descr: Beijing 100031


typical content
{url=http://219.133.55.164/mms/send/index.asp?TLType=1&no=805604&uid=1726}爱我别走{/url} {url=http://219.133.55.164/mms/send/index.asp?TLType=1&no=803689&uid=1726}上海滩{/url} {url=http://219.133.55.164/mms/send/index.asp?TLType=1&no=805284&uid=1726}舞娘{/url}{url=http://ivrsend.7town.com/Tnivr/SendIVR.htm?typ=3&mmsid=34691&uid=16651}我们都是好孩子{/url} {url=http://ivrsend.7town.com/Tnivr/SendIVR.htm?typ=4&mmsid=36171&uid=16651}谁动了我的琴弦{/url} {url=http://ivrsend.7town.com/Tnivr/SendIVR.htm?typ=3&mmsid=34686&uid=16651}香水有毒{/url} {url=http://ivrsend.7town.com/Tnivr/SendIVR.htm?typ=3&mmsid=26842&uid=16651}回心转意{/url}

 

I've just set the 'fourth pint' forum permissions. It was 'public' but now can only be posted in by registered users. I really can't believe the amount of spammers out there...its just getting worse and worse.

 

Thanks Mike, I should have paid more attention to set-up when I created it

I just saw another one and deleted him:
Klarso2325

Tom:
we need to either shut off article comments or turn them off after they go off the front page. I think almost all the older articles have crawler keywords posted on them

 

I have no idea how to turn off the article comments. Any idea how to do this?

 

Re: RE: spammers and crashers

Petty,
There was another user that registered today called Klarso. His email was, Klarso68066@nautilusinsurance.info. I deleted him as well.

I have noticed in the last week or two that two registrants enter the site with a name and then the same name with a number....ie...Klarso and Klarso2325. These are spammers.

As I was telling Mike in an email today, 75-80% of the registered members that come on the site are spammers.

Since I am going to be out of the country with likely very little Internet over Christmas and New Years, it is important to check all new members on a daily basis. If anything looks fishy, don't hesitate to delete them.

 

RE: Re: RE: spammers and crashers

I think you can turn them off at publish-time. I know you can on 'edit'

That's how I've deleted some of them... you can turn them off by 'edit', go back to article, delete one comment and they are all gone from that point.

Thinking that this has to do with the database 'write' sequence.