https://www.posetteforever.com/viewtopic.php?f=46&t=3100 ----------------------------------- Tormie Monday, 04 February 2008, 05:35 PM Spammers *war* next phase... ----------------------------------- Hi, I'm here entertaining you with some new boring technical data :sorry: of what will be my strategy and the next changes on the site. Actually each page of the site has a couple of "booby traps" for spammers, they are links that can't be seen by a "human" but that a non human bot will follow going to the spammer honey pot. If the bot is from a search engine nothing will happen, if the ip address is not from a search engine the information will go to "project honey pot" giving to the ip address the rank of "harvester or spammer bot", the result is that if this bot go to a lot of honey pots installed on different sites, its rank as offending IP address increases and here comes the second part: If it's a known IP, already ranked at project honey pot, it can't access the site, the spammer go to a dedicated page instead, a document explaining theat spamming and harvesting on the site is not allowed. offending IPs targeting PF can be seen here : http://www.projecthoneypot.org/bsh_X19tb2RlPXFsJnFsc3Q9NzE4Mi4yZWJjYyZfX2J5PTE.?rf=42267 (the italian one is the IP of Alcide , due to his particular network here in Italy :oops: , I had to specifically exclude it from the function and it's the reason why I sent that email to the active users because it could happen to legitimate users too) All these countermeasures will ease a lot my daily work in checking the credential of new registrations but it won't stop ALL the attempts. but however, I'll see how the situation evolves in the next weeks, if the rate of the spammers decreases a lot my project is to: -uninstall the actual "approval" mod for new users that is no more working properly -install a mod that disallow posting of attachments and external links to new users or users not in a certain group -go back to the simpler "activation by email" method instead of the actual "admin activation" -rest on the sofa watching TV :tv: The actual way the site is set is causing some troubles, because people has to wait me for the approval (and i can be sleeping , at work or away) and someone become angry because they have to be approved a second time when the begin to post, so I have to change strategy. The goal of the comment spammers is to place links to the sites they are advertising on all the possible places , all these links go on sites that sell Viagra, porn or online gambling/casino site. Why ? because people want to go there, you can read an interview with one of those individuals here : http://www.theregister.co.uk/2005/01/31/link_spamer_interview/ , and what they do is LEGAL unless elsewhere stated, this is the reason why I changed the agreement for that one has to agree during the registration process. We have also some tries to hack the site with some code "injection" , they are stopped by the crackertracker and logged so that I can ban the IP address, good news is that those "hackers" are using the same open proxies of the spammers so they should fall in the honey pot too. ----------------------------------- Tormie Monday, 11 February 2008, 10:58 PM Re: Spammers *war* next phase... ----------------------------------- After a week I'm glad to say that about the 90% of spam traffic has been cought by the traps :hurrah: The rest has been stopped by the antispam filter :yeah: So this system is working and the site is returned simple to register as it was in the past... I've also installed a "claymore" trap invented by myself :D , the spammer bots don't read the "terms and conditions" of the registration page... Mmmmh... Ok NO ONE does, however the difference is that a human has to click the "accept" button while the bot gives to the site the direct link to the following page , something with "register?agreed=true" at the end of the address, so now when one clicks the button the link has changed to somehting different (with "registar" instead of "register" in the link...) while if the site receives the old link it's obvious that it's a bot, so it is pulled directly in the honey pot, the claymore ignites and it goes directly into the big black list :D ... ( :tv: ) ----------------------------------- ahjah Monday, 11 February 2008, 11:02 PM Re: Spammers *war* next phase... ----------------------------------- Smarty, eh? :eh: :D ----------------------------------- JanReinar Monday, 11 February 2008, 11:15 PM Re: Spammers *war* next phase... ----------------------------------- Great news! :D ----------------------------------- guiltypleasures Wednesday, 13 February 2008, 02:39 AM Re: Spammers *war* next phase... ----------------------------------- Just in case your spammers boobie traps miss the mark, I've added some additional security in the clubhouse. Be careful about where you sit, I've added exploding woopie cushions in some of the chairs. I've recorded tormies cat meowing like a lion on fire (after he's smelled tormies old dirty slippers one too many times), this will be played whenever someone tries to come in a locked window. Also watch where you step, I've put "penguin" land minds around the permiter of the clubhouse (they stink worse than tormies farts!) Speaking of Tormies farts, I've sucesfully bottled them and have set them up as boobie traps at all entry doors. If that isn't enough, I have one last secret weapon, I"ve place a giant poster sized picture of my ex-husband on the door to the safe which should pretty much scare or kill any intruders that happen by :liar: Hope this helps tormie :) ----------------------------------- tda42 Wednesday, 13 February 2008, 02:58 AM Re: Spammers *war* next phase... ----------------------------------- I've added exploding woopie cushions in some of the chairs Thats our Guilty! :lmao: :afterburner: ----------------------------------- guiltypleasures Wednesday, 13 February 2008, 03:01 AM Re: Spammers *war* next phase... ----------------------------------- lol, yep that's me! Oh and I forgot, I also put some tuna oil on all the door knobs, that should do the trick too :) ----------------------------------- tda42 Wednesday, 13 February 2008, 03:06 AM Re: Spammers *war* next phase... ----------------------------------- Not to mention really smelly hands too. :lmao: ----------------------------------- Tormie Wednesday, 13 February 2008, 08:42 AM Re: Spammers *war* next phase... ----------------------------------- :lmao: :lmao: :lmao: :thumb: I want someone of those exploding woopie cushions , rofl :D ----------------------------------- Tormie Thursday, 26 June 2008, 07:38 PM Re: Spammers *war* next phase... ----------------------------------- A little update: all my boopie traps and the poo poo in the garden :sick: are keeping out spammers . It's a kind of fun to read the log, one can see the strategy used: everyone of this spammers uses an open proxy, I got tired to ban all that addresses, it's useless because they are thousands and the site seems to resist to Denial Of Service attacks. However here is some of the tries in the last week, most of them coming from Poland :roll: [code linenumbers=false]ID User IP Time Action Proxy Country Error Browser 347 fht5hjrgfd 82.177.193.25 2008 Jun 25 23:23 New registration (with website: www.g-g.seokatalogi.waw.pl/kategoria_25.html) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 346 jhfdgf324 89.161.208.96 2008 Jun 24 23:22 New registration (with website: www.samopomoc-zycie.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 345 qwe23r2ea 82.177.193.25 2008 Jun 24 23:09 New registration (with website: www.wiersze.seonet.az.pl/index.php?pozycja=w) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 344 fdhgfdq32 89.161.208.96 2008 Jun 24 00:14 New registration (with website: www.trendblog.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 343 hgstfrd45 89.161.208.96 2008 Jun 24 00:03 New registration (with website: www.pre-ink.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 342 kgdasfd435 89.161.208.96 2008 Jun 24 00:01 New registration (with website: www.solodruk.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 341 hgfjd54365 89.161.208.96 2008 Jun 23 23:58 New registration (with website: www.solektor.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 340 gfdhs354 89.161.208.96 2008 Jun 23 23:56 New registration (with website: www.automatysamotuszujace.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 339 546wsdgd 89.161.208.96 2008 Jun 23 23:54 New registration (with website: www.usbstick.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 338 6547wsgfd 89.161.208.96 2008 Jun 23 23:53 New registration (with website: www.tylkokulturystyka.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 337 546fdgas 89.161.208.96 2008 Jun 23 23:51 New registration (with website: www.trybunarobotnicza.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 336 fjsdfjh 89.161.208.96 2008 Jun 23 23:48 New registration (with website: www.venomcarz.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 335 6573443rstg 89.161.208.96 2008 Jun 23 23:45 New registration (with website: www.zaplanujrodzine.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 334 fhs25 89.161.208.96 2008 Jun 23 23:43 New registration (with website: www.warez.biz.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 333 gfhtrs 89.161.208.96 2008 Jun 23 23:41 New registration (with website: www.wsanok.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 332 rfdgrd4325324 89.161.208.96 2008 Jun 23 23:40 New registration (with website: www.taniebranie.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 331 78tyjghdfg234 82.177.193.25 2008 Jun 23 23:30 New registration (with website: www.opy.seonet.bytom.pl/kategoria_14.html) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 330 hddsh1324 89.161.208.96 2008 Jun 23 23:27 New registration (with website: www.salzburgerland.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 329 tv-tron 82.160.94.10 2008 Jun 22 23:22 New registration (with website: transmet.net.pl) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 328 likantropus_dei_01 82.160.94.10 2008 Jun 21 23:17 New registration (with website: haa.pl/okna-pcv/) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 327 erg4hrthregsdf 82.177.193.25 2008 Jun 20 23:06 New registration (with website: www.gg.seoonet.info/kategoria_31.html) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 326 erg4hrthregsdf 82.177.193.25 2008 Jun 20 23:06 New registration (with website: www.gg.seoonet.info/kategoria_31.html) - PL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 325 B4R3K 88.198.8.17 2008 Jun 20 20:17 New registration (with website: sbiznes.pl/) - DE - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 324 B4R3K 88.198.8.17 2008 Jun 20 17:33 New registration (with website: pomagamy.org) - DE - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 323 javox111 83.149.125.34 2008 Jun 20 03:31 New registration (with website: arthan.pl) - NL - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Page Page: profile.php Parameters: cpl_mode=all&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true http_referer: [Ban user] [Exclude User] [Ban IP address] [Exclude IP] [Probe] [Exclude Browser] 322 020705mt 89.161.163.203 2008 Jun 20 01:32 New registration (with website: www.gry.tm.pl) - PL -[/code] ----------------------------------- Whazizname Friday, 27 June 2008, 02:14 PM Re: Spammers *war* next phase... ----------------------------------- :shocked!: Wow! Tormie's got skills!! (spammers beware!) :ninja: (: