OT-Mysterious spammer network constantly trying to register for PM

Milacron · Aug 13, 2014

In spite of "Captcha" and two questions to answer (one of which one needs some basic manufacturing awareness to answer without Googling), for a few months now there has been a relentless number of spammers trying to register for PM such that I have to open every entry one by one to examine. I won't go into the details but even with wildly different answers for location, interests and occupation it's obvious they are all from the same group or person.

Every once in a while a spammer get's thru on PM but far as I can tell it's never one of these. So here these guys are attempting 20 or more times to get PM membership per day for months and yet far as I know always rejected and yet they keep it up, never tiring.

Just wondering if anyone here has read anything definitive somewhere as to what is going on here ? Maybe some Vietnamese getting paid a few cents per spam attempt no matter what the results ?

CAPCNC · Aug 13, 2014

No insight to the matter but thanks for being a great watch dog.

tjbaudio · Aug 13, 2014

Are you tracking the IP adresses? Could be traced back to a specific ISP.

Milacron · Aug 13, 2014

tjbaudio said:
Are you tracking the IP adresses? Could be traced back to a specific ISP.

Haven't checked lately as they seemed to be most anywhere. Checked five ISP's just now... all different numbers... two in Los Angeles, one in New York, one in France, one in Serbia... all different providers. The same spammer or group of spammers working for the same entity..for sure.

Curious what these morons want.. seeing as even if they did get thru and post, with rare exceptions (like when I'm asleep !) the post would be pointed out to me within minutes, deleted and they banned.

jCandlish · Aug 13, 2014

Milacron said:
So here these guys are attempting 20 or more times to get PM membership per day for months and yet far as I know always rejected and yet they keep it up,

They are most likely using the membership form as a springboard for a 3rd party attack or probe, as a relay, by spoofing their originating address.

Also, in this a way a messenger can anonymize themselves by using a random websites rejected form data as a relaying mechanism.

never tiring.

Why would they, so long as the messages get through?
.

dian · Aug 13, 2014

you sound very knowledgeable. can you explain that, please, so i can understand?

Milacron · Aug 13, 2014

<jbc> said:
Why would they, so long as the messages get through?

What messages ?

jCandlish · Aug 13, 2014

dian said:
can you explain that, please, so i can understand?

There are probably tens of thousands of websites that run some kind of vBulletin forum, all with very similar membership sign-up pages.

Behind the sign-up page there is form-data that is sent via http protocol.

In the case that the sign-up is rejected, a negative-acknowledgment is sent back to the originator of the enrollment process. This negative acknowledgement contains a significant portion of the originating form data. By spoofing the originators address that form data is sent to a 3rd party. As an anonymized message.

Many thousands of websites each handling 20 'forwards' per day adds up to significant bandwidth.

.

morsetaper2 · Aug 13, 2014

As for the spammers that do get through & post, how is it best to point them out? In the past I click the little triangle with the exclamation point.... the "Report Post" icon, in lower left of each post. And type "spammer" into the message box that pops up and submit.

Is that how spammers should be reported?

pri0ritize · Aug 13, 2014

There is also not really an incentive for them to stop trying. It's highly unlikely that it is a person attempting to specifically gain membership to this site. It's just a computer program that someone wrote and tries an enormous list of sites. It could be malicious, it could be a kid trying to write an algorithm to beat Captcha or any of the other tests people set out to determine if a user is human. The reason you're seeing different IP's is most likely the person that wrote the program is using a botnet to issue the requests.

BobRenz · Aug 13, 2014

First, my congratulations and very sincere THANKS! for working to keep this a site we can use. This site provides an excellent forum for machine tool discussions - even more excellent since it's a well managed site.

The many registration attempts you are fighting off are proof that anyone who has a computer needs good virus/malware/trojan/whatever protection. In my opinion, you need something that stays current through regular updates from the software supplier as well.

As they say: "The most expensive insurance is not having any insurance at all..."

Milacron · Aug 13, 2014

pri0ritize said:
There is also not really an incentive for them to stop trying. It's highly unlikely that it is a person attempting to specifically gain membership to this site. It's just a computer program that someone wrote and tries an enormous list of sites.

In this case it seems to be actual people trying to gain access. For example I could see the possibility of someone writing a program to answer the questions automatically but only after the answers are determined and a new line of code entered for the new answers. But in this case when I change the questions and answers, there is virtually no delay between doing so and the continued onslaught of the same spammers. If all "bot" one would think there would be a delay of a day or two while a human figures out the new answers to program in....but there isn't.

QuickJobShop · Aug 13, 2014

I get tons of registrations for my site as well. Not a msg board like this but gives the ability to comment. With the range of IP addresses I guess it is just a bot network that is registering via a script. Captcha is supposed to weed out this but I think some of the scripts can get by it. What I do see is that the email address domain is the same for each registration that is part of the attack.

jhruska · Aug 13, 2014

Thanks for blocking trash.
Reminds me of the recent false documents/passports spam.
John

Milacron · Aug 13, 2014

<jbc> said:
In the case that the sign-up is rejected, a negative-acknowledgment is sent back to the originator of the enrollment process. This negative acknowledgement contains a significant portion of the originating form data. By spoofing the originators address that form data is sent to a 3rd party. As an anonymized message.

There is an option in VB control panel to send emails only to those that are accepted and to not send email to those that are rejected (deleted)...wonder if that would help ? The only problem with that is occassionaly I reject someone legit (they put city only, leave out occupation, etc) and so they email afterwards to find out why.

Vernon Tuck · Aug 13, 2014

Milacron said:
Haven't checked lately as they seemed to be most anywhere. Checked five ISP's just now... all different numbers... two in Los Angeles, one in New York, one in France, one in Serbia... all different providers. The same spammer or group of spammers working for the same entity..for sure.

Curious what these morons want.. seeing as even if they did get thru and post, with rare exceptions (like when I'm asleep !) the post would be pointed out to me within minutes, deleted and they banned.

Whatever vile creature they may be, I'm confident they definitely are not "morons". The relentless nature of it sounds to me like a bot attack.

V

Thomas Paine · Aug 13, 2014

JBC, so you're saying the following:

-they sign up as many accounts as possible at as many forums as possible.........
-all the denial emails come back to a 3rd party, like maybe the mayor of Ferguson MO.
-the Ferguson MO servers go down because they are overloaded.
-'denial of service' attack complete.

Correct?

Milacron · Aug 13, 2014

Vernon Tuck said:
Whatever vile creature they may be, I'm confident they definitely are not "morons". The relentless nature of it sounds to me like a bot attack.

I disagree...they are morons...otherwise it wouldn't be so obvious they are spammers...not only spammer but the same spammer. We are lucky that the vast majority of spammers (or the originators of the spam programs) are breathingly stupid people.

jCandlish · Aug 13, 2014

Milacron said:
wonder if that would help ?

You're sending e-mails as NAKs! :eek:

There is no reason to wonder.

Practicalmachinist's sign-up form is a Spam forwarder.

.

Royldean · Aug 13, 2014

What's a NAK?

OT-Mysterious spammer network constantly trying to register for PM

Administrator

Aluminum

Plastic

Administrator

Titanium

Titanium

Administrator

Titanium

Diamond

Aluminum

Stainless

Administrator

Plastic

Titanium

Administrator

Stainless

Hot Rolled

Administrator

Titanium

Stainless

Similar threads