After setting up a Simple Machines Forum
site, I found a
spammer registered from a Ukrainian IP address
before I even registered
the administrator account for the forum. I changed the forum configuration
so that new members must be approved by the administrator and then installed
forum. When I had completed installing themes, I noticed an attempt to
register on the forum by five other spammers.
|ID||username||Email Address||IP Address|
When I searched the Stop Forum
Spam site, I didn't find the username
boersmaizc listed, but
I did find the email address listed with many entries from the IP address
184.108.40.206 listed. The IP address is assigned to OpaTelecom in
Ukraine. There were many
instances of the solarnicole email address being used by the spammer from
the 220.127.116.11 address, but also instances of that email address being
associated with IP addresses in Argentina (18.104.22.168), China
(22.214.171.124, 126.96.36.199, 188.8.131.52, 184.108.40.206, 220.127.116.11,
18.104.22.168, and 22.214.171.124), Finland (126.96.36.199),
France (188.8.131.52), Hong Kong (184.108.40.206), Kahzakhstan
(220.127.116.11), Russia (18.104.22.168), Thailand (22.214.171.124), and
the United States (126.96.36.199) -
The IP address in France was marked as "Toxic IP address or "bad" email domain".
There was another Ukrainian IP address in the list, 188.8.131.52, in the
same block of IP addresses,
184.108.40.206 - 220.127.116.11.
Another Ukrainian IP address on the list was 18.104.22.168. A search
at the Réseaux IP Européens
website revealed that IP address was assigned to PE Radashevsky Sergiy
Oleksandrovich (ISP ReedLan). RIPE is the
internet registry for Europe, Russia, the Middle East, and Central Asia.
Another Ukrainian IP address, 22.214.171.124, from the same
126.96.36.199 - 188.8.131.52 block of addresses was in the list.
The remaining IP address was 184.108.40.206, which the
American Registry for Internet Numbers (ARIN), a RIR, linked to Zhou
Pizhong in North Kansas City, Missouri.
A Stop Forum Spam search
showed many entries for that IP address, which it associated with the
United States, for August 22 with many prior entries as well.
All of the entries were awaiting membership approval; I deleted all of them.
When I did so, I noticed another attempt to register from a
Ukrainian IP address, 220.127.116.11. I deleted that one as well.
Ukrainian forum spammer at 18.104.22.168
I set up a Simple Machines Forum (SMF)
forum today using SMF 2.0.10, the latest supported release of the
software. When I logged into the forum immediately after setting it up
there was already one spam posting, which was a long block of text with
many spam links within it.
When I viewed the member information for the spammer, I saw the following:
In the spam posting, I found a link to the website from "true religion jeans
outlet" along with a lot of other links.
When I checked the spammer's profile information, I saw the following:
|Posts:||1 (N/A per day)|
|Date Registered:||Today at 08:32:47 AM|
|Local Time:||August 22, 2015, 09:44:49 AM|
|Last Active:||Today at 08:32:52 AM|
The signature the spammer had on his profile was "oakley glasses" which
was a link to http://www.oakley-sunglass.us.org/. The registration time for
the spammer was listed as 8:32:47 AM. When I checked the registration time
for the administrator account I created when setting up the forum, it was
08:34:58 AM, so the spammer posted two minutes prior even to the registration
of the administrator account.
The 2.1 version of SMF allows one to restrict registrations during the
installation process to require admin approval, but that isn't part of the
installation procedure for 2.0 versions. Instead, you need to log into the
forum as an administrator after installing the software and change the
registration option so that members can't register immediately. I did
change the setting immediately after logging in as the administrator to
Admin Approval by clicking on Admin, selecting Features
and Options, then Members , then Registration, then
Settings. The choices for registration are as follows:
- Immediate Registration
- Email Activation
- Admin Approval
- Registration Approval
With "Immediate Registration" as the default option when the forum software
is installed, spammers can post spam if you don't act quickly to change the
option. But even though I logged in as the administrator immediately after
completing the installation and changed the option, I was still too late
to prevent this particular spammer from posting spam.
On the profile page for the spammer, I selected Actions
and then Ban this user. I then selected an expiration period
of Never for a full ban for the spammer. For Triggers,
I left "Ban on Email Address (e.g. *@badsite.com)" selected with the
email address he used and also left "Ban on Username" selected with his
username, uwzedekzk. I also selected "Ban on IP (e.g., 192.168.10-20.*)"
selected for his IP address, which was 22.214.171.124. Then from his
profile page, I again selected Actions and then chose "Delete
When I performed a Stop Forum
Spam site search, I didn't find the spammer's username nor email address
listed, but I found a large number of entries for the IP address for August
22, 2015. The spammer used many usernames where the names were just random
strings of characters and the email addresses likewise used random strings
of characters, but all using "@gmail.com". The Stop Forum Spam
Contry Check - Ukraine
page currently shows "7775469 entries in our database from Ukraine
(20.31 percent of total)", i.e., about 1/5 of forum spam is originating from
Ukrainian spammers. The
Spam sources by country page currently shows that their statistics for
the last year show spam originating from Ukrainian IP address space in 51.7%
of the spam reports (PDF).
Since the spammer uses random email addresses and usernames,
I removed the email check from the SMF spammer check, leaving just
the IP address check by selecting Members and then Ban
list. The Stop Forum Spam site search reported "Found 1000 entries
for "126.96.36.199". I saw a prior incident with a Ukraninian forum spammer
r little over 5 years ago, in July of 2010, when a
manged to post spam to one of my wife's forums.