MoonPoint Support Logo


Shop Amazon Warehouse Deals - Deep Discounts on Open-box and Used ProductsAmazon Warehouse Deals

Advanced Search
Sun Mon Tue Wed Thu Fri Sat

Sat, Aug 22, 2015 10:31 pm

Forum Spammers

After setting up a Simple Machines Forum (SMF) site, I found a spammer registered from a Ukrainian IP address before I even registered the administrator account for the forum. I changed the forum configuration so that new members must be approved by the administrator and then installed themes for the forum. When I had completed installing themes, I noticed an attempt to register on the forum by five other spammers.
IDusernameEmail AddressIP Address

When I searched the Stop Forum Spam site, I didn't find the username boersmaizc listed, but I did find the email address listed with many entries from the IP address listed. The IP address is assigned to OpaTelecom in Ukraine. There were many instances of the solarnicole email address being used by the spammer from the address, but also instances of that email address being associated with IP addresses in Argentina (, China (,,,,,, and, Finland (, France (, Hong Kong (, Kahzakhstan (, Russia (, Thailand (, and the United States ( - PDF. The IP address in France was marked as "Toxic IP address or "bad" email domain".

There was another Ukrainian IP address in the list,, in the same block of IP addresses, -

Another Ukrainian IP address on the list was A search at the Réseaux IP Européens website revealed that IP address was assigned to PE Radashevsky Sergiy Oleksandrovich (ISP ReedLan). RIPE is the regional internet registry for Europe, Russia, the Middle East, and Central Asia. Another Ukrainian IP address,, from the same - block of addresses was in the list.

The remaining IP address was, which the American Registry for Internet Numbers (ARIN), a RIR, linked to Zhou Pizhong in North Kansas City, Missouri. A Stop Forum Spam search showed many entries for that IP address, which it associated with the United States, for August 22 with many prior entries as well.

All of the entries were awaiting membership approval; I deleted all of them. When I did so, I noticed another attempt to register from a Ukrainian IP address, I deleted that one as well.

[/network/web/forums/smf] permanent link

Sat, Aug 22, 2015 12:37 pm

Ukrainian forum spammer at

I set up a Simple Machines Forum (SMF) forum today using SMF 2.0.10, the latest supported release of the software. When I logged into the forum immediately after setting it up there was already one spam posting, which was a long block of text with many spam links within it.

When I viewed the member information for the spammer, I saw the following:


In the spam posting, I found a link to the website from "true religion jeans outlet" along with a lot of other links.

When I checked the spammer's profile information, I saw the following:

Posts:1 (N/A per day)

Date Registered:Today at 08:32:47 AM
Local Time:August 22, 2015, 09:44:49 AM
Last Active:Today at 08:32:52 AM

The signature the spammer had on his profile was "oakley glasses" which was a link to The registration time for the spammer was listed as 8:32:47 AM. When I checked the registration time for the administrator account I created when setting up the forum, it was 08:34:58 AM, so the spammer posted two minutes prior even to the registration of the administrator account.

The 2.1 version of SMF allows one to restrict registrations during the installation process to require admin approval, but that isn't part of the installation procedure for 2.0 versions. Instead, you need to log into the forum as an administrator after installing the software and change the registration option so that members can't register immediately. I did change the setting immediately after logging in as the administrator to Admin Approval by clicking on Admin, selecting Features and Options, then Members , then Registration, then Settings. The choices for registration are as follows:

With "Immediate Registration" as the default option when the forum software is installed, spammers can post spam if you don't act quickly to change the option. But even though I logged in as the administrator immediately after completing the installation and changed the option, I was still too late to prevent this particular spammer from posting spam.

On the profile page for the spammer, I selected Actions and then Ban this user. I then selected an expiration period of Never for a full ban for the spammer. For Triggers, I left "Ban on Email Address (e.g. *" selected with the email address he used and also left "Ban on Username" selected with his username, uwzedekzk. I also selected "Ban on IP (e.g., 192.168.10-20.*)" selected for his IP address, which was Then from his profile page, I again selected Actions and then chose "Delete this account".

When I performed a Stop Forum Spam site search, I didn't find the spammer's username nor email address listed, but I found a large number of entries for the IP address for August 22, 2015. The spammer used many usernames where the names were just random strings of characters and the email addresses likewise used random strings of characters, but all using "". The Stop Forum Spam Contry Check - Ukraine page currently shows "7775469 entries in our database from Ukraine (20.31 percent of total)", i.e., about 1/5 of forum spam is originating from Ukrainian spammers. The Spam sources by country page currently shows that their statistics for the last year show spam originating from Ukrainian IP address space in 51.7% of the spam reports (PDF).

Since the spammer uses random email addresses and usernames, I removed the email check from the SMF spammer check, leaving just the IP address check by selecting Members and then Ban list. The Stop Forum Spam site search reported "Found 1000 entries for "". I saw a prior incident with a Ukraninian forum spammer r little over 5 years ago, in July of 2010, when a Ukrainian spammer manged to post spam to one of my wife's forums.

[/network/web/forums/smf] permanent link

Once You Know, You Newegg AliExpress by

Shop Amazon Local - Subscribe to Deals in Your Neighborhood

Valid HTML 4.01 Transitional

Privacy Policy   Contact

Blosxom logo