Apr
07
2008

Fake User Registration Spam Attack Bastards

datePosted on 23:39, April 7th, 2008 by Strangely

It’s all in the title really!

However, the point of this post is that I have a few domains and it looks like the robot(s) are set up by alphabetical order, not IP order. Here’s how:

Two weeks ago and previous,

Domain A had loads of spam, Domain B had few

Now,

Domain A has few, Domain B has loads of spam.

Also, in that time, the amount of spam coming from komatoz.net has increased. So basically it’s ramping up the komatoz name as well moving from one domain batch to another. komatoz.net is in China (PRC).

Here’s a bit of the dump taken from the excellent Sabre plugin. You’ll see the sudden prevalence in komatoz … Hopefully, as all the email addresses are duff, the duff robots will pick them up and send to themselves so that maybe mail.ru and komatoz.net will do something about it. Fine chance. It’s really just for info to show the plugin operation. You can see how mail.ru has the same IP address as komatoz.net at one point and then changes it.

extigomot email hidden; JavaScript is required 78.157.143.200
kosopiss email hidden; JavaScript is required 89.149.241.229
roocawnHentee email hidden; JavaScript is required 89.149.253.220
belkatvv email hidden; JavaScript is required 89.207.216.212
kosopiss email hidden; JavaScript is required 89.149.241.229
wcportal email hidden; JavaScript is required 82.230.186.198
catwnhip email hidden; JavaScript is required 89.149.241.229
StrategiyaB email hidden; JavaScript is required 220.41.232.107
turokturru email hidden; JavaScript is required 221.120.210.45
reftywal email hidden; JavaScript is required 89.149.241.229
edwerznet email hidden; JavaScript is required 82.74.159.189
conordco email hidden; JavaScript is required 89.149.241.229
mstobil email hidden; JavaScript is required 89.149.241.229
regnewru email hidden; JavaScript is required 79.20.90.235
hateloveru email hidden; JavaScript is required 58.56.7.164
smiseeo email hidden; JavaScript is required 89.149.241.229
renoclubrur email hidden; JavaScript is required 87.118.120.202
Bookenrorgo email hidden; JavaScript is required 213.205.99.187
okvobzfuty email hidden; JavaScript is required 89.149.241.229
doktelp email hidden; JavaScript is required 89.149.241.229
Amazon Related:

Possibly Related Sites
Related Posts by Tags
categoryPosted in Software, Website | printPrint

2 Responses to “Fake User Registration Spam Attack Bastards”

  1. WordPress User Registration Spam on April 24th, 2008 at 10:14 am

    [...] and techniques change though!). This post is really a revisit and clarification of an earlier one here and shows some of the things I do to keep the spammy bastards at bay as there is no “one fix [...]

    Like or Dislike: Thumb up 0 Thumb down 0

    Reply
  2. Cuplaweb » Uninvited guests… on August 24th, 2008 at 2:34 pm

    [...] blogger who doesn’t think much of the fake user signups is using the Sabre plugin, but I am going to see how I get on with Register Plus before employing [...]

    [WORDPRESS HASHCASH] The comment’s server IP (64.13.192.16) doesn’t match the comment’s URL host IP (64.13.192.169) and so is spam.

    Like or Dislike: Thumb up 0 Thumb down 0

    Reply

Leave a Reply

Name: (required)
Email: (required) (will not be published)
Website:
Comment:

Comments links could be nofollow free.

Spam Protection by WP-SpamFree

Improve the web with Nofollow Reciprocity.

Recent Posts

Archives

Topics

© 2007-2010 Strangely Perfect All Rights Reserved

Easy AdSense by Unreal

Strangely Perfect is Digg proof thanks to caching by WP Super Cache