Attack Bots and Hacked Servers Will Get Listed Here

Comment spammers are thick on social networking sites like Digg most of their comments include a link back to a bogus site. If you go to their profile you will see all of the spam they have posted and it is easy to bury from there. Post a link to that page here and we can all bury it as spam.

Moderators: JeanInMontana, rockingmtranch, ShadowPuterDude, admin, MysteryFCM, Owner

User avatar
JeanInMontana
It's Mine!!
It's Mine!!
Posts: 3331
Joined: Fri Jun 08, 2007 6:10 am
Location: South Central Montana
Contact:

From Hoax~Slayer 6/23

Postby JeanInMontana » Fri Jun 22, 2007 7:48 pm

frequensea@bonbon.net
drypolkisa@drypol.com
martyn-172@goodsite.com
gali_plotnikov72@bk.ru

83.167.111.39
213.200.183.88
201.53.42.1

Sorry 83.167.111.39 is currently listed in APEWS :-(
Entry matching your Query: E-217628
83.167.0.0/16CASE: C-137
SANS Internet Storm Center attack sourcesSpecial Reason:
http://isc.incidents.org/sources.html Seems you are hosting attack bot[s]History:
Entry created 2007-06-23
~Think Globally * Dream Universally~Anon
ImageImageImage Donating any amount helps keep this site alive.

Lukaurod

This is info you asked

Postby Lukaurod » Sat Jun 23, 2007 2:45 pm

[url=http://www.anderson.edu/cgi/postcard/postcard.cgi?ID=118261796027571&PWD=n1y5P5]adderall[/url] <a href=http://www.windows.ucar.edu/cgi-bin/postcard.cgi?p_get=56114 >bontril</a> [url=http://www.windows.ucar.edu/cgi-bin/postcard.cgi?p_get=56114]bontril[/url] <a href=http://www.anderson.edu/cgi/postcard/postcard.cgi?ID=118262526530088&PWD=plbMsX >adipex</a> [url=http://www.anderson.edu/cgi/postcard/postcard.cgi?ID=118262526530088&PWD=plbMsX]adipex[/url] <a href=http://www.hs.iastate.edu/ecard/view.php?id=21 >vicodin</a> [url=http://www.hs.iastate.edu/ecard/view.php?id=21]vicodin[/url] <a href=http://www.anderson.edu/cgi/postcard/postcard.cgi?ID=118262544130135&PWD=pj8Ht9v >cytomel</a> [url=http://www.anderson.edu/cgi/postcard/postcard.cgi?ID=118262544130135&PWD=pj8Ht9v]cytomel[/url] <a href=http://www.hs.iastate.edu/ecard/view.php?id=22 >wellbutrin</a> [url=http://www.hs.iastate.edu/ecard/view.php?id=22]wellbutrin[/url] <a href=http://www.anderson.edu/cgi/postcard/postcard.cgi?ID=118262554730172&PWD=7BsrmEp
P >ephedra</a> [url=http://www.anderson.edu/cgi/postcard/postcard.cgi?ID=118262554730172&PWD=7BsrmEpP]ephedra[/url] <a href=http://www.windows.ucar.edu/cgi-bin/postcard.cgi?p_get=56117 >ionamin</a> [url=http://www.windows.ucar.edu/cgi-bin/postcard.cgi?p_get=56117]ionamin[/url] <a href=http://www.anderson.edu/cgi/postcard/postcard.cgi?ID=118262556830179&PWD=BQHb8x57 >fluoxetine</a> [url=http://www.anderson.edu/cgi/postcard/postcard.cgi?ID=118262556830179&PWD=BQHb8x57]fluoxetine[/url] <a href=http://www.windows.ucar.edu/cgi-bin/postcard.cgi?p_get=56115 >ephedrine</a> [url=http://www.windows.ucar.edu/cgi-bin/postcard.cgi?p_get=56115]ephedrine[/url] <a href=http://www.windows.ucar.edu/cgi-bin/postcard.cgi?p_get=56116 >glucophage</a> [url=http://www.windows.ucar.edu/cgi-bin/postcard.cgi?p_get=56116]glucophage[/url] <a href=http://www.anderson.edu/cgi/postcard/postcard.cgi?ID=118262537230121&PWD=v7svNr >clenbuterol</a> <a href=http://www.anderson.edu/cgi/postcard/postcard.cgi?ID=118261796027571&PWD=n1y5P5>adderall<
/a> [url=http://www.anderson.edu/cgi/postcard/postcard.cgi?ID=118262537230121&PWD=v7svNr]clenbuterol[/url] <a href=http://www.windows.ucar.edu/cgi-bin/postcard.cgi?p_get=56118 >lexapro</a> [url=http://www.windows.ucar.edu/cgi-bin/postcard.cgi?p_get=56118]lexapro[/url] <a href=http://www.hs.iastate.edu/ecard/view.php?id=24 >buy xanax</a> [url=http://www.hs.iastate.edu/ecard/view.php?id=24]buy xanax[/url] <a href=http://www.hs.iastate.edu/ecard/view.php?id=25>zyrtec</a> [url=http://www.hs.iastate.edu/ecard/view.php?id=25]zyrtec[/url]

User avatar
JeanInMontana
It's Mine!!
It's Mine!!
Posts: 3331
Joined: Fri Jun 08, 2007 6:10 am
Location: South Central Montana
Contact:

Postby JeanInMontana » Sat Jun 23, 2007 2:50 pm

:bst: Yes this is exactly what I asked for. :0!: Now I have your IP and I can ban it asshole!! :whp:

Sorry 66.232.125.138 is currently listed in APEWS :-(
Entry matching your Query: E-217320
66.232.96.0/19CASE: C-137
SANS Internet Storm Center attack sourcesSpecial Reason:
http://isc.incidents.org/sources.html Seems you are hosting attack bot[s]History:
Entry created 2007-06-22


Second attack bot suspect banned. I am sure they are bots, they have a pattern. All choose swimming as an occupation and swing as a hobby, Albanian is their language choice, but they are from USA, they all use the same subject line too.

I think I may have lured this one back to post via a PM. I saw they had notification for PM's on so I sent one after I added some info to their profile. Notice the signature.:rotf: This forum is lacking in IP logging via admin panel. It logs via Cpanel, but is much harder to trace down.
~Think Globally * Dream Universally~Anon
ImageImageImage Donating any amount helps keep this site alive.

User avatar
JeanInMontana
It's Mine!!
It's Mine!!
Posts: 3331
Joined: Fri Jun 08, 2007 6:10 am
Location: South Central Montana
Contact:

Lukaurod

Postby JeanInMontana » Sun Jun 24, 2007 11:43 am

Ipatiplakat and Lukaurod seem to be the same person/bot ( not confirmed either except they are listed in APEW for hosting attack bots). Using several IP's most likely a proxy service to post.
66.232.125.138 IP used for post here http://montanamenagerie.com/forum/viewt ... light=#287
66.232.126.20 used for post here http://montanamenagerie.com/forum/viewt ... ?p=289#289

I was in the process of banning the jerk when the second post appeared, these guys play hard ball.
:0!:
~Think Globally * Dream Universally~Anon
ImageImageImage Donating any amount helps keep this site alive.

User avatar
JeanInMontana
It's Mine!!
It's Mine!!
Posts: 3331
Joined: Fri Jun 08, 2007 6:10 am
Location: South Central Montana
Contact:

Attack Bots , Spam Bots & Hacked Servers

Postby JeanInMontana » Wed Aug 22, 2007 11:23 pm

Nothing quite like getting a funny feeling about a "guest" and checking the IP to get this as a result.
Additional Information: RxBot (Optix) - Used for DDoSing 87.240.15.38

It has the extreme pucker effect and I don't mean lips. Needless to say I was into the Cpanel for some ban action. I nearly lost it when it loaded a completely white page! Earlier I had gotten an error here in the forums " data base not found" and had a moment of panic ..... then I see Mr Ddossing well, I think you get the picture. Anyway another proactive mass banning in the Cpanel of some domains and IP's. We'll see. The site has been hammered pretty bad the last couple of days with spammers. There are NOT 50 members.

Edit to add I have deleted all users I am positive are spammers. They may not have been bots, I don't care. :irle: If they showed on one spam list they got the boot. :spam: :thrt:

These are bots listed at APEWS and Project Honey Pot
24.174.221.48
24.184.235.72
211.117.62.81
Last edited by JeanInMontana on Mon Aug 27, 2007 12:57 pm, edited 2 times in total.
~Think Globally * Dream Universally~Anon
ImageImageImage Donating any amount helps keep this site alive.


Return to “Mission Comment Spammer”

Who is online

Users browsing this forum: No registered users and 1 guest