[Pup Patrol]

I felt bad about the Feedback threads where the darn spam posted, so I did end up reporting it.

Makes me nervous that this one has been around for a month, though.

[knowschad]

Pup Patrol, on 21 November 2011 - 06:11 AM, said:

I felt bad about the Feedback threads where the darn spam posted, so I did end up reporting it.

Makes me nervous that this one has been around for a month, though.

It sure did a lot of posting during its one day visit! Did you catch that the post about coordinate systems came right out of Wikipedia?

Quote

A geographic coordinate system is a coordinate system that enables every location on the Earth to be specified by a set of numbers. The coordinates are often chosen such that one of the numbers represent vertical position, and two or three of the numbers represent horizontal position.

I love some of the other posts! Generally bad English, often using the word, "dear".

The name RaviAuto turns up a lot of Google hits, including a company in Bengal, India, an auto repair company in South Ozone Park, NY, and numerous forum memberships.

[Pup Patrol]

Check out the username on StopForumSpam, the link to which I included in my report of the username:

http://www.stopforumspam.com/search

[knowschad]

Pup Patrol, on 21 November 2011 - 06:35 AM, said:

Check out the username on StopForumSpam, the link to which I included in my report of the username:

http://www.stopforumspam.com/search

ravi(at)rsseosolution(dot)com

I Googled the company and found that it is a search engine link building company This one lists its address as in a shopping center in India. Big time operation, I'm sure!

[kunarion]

Pup Patrol, on 21 November 2011 - 06:11 AM, said:

I felt bad about the Feedback threads where the darn spam posted, so I did end up reporting it.

Makes me nervous that this one has been around for a month, though.

Looks like our dear friend Ravi has been quarantined. Not yet quite banned. You can still find the topics, just no posts in the topics. He's like a lingering specter, invisible.

[knowschad]

kunarion, on 21 November 2011 - 10:00 AM, said:

Pup Patrol, on 21 November 2011 - 06:11 AM, said:

I felt bad about the Feedback threads where the darn spam posted, so I did end up reporting it.

Makes me nervous that this one has been around for a month, though.

Looks like our dear friend Ravi has been quarantined. Not yet quite banned. You can still find the topics, just no posts in the topics. He's like a lingering specter, invisible.

He only posted that one day in October, anyway. Just another fly-by-night, sunny-weather spambot.

[kunarion]

[The email I mention is not from my friend. It has her (obsolete) email address and her name in the "from" box, but actually originates in an open mail server. It's Spam made to look slightly authentic. It has no connection to her except for using her info, possibly gleaned from some web site.]

Here's today's email "from" my friend. I hope it's not a suicide note:

"I am finally become Boss

Hey there...
it seemed like my options were starting to become slim this is the best thing that ever happened to me now a weight is lifted off my shoulders see if its for you
[xxxxxx.com]
goodbye"

This post has been edited by kunarion: 22 November 2011 - 07:56 AM

[hzoi]

toqirnwl wants us to compare cheap loans. How about...not?

[Eartha]

Thanks for reporting it!
My best laugh though was Pup Patrol's report.

Quote

spam

which is "maps" spelled backwards. Interesting.

I had to share it with you here. Thanks for the chuckle!

[Pup Patrol]

You're welcome.

I thought just typing "spam" was getting a bit boring, so I've been trying to come up some ways to amuse the moderators.

Glad it worked.

[knowschad]

Pup Patrol, on 22 November 2011 - 01:13 PM, said:

You're welcome.

I thought just typing "spam" was getting a bit boring, so I've been trying to come up some ways to amuse the moderators.

Glad it worked.

Next time, give this a shot:

Man:You sit here, dear.
Wife:All right. Man:Morning! Waitress:Morning! Man:Well, what've you got? Waitress:Well, there's egg and bacon; egg sausage and bacon; egg and spam; egg bacon and spam; egg bacon sausage and spam; spam bacon sausage and spam; spam egg spam spam bacon and spam; spam sausage spam spam bacon spam tomato and spam; Vikings:Spam spam spam spam...

[kunarion]

This bot is 18 years old:
http://forums.Ground...howtopic=286453

[knowschad]

kunarion, on 02 December 2011 - 10:01 PM, said:

This bot is 18 years old:
http://forums.Ground...howtopic=286453

R.I.P.

[The Blorenges]

knowschad, on 03 December 2011 - 10:01 PM, said:

kunarion, on 02 December 2011 - 10:01 PM, said:

This bot is 18 years old:
http://forums.Ground...howtopic=286453

R.I.P.

Do bots R.I.P. I wonder?

Do they rest in bytes?

There's probable a more technical term for a dead bot.

Somebody will know.


MrsB

[knowschad]

The Blorenges, on 04 December 2011 - 03:29 AM, said:

knowschad, on 03 December 2011 - 10:01 PM, said:

kunarion, on 02 December 2011 - 10:01 PM, said:

This bot is 18 years old:
http://forums.Ground...howtopic=286453

R.I.P.

Do bots R.I.P. I wonder?

Do they rest in bytes?

There's probable a more technical term for a dead bot.

Somebody will know.


MrsB

Naw... I think they just move on to another forum.

[kunarion]

http://forums.Ground...howtopic=286789

Posted Today, 06:52 PM
"Amazing! I saw a woman wearing such clothes the first time I came to California.


I saw a woman wearing this the first time I came to California.
I almost see her body through it,
have you experienced it?"

This post has been edited by XINDE: Today, 06:52 PM


---
That's almost like HAICAP written in reverse!

This post has been edited by kunarion: 08 December 2011 - 04:32 PM

[knowschad]

kunarion, on 08 December 2011 - 04:32 PM, said:

http://forums.Ground...howtopic=286789

Posted Today, 06:52 PM
"Amazing! I saw a woman wearing such clothes the first time I came to California.


I saw a woman wearing this the first time I came to California.
I almost see her body through it,
have you experienced it?"

This post has been edited by XINDE: Today, 06:52 PM

Wow! It even started the thread. How bold! Think you can recruit the bot for the basis of the new automatic cache reviewer software that we are designing?

[kunarion]

knowschad, on 08 December 2011 - 04:33 PM, said:

kunarion, on 08 December 2011 - 04:32 PM, said:

http://forums.Ground...howtopic=286789

Posted Today, 06:52 PM
"Amazing! I saw a woman wearing such clothes the first time I came to California.


I saw a woman wearing this the first time I came to California.
I almost see her body through it,
have you experienced it?"

This post has been edited by XINDE: Today, 06:52 PM

Wow! It even started the thread. How bold! Think you can recruit the bot for the basis of the new automatic cache reviewer software that we are designing?

And now let us all have a moment of silence for the robot who went to California to almost see a woman's body through her clothes. Moment's over.

[Pup Patrol]

Spammers aren't always obvious, and can sound quite innocuous and "normal":

http://forums.Ground...howtopic=291999

But if you do a Google search for the username "amelitarevilla" and check it on StopForumSpam, then it becomes quite clear that it's a spammer.

http://www.stopforumspam.com/





B.

[kunarion]

Pup Patrol, on 21 March 2012 - 08:16 AM, said:

But if you do a Google search for the username "amelitarevilla"

I saw the title of the OP but hadn't read it. Looks like Amelita is currently hitting thousands of forums, and is improving its spelling.

"Hello i am Amelita A. Revilla
Newbie in this forum.
Im glad to be part of this community
Hope to learnd a lot from you guy."

It would be VERY useful to know forums that commonly get spammed in such widespread attacks, which display the IP address of forum posts. I see in your link that the IP address works out to the Philippines. I've found a very similar post (possibly human-assisted) as far back as 2007, by someone "in Manila".

Here's an instance where the Bot used the wrong area for the "introduction" OP:
http://www.neoseeker...melita-revilla/

The typical Bots around here sign up for a GC account, sign in to the site and these forums, and post a benign reply based on real sentences from other forums. The Amelita Bot has two canned texts. Once logged in, it will gather all the info possible before being kicked (at which time it can sign up as a less obvious user). Then it likely searches for exploits, gathers email addresses, user names, real names, friends lists, and cross-references them to create and sell an accurate database to whoever is buying.

This post has been edited by kunarion: 21 March 2012 - 09:10 AM

[Pup Patrol]

I've posted two separate reports for the amelita spammer. The thread and the account are still active.



I know it's a spammer. It's really, really obvious. That's why I included the Google search results and the link to StopForumSpam when I reported the post.



B.

[kunarion]

Pup Patrol, on 21 March 2012 - 09:18 AM, said:

I've posted two separate reports for the amelita spammer. The thread and the account are still active.

These things are evidently a low priority. Once kicked, do the hackers send a broader attack? If so, leaving the lesser evil alone may keep the situation calm for a while.

[Pup Patrol]

kunarion, on 21 March 2012 - 09:32 AM, said:

Pup Patrol, on 21 March 2012 - 09:18 AM, said:

I've posted two separate reports for the amelita spammer. The thread and the account are still active.

These things are evidently a low priority. Once kicked, do the hackers send a broader attack? If so, leaving the lesser evil alone may keep the situation calm for a while.

I've reported other spammers, and seen them disappear really quickly.

I've seen no evidence that previously reported (and deleted) spammers have done any "broader attacks" on these forums.

These spammers don't target particular sites. They just spray out their garbage in as many as possible venues. Frequent and random seem to be their watchwords.

I've posted a 3rd report on the amelita one, and it's still there. Groundspeak should have the evidence in hand to determine that it's a prolific spammer. I am stumped as to why it's taking so long to deal with this one.




B.

[Castle Mischief]

Looks like the thread was trashed-out.

[kunarion]

Castle Mischief, on 21 March 2012 - 11:04 AM, said:

Looks like the thread was trashed-out.

'Bye, "Amelita A. Revilla", Hope to learnd a lot from you guy!

[kunarion]

The most beautiful Spam Bot ever:
http://forums.Ground...howtopic=293431

[TheAlabamaRambler]

If you are worried about bots scooping up your IP Address just hide it.

http://untraceablema...and-how-it.html

[knowschad]

kunarion, on 05 April 2012 - 01:35 PM, said:

The most beautiful Spam Bot ever:
http://forums.Ground...howtopic=293431

That is the Mandarin duck, I believe... very similar to, but even more elegant than our wood duck (I know this from my fly-tying days) I didn't check the link... did you?

[kunarion]

knowschad, on 05 April 2012 - 03:17 PM, said:

kunarion, on 05 April 2012 - 01:35 PM, said:

The most beautiful Spam Bot ever:
http://forums.Ground...howtopic=293431

That is the Mandarin duck, I believe... very similar to, but even more elegant than our wood duck (I know this from my fly-tying days) I didn't check the link... did you?

The link is the host site for the picture, "Great Gallery Dike, The world's longest gallery wall". It looks something like a Flickr page.

[kunarion]

A Geocacher joined today, and rather than Geocache, placed a Spam URL with part of a wordy travel article in the Travel Bug forum. Get it? The "Travel Bug". Such a clever bot!
http://forums.Ground...howtopic=293774

[kunarion]

Today's Spam Bot arrived in the Travel Bug forum to sell iPhone cases to the Dutch:
http://forums.Ground...howtopic=293797

[Pup Patrol]

kunarion, on 11 April 2012 - 05:52 AM, said:

Today's Spam Bot arrived in the Travel Bug forum to sell iPhone cases to the Dutch:
http://forums.Ground...howtopic=293797

I've reported that one twice. The second report included a Google translation of the post.

An obvious spam-link should speak for itself.





B.

[Pup Patrol]

Oh yeah:

http://forums.Ground...howtopic=293862







B.

[Michaelcycle]

Pup Patrol, on 12 April 2012 - 06:22 AM, said:

Oh yeah:

http://forums.Ground...howtopic=293862







B.

Sniff, sniff...do I smell bleach?

[The Blorenges]

I think another of those little spambots just crawled in.

Here.


I've reported it so I hope a Mod with the bug spray can will zap it soon.


MrsB

[kunarion]

A bot joined at 1:00am today, and began posting around 7:00. It has an East Indian sounding nick. It seems to use fractured paragraphs from Yahoo Answers of a DIY theme, and a couple of words link to one particular site in New Zealand that sells an industrial leveling compound.

At this time, the bot has posted five different spams, two-word titles and one phrase title, all in the General Challenges Topics. Five posts are too many to go unnoticed, so I'm guessing this bot is broken. Unless it's a flood bot, in which case it's not much of a flood, so this bot is broken.

Example:

To fix a crack in the wall, we should keep in mind that Bricks, concrete and limestone may show occasional cracks. Remove debris with a hard bristle brush. When you are sure that no more loose bits and pieces come out, switch to the paintbrush to get rid of dust. Dip the paintbrush into the cup of water and moisten the inside of the crack. Scoop up a glob of cement with the putty knife, apply it to the crack and smooth it into place. Protect the cement from moisture, let it dry completely and then paint over the fixed crack.

This post has been edited by kunarion: 30 May 2012 - 04:40 AM

[Pup Patrol]

That DIY spammer was reported by at least two members, before vanishing.

Maybe it was going for the Very Busy Day Spam Posting Cache Challenge?





B.

[kunarion]

I got this unusual Spam in my email. The exact same thing was sent to three similar email addresses (in Blind Carbon Copy "Bcc", which for some reason is in view). That's odd, because with no actual name or address in the email, how do we know which one of us the package is for?

It came with a file attachment, which is a program to run "to make a label". One day in the distant future, a "label" may be some kind of image file, but for now, it's a program that doesn't have a "label" at all, just malicious software. It is pretty cool that I can pick up a package that's in "Montgomery" by visiting the "nearest post office" and presenting a "label", for a package that has an invalid address. Did you know that's how the USPS works?

But the attachment is compressed with "RAR", so there's a hitch. I'd have to go find a special program to even open it. Oh well, the other guys can go get the package that was mailed to three different people at once, from the almost-English "USPS" company in Malaysia.

Only my closest friends call me "Postal notification", so I'm pretty sure it's real.



===================

Postal notification,

We couldn’t deliver your parcel.

Status deny: Address delivery doesn’t exist in database.
LOCATION OF YOUR PARCEL:Montgomery
STATUS: sorting
SERVICE: Standard Shipping
Parcel number:U399904297 NU
FEATURES: No

The label of your parcel is enclosed to the letter.
Print a label and show it at your post office.

Attention!
If the parcel isn’t received within 30 working days our company will have the right to claim compensation from you for it's keeping in the amount of $21.85 for each day of keeping of it.

You can find the information about the procedure and conditions of parcels keeping in the nearest office.

Thank you for your attention.
USPS Customer.

This post has been edited by kunarion: 08 June 2012 - 07:28 AM

[knowschad]

Yeah, I've received a couple like that recently. One specified an exact invoice amount, and yet the email had a cc list of perhaps 100 recipients.

[hzoi]

kunarion, on 08 June 2012 - 07:19 AM, said:

LOCATION OF YOUR PARCEL:Montgomery

I'm on it.

[hzoi]

kunarion, on 08 June 2012 - 07:19 AM, said:

Only my closest friends call me "Postal notification", so I'm pretty sure it's real.

nice! []

[knowschad]

kunarion, on 08 June 2012 - 07:19 AM, said:

Only my closest friends call me "Postal notification", so I'm pretty sure it's real.

That's odd... my friends say that to others when they see me approaching.

[The Blorenges]

I have a suspicion that this could be another of those spambots:

"The event lover"

MrsB

[Pup Patrol]

The Blorenges, on 11 June 2012 - 03:25 AM, said:

I have a suspicion that this could be another of those spambots:

"The event lover"

MrsB

I did a google search for the username kewson12 before reporting it as spam. The list of forums that it is a member of is mighty impressive and diversified. (That's a tipoff that it's a spammer.)




B.

[The Blorenges]

Pup Patrol, on 11 June 2012 - 06:02 AM, said:

The Blorenges, on 11 June 2012 - 03:25 AM, said:

I have a suspicion that this could be another of those spambots:

"The event lover"

MrsB

I did a google search for the username kewson12 before reporting it as spam. The list of forums that it is a member of is mighty impressive and diversified. (That's a tipoff that it's a spammer.)

B.

... and Fizzzz...Pop!

Another puff of pink smoke

[hzoi]

My money's on this guy, who seems more concerned with Windows 7 compatibility than geocaching. Only two posts...must be testing the waters.

[kunarion]

hzoi, on 14 June 2012 - 12:03 PM, said:

My money's on this guy, who seems more concerned with Windows 7 compatibility than geocaching. Only two posts...must be testing the waters.

Great find! That's quite an advanced one, using the thread title in a sentence, even quoting a previous post. But asking how to delete caches on GPS upon joining Geocaching.com is a huge red flag. The phrases are not well composed. And being contentious about getting no answer, when not only was the question already answered, the bot had never asked, just looks sloppy. And the Spam links detract. I give it a 3.

This post has been edited by kunarion: 14 June 2012 - 01:28 PM

[kunarion]

sorry, double post.

This post has been edited by kunarion: 14 June 2012 - 01:26 PM

[hzoi]

Now that I know the tells, it's pretty easy to spot them. Just have to hit the right threads.

[kunarion]

A spam bot arrived today in the CITO forum, with the word "wig" in its name, posting the topic "HUMAN HAIR WIG" with a touching story about needing a wig, a question on where to get one, and a link to where it found a great deal and bought a wig.

Sometimes I think the Spam Bots aren't even trying anymore.

This post has been edited by kunarion: 13 July 2012 - 08:25 PM