CCF Archive Site

This afternoon this individual joined the site:



The IP address of this new person resolves to the University of California Office of the President: http://ucop.edu/

But what was very strange was that the "Guest" (not-logged-in) visitor count escalated around that time to over 80. That is extraordinary and there's no reason for it. This is a small unpopular site.

...Except that  there were dozens of visitors visiting one single post on this forum. There were maybe 4 or 5 posts each of which had many "visitors" landing on those pages.  And I kept seeing "Attempting to register" statuses.

It was too much of a coincidence for me.

I deleted the account of this "Sumprit" asshole with the Hotmail address. Who is probably a marbled mouthed SE Asian spammer.  I'm assuming that Sumprit was scoping the board out in preparation for spamming or an attack and that he was responsible or tied to the invasion of bots. 

I then located a plugin for SMF that lets me throttle the number of unregistered guests. I set the limit to 10 guests. It will still let search engines in.

It makes me angry how many utter jerkoffs there are on the internet. We dont' even have anything worth stealing here, and someone wants to rip us off anyway. 

That's really unusual.  It almost sounds like an attempted DOS attack.  What post were they visiting? 

Let me be clearer about what I saw and how simple it is to recognize spammers when they come in like this.

And, the details don't matter so that's why I am only saying it was "a few posts", not which ones. It's random, just the spammer's choice of URLs to come in through.

First of all, we only get a completed user registration resulting in a new member about once a month. That's the screenshot at the top of this thread. And it's an Indian name (strike 1, a BIG one). Plus a Hotmail address (nobody legitimate uses Hotmail anymore.) Plus an IP address that resolves to .edu, which is very unlikely to be legitimate. Put together I had no trust in this profile's user.

I have much more trust when: the name is not foreign sounding; the email is some ISPs or is Gmail or Yahoo; and when the IP address resolves to a residential internet provider and has words like "cable" or "fios" embedded in it.

Not rocket science, obviously.   

The board has this list I can view and most of you can't.



This list was standing at 89 - and spanned multiple pages - when I noticed. And this was maybe 1/2 hour after the Indian guy registered.

The number-of-visitors throttle plugin isn't perfect. This list has 18 total guests and it's supposed to be limited to 10.

What I see when I launch a private browsing session (not logged in) and visit as a guest now is this screen - the guest quota is filled and therefore it doesn't show me any posts or page indexes. Any registered user can still log in and see everything, however.