From dirk at haun-online.de  Mon Jan 21 14:04:26 2008
From: dirk at haun-online.de (Dirk Haun)
Date: Mon, 21 Jan 2008 20:04:26 +0100
Subject: [geeklog-spam] [geeklog-devel] Bad Behavior and spammers
In-Reply-To: <002401c85c29$26b59cb0$fe00a8c0@ns2.spacequad.com>
References: <mailman.103.1200887640.76035.geeklog-devel@lists.geeklog.net>
	<002401c85c29$26b59cb0$fe00a8c0@ns2.spacequad.com>
Message-ID: <20080121190426.1334471202@smtp.haun-online.de>

Michael Brusletten wrote:

>I know this is not really the place to post this

Yep. How about using the geeklog-spam list?

Btw, where's the connection between Bad Behavior and Casino spam?

bye, Dirk


-- 
http://www.geeklog.net/
http://geeklog.info/



From ironmax at spacequad.com  Tue Jan 22 11:21:46 2008
From: ironmax at spacequad.com (Michael Brusletten)
Date: Tue, 22 Jan 2008 11:21:46 -0500
Subject: [geeklog-spam] geeklog-spam Digest, Vol 7, Issue 1
References: <mailman.11.1201014002.29416.geeklog-spam@lists.geeklog.net>
Message-ID: <001901c85d12$e2388ad0$fe00a8c0@ns2.spacequad.com>

Dirk,

Funny you should ask.  Have you not seen the spam postings about the casino
spam in BB2?   Here is an example below,  Anyone seeing this type of spam in
BB2, please let me know by sending an email to admin at spacequad.com  Reason I
ask is because the Casino-on-net owners are asking me to get as many site
owners together to send proof that it is more widespread than just my
domain.  They are attempting to shut down the rogue affiliate that is
damaging their image.

Michael


Entry details

IP Address: 222.252.228.180 [ Search ]  <---- Offending IP address of the
spammer that was used to connect to the internet, or proxy IP.
Date: 2008-01-20 04:37:02  <------ Date and Time in UTC
Reason: Required header 'Accept' missing  <---  Reject reason

POST /forum/createtopic.php HTTP/1.0 <--- Type of postCookie: <------- Self
ExplainitoryHost: www.spacequad.com  <--- What primary site to post
toUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)  <
Self ExplainitoryContent-Length: 1898  <------ Message lengthContent-Type:
application/x-www-form-urlencoded  <---- Self ExplainitoryResponse:

forum: 25 <----- Forum ID numberid: 174  <----- Message ID to post
tomodedit: 0method: postreplyeditpost: editpid: editid: page: 0aname: texas
holdem poker downloadmood: happyaddbbcode18: blackaddbbcode20: 18helpbox:
sonneries telephones portablessubject: free ringtones for cell phonecomment:
[url=http://groups.google.it/group/spenser8422/web/il-poker]il poker[/url]
http://groups.google.it/group/spenser8422/web/il-poker <a
href=http://groups.google.it/group/spenser8422/web/il-poker>il poker</a>
http://groups.google.be/group/kendall9706/web/sonneries-telephones
[url=http://groups.google.be/group/kendall9706/web/sonneries-telephones]sonn
eries telephones[/url] <a
href=http://groups.google.be/group/kendall9706/web/sonneries-telephones>sonn
eries telephones</a>
[url=http://groups.google.ca/group/geisman2948/web/how-to-download-ringtones
]how to download ringtones[/url] <a
href=http://groups.google.ca/group/geisman2948/web/how-to-download-ringtones
>how to download ringtones</a>
http://groups.google.ca/group/geisman2948/web/how-to-download-ringtones
[url=http://groups.google.com.au/group/ciaran8504/web/casino-craps]casino
craps[/url] http://groups.google.com.au/group/ciaran8504/web/casino-craps <a
href=http://groups.google.com.au/group/ciaran8504/web/casino-craps>casino
craps gambling online</a>
[url=http://groups.google.hu/group/maya3907/web/poly-ringtones-3]poly
ringtones[/url] http://groups.google.hu/group/maya3907/web/poly-ringtones-3
<a href=http://groups.google.hu/group/maya3907/web/poly-ringtones-3>poly
ringtones</a>captcha: download gioco poker gratiscsid: 47261aaa4a49postmode:
textsubmit: Submit----------------------



Message: 1
Date: Mon, 21 Jan 2008 20:04:26 +0100
From: "Dirk Haun" <dirk at haun-online.de>
Subject: Re: [geeklog-spam] [geeklog-devel] Bad Behavior and spammers
To: <geeklog-spam at lists.geeklog.net>
Cc: geeklog-devel <geeklog-devel at lists.geeklog.net>
Message-ID: <20080121190426.1334471202 at smtp.haun-online.de>
Content-Type: text/plain; charset=ISO-8859-1

Michael Brusletten wrote:

>I know this is not really the place to post this

Yep. How about using the geeklog-spam list?

Btw, where's the connection between Bad Behavior and Casino spam?

bye, Dirk


-- 
http://www.geeklog.net/
http://geeklog.info/



------------------------------

_______________________________________________
geeklog-spam mailing list
geeklog-spam at lists.geeklog.net
http://eight.pairlist.net/mailman/listinfo/geeklog-spam


End of geeklog-spam Digest, Vol 7, Issue 1
******************************************

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist8.pair.net/pipermail/geeklog-spam/attachments/20080122/942dcf97/attachment.html>

From dirk at haun-online.de  Tue Jan 22 15:18:53 2008
From: dirk at haun-online.de (Dirk Haun)
Date: Tue, 22 Jan 2008 21:18:53 +0100
Subject: [geeklog-spam] geeklog-spam Digest, Vol 7, Issue 1
In-Reply-To: <001901c85d12$e2388ad0$fe00a8c0@ns2.spacequad.com>
References: <mailman.11.1201014002.29416.geeklog-spam@lists.geeklog.net>
	<001901c85d12$e2388ad0$fe00a8c0@ns2.spacequad.com>
Message-ID: <20080122201853.294228805@smtp.haun-online.de>

Michael Brusletten wrote:

>Funny you should ask.  Have you not seen the spam postings about the casino
>spam in BB2?

Nope. BB2 does not display the content of the posts by default. I assume
there's a template variable for that, but it's not used normally.


>Reason I
>ask is because the Casino-on-net owners are asking me to get as many site
>owners together to send proof that it is more widespread than just my
>domain.  They are attempting to shut down the rogue affiliate that is
>damaging their image.

Too bad. I thought you were trying to alert Google Groups. I get lots of
porn and pills spam with Google Groups URLs. Last time I checked, I
couldn't even find a proper abuse address to contact there ...

bye, Dirk


-- 
http://www.geeklog.net/
http://geeklog.info/



From ironmax at spacequad.com  Wed Jan 23 11:02:21 2008
From: ironmax at spacequad.com (Michael Brusletten)
Date: Wed, 23 Jan 2008 11:02:21 -0500
Subject: [geeklog-spam] Bad Behavior and spammers
References: <mailman.7.1201100402.61329.geeklog-spam@lists.geeklog.net>
Message-ID: <04e501c85dd9$57acd4d0$fe00a8c0@ns2.spacequad.com>

Yeah I wish there was a proper Google address to report to as well.  All
they have is the abuse at google.com  They do have an onlie form that you can
use for search results spam at http://www.google.com/contact/spamreport.html
or online reporting of google pages spam at
http://www.google.com/support/pages/bin/request.py?contact_type=abuse_spam&extra.IssueType=abuse_spam

You are right though, if you try to report to the abuse email at google, it
really doesn't go anywheres.

Michael Brusletten wrote:

>>Funny you should ask.  Have you not seen the spam postings about the
casino
>>spam in BB2?
>
>Nope. BB2 does not display the content of the posts by default. I assume
>there's a template variable for that, but it's not used normally.

Your correct on a small change that would allow you to see this info.  Have
a look at this thread
http://www.gllabs.org/forum/viewtopic.php?showtopic=6723 over on GLLabs and
download the Entry.zip file to make the changes.  Then you will be able to
start actually seeing the content that these spammers are trying to post to
the site.  The info is already there in the database, you just have to make
a template file change.

>>Reason I
>>ask is because the Casino-on-net owners are asking me to get as many site
>>owners together to send proof that it is more widespread than just my
>>domain.  They are attempting to shut down the rogue affiliate that is
>>damaging their image.

>Too bad. I thought you were trying to alert Google Groups. I get lots of
>porn and pills spam with Google Groups URLs. Last time I checked, I
>couldn't even find a proper abuse address to contact there ...

For now...can you make the change and then send me a few entry posts to my
admin email.  Then I can forward that off to the proper place.  Then
hopefully geeklog.net will be removed from any further postings.  You may
want to do this to other sites as well that you have control over.  Please
send seperate emails for each site involved.  This goes for anyone else that
want to stop these spammers.  BTW, if your wondering, its the same spam gang
doing the google pages spam.  So if you want off their lists, let me know.

I haven't really seen any postings in the last few days now on
spacequad.com.  Not even in the BB2 database.  Its really nice not having to
worry about disk space and bandwidth usage caused by spam.


Michael

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist8.pair.net/pipermail/geeklog-spam/attachments/20080123/3b95fd65/attachment.html>

From dirk at haun-online.de  Wed Jan 23 15:29:25 2008
From: dirk at haun-online.de (Dirk Haun)
Date: Wed, 23 Jan 2008 21:29:25 +0100
Subject: [geeklog-spam] Bad Behavior and spammers
In-Reply-To: <04e501c85dd9$57acd4d0$fe00a8c0@ns2.spacequad.com>
References: <mailman.7.1201100402.61329.geeklog-spam@lists.geeklog.net>
	<04e501c85dd9$57acd4d0$fe00a8c0@ns2.spacequad.com>
Message-ID: <20080123202925.1923627333@smtp.haun-online.de>

Michael Brusletten wrote:

>For now...can you make the change and then send me a few entry posts to my
>admin email.  Then I can forward that off to the proper place.  Then
>hopefully geeklog.net will be removed from any further postings.  You may
>want to do this to other sites as well that you have control over.  Please
>send seperate emails for each site involved.  This goes for anyone else that
>want to stop these spammers.  BTW, if your wondering, its the same spam gang
>doing the google pages spam.  So if you want off their lists, let me know.

Hmm. Who exactly are you sending these reports to?

I hope you've made sure you're not talking the spammer himself. I'm
getting opt-out offers[1] all the time. I don't want to opt out of that
crap - I want them to stop entirely and for good.

bye, Dirk

[1] <http://spam.tinyweb.net/article.php/opt-out-spammer>


-- 
http://www.geeklog.net/
http://geeklog.info/



From ironmax at spacequad.com  Thu Jan 24 10:38:26 2008
From: ironmax at spacequad.com (Michael Brusletten)
Date: Thu, 24 Jan 2008 10:38:26 -0500
Subject: [geeklog-spam] geeklog-spam Digest, Vol 7, Issue 3
References: <mailman.5.1201186801.98087.geeklog-spam@lists.geeklog.net>
Message-ID: <005301c85e9f$2a2d6c10$fe00a8c0@ns2.spacequad.com>

Dirk,

For now, make the changes that I had asked and send me over a copy of a few
of the spam postings.  I will forward off these postings to 888.com  Here is
an excerpt of the conversation I got back from Zak, the security admin.

Hello Michael,



My name is Zacky and I am responsible for anti-virus/spyware issues in 888.
I received your report re spamming related to our websites, and I would like
to understand the issue here and address accordingly.



888 is very strict about spamming, malware, spyware etc - we do not do any
of those and highly disapprove of such practices.



I would appreciate if you could please provide me with details on this
matter.



Thank you in advance,

Zac

----------------

So I did send them the backlog of what I had for the casino spam.  It turned
out that the same affiliate was also spamming for credit card and ring
tones.  If you want this taken care of for all the domains that you have
some controls over, please send the info I need, so that your domains can be
taken off of the spammers lists.  I think I may have only a day or so left
before they contact their affiliates to give them the list of domains not to
send anymore spam to.  They've already taken us off their lists.

Michael


Michael Brusletten wrote:

>For now...can you make the change and then send me a few entry posts to my
>admin email.  Then I can forward that off to the proper place.  Then
>hopefully geeklog.net will be removed from any further postings.  You may
>want to do this to other sites as well that you have control over.  Please
>send seperate emails for each site involved.  This goes for anyone else
that
>want to stop these spammers.  BTW, if your wondering, its the same spam
gang
>doing the google pages spam.  So if you want off their lists, let me know.

Hmm. Who exactly are you sending these reports to?

I hope you've made sure you're not talking the spammer himself. I'm
getting opt-out offers[1] all the time. I don't want to opt out of that
crap - I want them to stop entirely and for good.

bye, Dirk

[1] <http://spam.tinyweb.net/article.php/opt-out-spammer>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist8.pair.net/pipermail/geeklog-spam/attachments/20080124/75eb5d30/attachment.html>