Major spam attack

[Telephalsion]

When it said "Our message board is once again under attack" I feared I wouldn't have a forum to come back to. Then I see it's a Gamefaqs-esque loser.
First person to invent a way to kill people over the internet gets a butter-biscuit.

And on another note- Hi again.

Come back to mIRC.

Yes please Glenn!

[Fitz Tayo]

Glenn. Return. Now.

[Engima]

Well, i've got names, addresses and phone numbers

responsible: Wanda Pérez
address: Lope de Vega # 95, 95, Piantini
address: 025273 - Santo Domingo -
country: DO
phone: +1 809 476-4278 [4278]

and

person: Sebastien Lahtinen
role: NetConnex Hostmaster
address: NetConnex Broadband Ltd.
address: 1 Eastway
address: Epsom, KT19 8SG
address: United Kingdom
phone: +44 870 745 4830
fax-no: +44 870 745 4831

all the email addresses are fixed though, so I can't get any of those. If you want my full log, PM me. Have fun

I cannot guarantee that either of these were the spammer, i'm currently trying to figure out if either was used as a proxy. If anyone, however, wants to contact them to get information, you have their name and phone numbers...

[Telephalsion]

Nice researsh, I'll leave the further disturbing of privacy to someone else.
This is illegal no?

[Engima]

The spamming or the looking up of private information?

[EmperorJeramyu]

Almost every time he posted he had a different IP. There were at least 20 more I could've added, but I figured that he/she/it was using some sort of masking technique. Unless all of those people were posting using the same account...

[Engima]

well then that complicates matters... The only possible scenarios I can think of now are:

1) There were multiple cuplrits on the same account
2) He/She switched proxies every post, explaining his slowness...
2) He/She was using a program (unlikely because I do not recall arbitrary patterns, more likely one of the above

Doesn't look like we'll be finding the person(s) in question, but I hope you kept a list of all those hostnames to ban them and at least slow down another spam.

http://www.ozzu.com/ftopic31433.html - this might be useful to whoever has access to manage the PHP code for the boards.

[iamtheverb]

the dude came on #theway yesterday and mentioned a proxy roulette service. here are the relevant parts of the chat:

[6/26/2005 8:26 PM] -->| Me (~chatzilla@ZiRC-74269671.ma.dl.cox.net) has joined #theway
[6/26/2005 8:26 PM] <WarV> Shut the fuck up.
[6/26/2005 8:27 PM] <ReaperGal> As soon as you tell me what liying means.
[6/26/2005 8:28 PM] <WarV> You know what it damn means.
[6/26/2005 8:29 PM] <Me> Hey guys, it's the spammer. I just want to let you guys know that I don't feel like spamming you anymore. I know you probably think I'm some person that has no life, and makes a living off of spamming forums.. well guess what? I've lost no sleep over the forum spamming, setting my browser to autorefresh is no problem. If the forum had a gross IQ of over 20 I probably would not have spammed, well I'll see you guys on the flipside. Have fun posting

there was a bunch of chatting in between these parts, but nobody really responded to him.

[6/26/2005 8:36 PM] <Me> lol I hope this amazing "sroty" develops into something amazing, so that you guys have something to look forward to.
[6/26/2005 8:36 PM] <ReaperGal> Hey, War. What does lech mean?
[6/26/2005 8:36 PM] |<-- Me has left irc.zirc.org (Quit: ChatZilla 0.9.61 [Mozilla rv:1.7.8/20050511])

he came back a bit later, and there was some actual chatting this time:

[6/26/2005 10:39 PM] -->| Me (Me@ZiRC-74269671.ma.dl.cox.net) has joined #theway
[6/26/2005 10:40 PM] <ReaperGal> ^-^
[6/26/2005 10:40 PM] <ReaperGal> This guy is funny. I don't think he tries to be, though.
[6/26/2005 10:40 PM] <OoS> No one tries to be funny. Humor is an illusion.
[6/26/2005 10:40 PM] -->| Exiled (Exiled@ZiRC-535E95CC.myviscom.com) has joined #theway
[6/26/2005 10:40 PM] <Exiled> wow people
[6/26/2005 10:41 PM] <OoS> Hi!
[6/26/2005 10:41 PM] <Teenr0cker> HI
[6/26/2005 10:41 PM] <Teenr0cker> I HATE HOMEWORK!
[6/26/2005 10:42 PM] <ReaperGal> That's probably why you're taking summer school.
[6/26/2005 10:42 PM] <Me> Hey, could someone please post on the scratch wall on topic spam attack that his friend can hack me if he wants to.
[6/26/2005 10:43 PM] <Me> thanks
[6/26/2005 10:43 PM] <OoS> I would.
[6/26/2005 10:43 PM] <OoS> But I'm too lazy.
[6/26/2005 10:43 PM] <Me> cool
[6/26/2005 10:43 PM] <OoS> Sorry.
[6/26/2005 10:43 PM] <Glenn> Oh, I'm here.
[6/26/2005 10:43 PM] <ReaperGal> Why are you here?
[6/26/2005 10:43 PM] <Me> I tried to make another account, but man, I've turned this forum into high-security.
[6/26/2005 10:44 PM] <ReaperGal> Just curious.
[6/26/2005 10:44 PM] <OoS> So anyway.
[6/26/2005 10:44 PM] <Glenn> whoa...spammy?
[6/26/2005 10:44 PM] <Glenn> you're the one who made me come visit
[6/26/2005 10:44 PM] <Me> just wanted someone to post that, because the admin verification takes a while ^-^
[6/26/2005 10:44 PM] <ReaperGal> Yeah. He's the one who spammed.
[6/26/2005 10:45 PM] <ReaperGal> And if that's what it takes to get you back here, I would have.
[6/26/2005 10:45 PM] <Glenn> Well, it's what got me to post.
[6/26/2005 10:45 PM] <Glenn> Then I was like, "
[6/26/2005 10:45 PM] <Glenn> yeah, I was like "(no thoughts)
[6/26/2005 10:45 PM] <Glenn> so here I am
[6/26/2005 10:45 PM] <OoS> I like Jeramyu's equation.
[6/26/2005 10:45 PM] <Me> lol
[6/26/2005 10:45 PM] <Me> lol yeah that was funny
[6/26/2005 10:46 PM] <OoS> Yeah.
[6/26/2005 10:46 PM] <OoS> Well.
[6/26/2005 10:47 PM] <OoS> Seriously, pie is boring.
[6/26/2005 10:47 PM] <Me> Yeah, I know. Sorry for the boring spams.
[6/26/2005 10:47 PM] <ReaperGal> I'd really like to know why you're here. I mean, do spammers usually hang out in the channels of forums they've tried to spam>
[6/26/2005 10:47 PM] <ReaperGal> ?
[6/26/2005 10:47 PM] <OoS> I think you should post gothic poetry.
[6/26/2005 10:47 PM] <OoS> It's what I would do.
[6/26/2005 10:47 PM] <Glenn> No, what I want to know...
[6/26/2005 10:47 PM] <OoS> Just loads of it.
[6/26/2005 10:47 PM] <Me> Hmm.. interesting.
[6/26/2005 10:47 PM] <Glenn> Were you bored?
[6/26/2005 10:47 PM] <Me> lol no j/k
[6/26/2005 10:48 PM] <ReaperGal> Yeah! Goth poetry is so funny!
[6/26/2005 10:48 PM] <Me> Yeah, a friend wanted me to spam the forum, so I did.
[6/26/2005 10:48 PM] <Glenn> for 2 hours?
[6/26/2005 10:48 PM] <Me> yep
[6/26/2005 10:48 PM] <Me> he wanted revenge or something
[6/26/2005 10:48 PM] <Glenn> what's his name?
[6/26/2005 10:48 PM] <Glenn> I haven't been online for months, so tell me.
[6/26/2005 10:48 PM] <Me> eh.. his forum name was like... maybe pheonix
[6/26/2005 10:48 PM] <OoS> Is it Steven Baldwin?
[6/26/2005 10:49 PM] <ReaperGal> Is it (dare I say it...)
[6/26/2005 10:49 PM] <ReaperGal> Jesus?!?!?
[6/26/2005 10:49 PM] <Me> pheonix something
[6/26/2005 10:49 PM] <Glenn> pheonix47?
[6/26/2005 10:49 PM] <Glenn> stupid fools.
[6/26/2005 10:49 PM] <Me> Did he lie about his age? If yes, it's him.
[6/26/2005 10:49 PM] <Glenn> Ryan!
[6/26/2005 10:49 PM] <ReaperGal> Hmm. Before my time, then.
[6/26/2005 10:50 PM] <Me> *shrugs*
[6/26/2005 10:50 PM] <Glenn> but really man
[6/26/2005 10:50 PM] <Glenn> 2 hours?
[6/26/2005 10:50 PM] <Me> all I had to do was set the browswer to refresh every 2 seconds
[6/26/2005 10:50 PM] <Me> not hard at all
[6/26/2005 10:50 PM] <Me> and I had a proxy roulette service running
[6/26/2005 10:51 PM] <Me> browser*
[6/26/2005 10:51 PM] <OoS> Wow.
[6/26/2005 10:51 PM] <OoS> How masterful.
[6/26/2005 10:51 PM] <OoS> You really turn me on. Sex me up, spammy!
[6/26/2005 10:51 PM] <ReaperGal> Ouch. I'm allergic to sarcasm...
[6/26/2005 10:51 PM] <Glenn> Spammy!!!!
[6/26/2005 10:51 PM] <Glenn> I like things.
[6/26/2005 10:51 PM] <OoS> You sexy spamming machine!
[6/26/2005 10:51 PM] <Me> lol
[6/26/2005 10:52 PM] |<-- Teenr0cker has left irc.zirc.org (Ping timeout)
[6/26/2005 10:52 PM] <OoS> And whoever your "friend" is, it's you, nobody asks someone else to spam for them, they just do it themselves, you stupid cockbite.
[6/26/2005 10:53 PM] <Me> Alright
[6/26/2005 10:53 PM] -->| Teenr0cker (~Boxxoroxx@ZiRC-3BD5D9B2.pas-mres.charterpipeline.net) has joined #theway
[6/26/2005 10:54 PM] <Glenn> Teen!
[6/26/2005 10:54 PM] <Glenn> 4H7u8z9z12a2h13!
[6/26/2005 10:54 PM] <Me> I'm sorry that I caused you the inconvenience of the scroll wheel
[6/26/2005 10:54 PM] <ReaperGal> Teen!
[6/26/2005 10:54 PM] <OoS> Damn right you're sorry!
[6/26/2005 10:54 PM] <Me> lol
[6/26/2005 10:54 PM] <OoS> You heartless bastard!
[6/26/2005 10:55 PM] <ReaperGal> He has Carpal tunnel now. Good job. I hope you're happy.
[6/26/2005 10:55 PM] <ReaperGal> ^-^
[6/26/2005 10:55 PM] <OoS> What about all those orphan children in Albania who have broken fingers, and can't scroll down?
[6/26/2005 10:55 PM] <ReaperGal> Yeah!
[6/26/2005 10:55 PM] <OoS> Did you ever once stop to think about THEM?!
[6/26/2005 10:55 PM] <Me> Oh damn, I forgot about them
[6/26/2005 10:55 PM] <Me> *cries*
[6/26/2005 10:56 PM] |<-- Teenr0cker has left irc.zirc.org (Ping timeout)
[6/26/2005 10:56 PM] <ReaperGal> Huh, that movie The Stand is pretty good. It really does justice to the book. Except for the ending. But the ending of the book really didn't do the book justice either...
[6/26/2005 10:56 PM] <iamtheverb> what about THE LANGOLIERS???
[6/26/2005 10:57 PM] <OoS> That was stupid.
[6/26/2005 10:57 PM] <ReaperGal> Ann was really scared by the story when she read it.
[6/26/2005 10:57 PM] <ReaperGal> I thought it was just interesting.
[6/26/2005 10:58 PM] <iamtheverb> I liked the part at the end of the miniseries when they were all skipping through the airport and then there was a freeze frame
[6/26/2005 10:58 PM] <iamtheverb> BRILLIANT
[6/26/2005 10:58 PM] <ReaperGal> But the end of The Stand is such Deus Ex Machina.
[6/26/2005 10:59 PM] <iamtheverb> is there a freeze frame?
[6/26/2005 11:00 PM] <ReaperGal> I can't think up a decent ending in any of his novels. His short stories are good, but his novels. It breaks my heart.
[6/26/2005 11:00 PM] <OoS> Every movie should have at least one freeze frame in it.
[6/26/2005 11:00 PM] <iamtheverb> totally
[6/26/2005 11:01 PM] <iamtheverb> also, they should all have at least one Dean Stockwell
[6/26/2005 11:01 PM] <OoS> Yes.
[6/26/2005 11:01 PM] <OoS> Preferably more than one.
[6/26/2005 11:02 PM] <ReaperGal> *shudder*
[6/26/2005 11:02 PM] <OoS> What's wrong, Reaper?
[6/26/2005 11:02 PM] <ReaperGal> Dean stockwell...
[6/26/2005 11:02 PM] <ReaperGal> *shudder*
[6/26/2005 11:02 PM] <iamtheverb> what, don't you like child actors that had success as adults also??
[6/26/2005 11:02 PM] <OoS> Were you abused by multiple Dean Stockwells, and now those memories are resurfacing?
[6/26/2005 11:02 PM] <Me> lol that was great having jeremyu PM me saying "um.. could you stop or something"
[6/26/2005 11:03 PM] <ReaperGal> Oh, hey Glenn! If you hate that girl now, can I talk to her?
[6/26/2005 11:03 PM] <Me> anyways I'll see you guys later. No more spam from me
[6/26/2005 11:03 PM] <ReaperGal> Yes, I was.
[6/26/2005 11:03 PM] <OoS> I knew it.
[6/26/2005 11:03 PM] <ReaperGal> Well, just in general, I hate all child actors.
[6/26/2005 11:04 PM] <ReaperGal> And their adult counterparts.
[6/26/2005 11:04 PM] |<-- Me has left irc.zirc.org (Quit: )
[6/26/2005 11:04 PM] <GluhenderKrieger> Hold on, so this "Me" guy was asked to spam the forum?
[6/26/2005 11:04 PM] <Glenn> yeah
[6/26/2005 11:04 PM] <ReaperGal> ..
[6/26/2005 11:04 PM] <GluhenderKrieger> By someone who lied about his age?
[6/26/2005 11:04 PM] <OoS> I don't think so.
[6/26/2005 11:04 PM] <Glenn> yep
[6/26/2005 11:05 PM] <GluhenderKrieger> The only person I can think of is Chip.
[6/26/2005 11:05 PM] <Glenn> Me is Me@ZiRC-74269671.ma.dl.cox.net * Spam
[6/26/2005 11:05 PM] <Glenn> Me on #theway
[6/26/2005 11:05 PM] <Glenn> Me using ferret.uk.eu.zirc.org ZiRC United Kingdom - INTERNET: Serious Business
[6/26/2005 11:05 PM] <Glenn> Me End of /WHOIS list.
[6/26/2005 11:05 PM] <Glenn> notice the * Spam

so there you have it. Reaper is afraid of Dean Stockwell. wait, what were we talking about?

[Aegis]

Possibly that the spammer spread a virus and used the virused computers as proxies? Mabye, but probably not.

[ReaperGal]

so there you have it. Reaper is afraid of Dean Stockwell.

*shudder*

[EmperorJeramyu]

proxy roulette? oh boy. though it looks like the ip70-178-81-170.ma.dl.cox.net one is right.

So who exactly was this spammer extracting vengeance in the name of? because I don't know what's more pathetic: that someone needed their friend to spam some obscure internet forum, or that someone was a big enough of a suggestable idiot to do their friends bidding to spam some obscure internet forum.

[voodooKobra]

what's funny is my friend found an open FTP port ^_^

[Teenr0cker]

We had suspected it was a friend of ryan. He asked of this guy we were thinking of lied about his age, so if that's any help.























Oh yeah....GLENN ROCKS!!!

[Telephalsion]

If this event ends up in glenns return it'll thank the spammer. What's on the ftp?

[Engima]

voodooKobra: that exact port would be nice

Anyways, he's lying. He claims he left his computer refreshing and switching proxies at certain intervals? that doesn't explain how therre were different posts in different areas, that doesn't explain what wrote all the text, nor does it explain the somewhat intelligent posts (the ones with English text). Still, assuming he was typing after each refresh, he'd better have damn fast fingers if he wants to smack a buch of random keys, switch to the subject box to the message body box and type in another random set of keys, in under two seconds.

My conclusion is, this guys a little kiddie scripter who thinks he's a big, bad guy because he downloaded a proxy roulette and an auto-refresher plugin for firefox. I'll check the IP address from the IRC, that seems real enough to me

Edit: OK now this sucks, I can't ping him, so either he's disconnected or he has his hostname masked because cox.net doesn't recognize him...

Searching for ZiRC-74269671.ma.dl.cox.net A record at l.root-servers.net [198.32.64.12]: Got referral to E.GTLD-SERVERS.net. [took 82 ms]
Searching for ZiRC-74269671.ma.dl.cox.net A record at E.GTLD-SERVERS.net. [192.12.94.30]: Got referral to ns.west.cox.net. [took 70 ms]
Searching for ZiRC-74269671.ma.dl.cox.net A record at ns.west.cox.net. [68.111.106.76]: Reports that no A records exist. [took 85 ms]