NEED EMAIL FLOOD CONTROL - Scammers

oldengine · February 12th, 2007, 11:10 AM

I had a scammer register and attempt to write his scam email to ALL of my advertisers. I lost count at over 100.

This is documented in my server logs from:
[12/Feb/2007:06:09:48 -0500]
to:
[12/Feb/2007:06:45:36 -0500]

Rippin 'em through at the rate of 5 seconds or less each!

FLOOD CONTROL NEEDED!

Message follows:

=====================

From: -------@yahoo.com
Date: Mon, 12 Feb 2007 06:28:27 -0500
I saw your advert while surfing via the internet and am willing and highly
interested to buy it.get back to me via my email if it is still available for sale.
Are you the owner???
what is the condition like ?.
send its recent pictures if available.
What is your last offer price???
I want you to know that you will be getting the payment inform of a cashier check or a Money order I look forward to read from you soonest.
kindly get back to me with your full contact name and address including phone number in which the payment can be sent to as i will be making the payment for the final asking price.
Best regards...

==============

I have modified the classifieds script to attach the following to each blind email:

==============

Notice:
Beware of SCAMMERS with forged cashier's checks or counterfeit money orders!
The scheme will involve a check made out for more than your asking price.
They will want you to quickly WIRE excess money back to them or their shipper.
Your bank will not so politely inform you after the fact that you are responsible!
Sender's originating IP address: 216.185.79.8 - Use these numbers to report abuse.

=============

IP reported to ISP and email reported to Yahoo.

oldengine · February 12th, 2007, 11:16 AM

The actual server logged count is 126 for the above email.

ludachris · February 12th, 2007, 11:55 AM

Can't you just turn off viewing permissions for Non-registered users? One thing I've done in the past is modify the showproduct.php page so that the Contact Seller link uses the standard vbulletin sendmessage.php form instead of the ppc contact form. It fixed the issue. I'm going to try out the ppc form once again but this time I'm not allowing Non-registered users to view the classifieds at all.

oldengine · February 12th, 2007, 12:22 PM

This jerk registered!

Claimed he lived in Miami, but the ISP is in Ontario Canada.

These birds are getting bold!

ludachris · February 12th, 2007, 01:53 PM

That sucks. Just ban him!

One thing I've done and I know others are starting to do this as well - create a new member usergroup that is not allowed to post in the classifieds until they reach a certain post count/days registered/reputation level, whatever criteria combo you want. Also create a scheduled task that will bump them up to the next member level once they reach that criteria. It has helped prevent spam and fraud greatly for us. Of course this is assuming you're using vb.

oldengine · February 12th, 2007, 02:37 PM

Sure, I can just ban him, but he has already done his damage. One hundred twenty six of my advertisers now have the potential to get screwed.

Believe me, we have all discussed this on our vB forum and I have a board dedicated to this titled: "Fraud SCAM Swindle & Steal."

I have an entire list of 148 different IP ranges in my iptables firewall, most all having been the result of a scam email coming in like this. I have a zero tolerance policy on this and the entire damned ISP is dumped. These are mostly in Africa and the satellite services that carry them. It's really the so called "internet cafe" envirionment, but I'm just not going to put up with them.

So, the real reason for my initial post here is to THROTTLE the damages. There is absolutely no excuse for anyone pumping through 126 email ad responses in a half hour's time.

Another one will be back, most likely within the week.

oldengine · February 13th, 2007, 10:39 PM

This same dude came back again today with a different IP and an account that I can't find as yet. His previous account is banned!

69.50.208.4 - - [13/Feb/2007:05:20:11 -0500] "POST /classifieds/contact.php HTTP/1.0" 200 1251 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50"

The Opera 8.5 flags him as the same one. (I have my reasons.)

He popped out 22 more emails to my sellers!

He either had registered an earlier stealth account or he figured out how to send email through the server without logging in.

EDIT: If he was still logged in from the first time, could he send email even though he was banned in the forum registration system?

Evidently, at least in my system, banning a user does not prevent him from sending email responses through the classifieds. Changing his password does the trick.

Banned SCAMMER sending email through ads.

Chuck S · February 14th, 2007, 07:34 AM

Yes banning him from the forum does nothing in our software. You need to move him into a special usergroup where you remove all rights to see categories of ads

oldengine · February 14th, 2007, 10:19 AM

This issue has been resolved in the other thread.

Flood control would still be a good idea for a future version.