What does this spammer want? Why will he / she not go away?

[Uhura!]

SMF 2.0.10 | SMF © 2015, Simple Machines
SimplePortal 2.3.6 © 2008-2014, SimplePortal

I have banned this person, but the keep visiting every day.

Member Profile info. Note - he's even referred someone to my site:

Username:     Mepintiff
Posts:     0 (0 per day)
Email:     [email protected]
Personal Text:     I LOVE Our Parenting Spot!
Referrals:     1
Referral Link: My Parenting Power Score:     0
Gender:     Male
Age:     N/A
Location:     Tunisia

Book Author?:     No
My Parenting Style:     Authoritarian

User is currently banned [View]
Date Registered:     November 25, 2013, 07:41:47 PM
IP:     211.101.60.61
Local Time:     April 30, 2015, 08:04:44 AM
Last Active:     Today at 06:53:37 AM

Here is a small sample:

211.101.60.61    [email protected]    Mepintiff    Today at 06:53:38 AM    
211.101.60.61       Mepintiff    Today at 06:53:35 AM    
212.83.167.196       Mepintiff    Today at 06:52:17 AM    
37.130.227.133          Today at 06:37:06 AM    
37.130.227.133          Today at 03:34:03 AM    
219.223.190.90    [email protected]    Mepintiff    Today at 03:23:29 AM    
219.223.190.90       Mepintiff    Today at 03:23:24 AM    
212.83.167.196       Mepintiff    Today at 03:23:12 AM    
212.83.167.196       Mepintiff    Yesterday at 06:07:53 PM    
222.80.72.30       Mepintiff    Yesterday at 05:50:11 PM    
212.83.167.196       Mepintiff    Yesterday at 05:50:08 PM    
114.112.91.97    [email protected]    Mepintiff    Yesterday at 09:33:09 AM    
114.112.91.97       Mepintiff    Yesterday at 09:33:07 AM    
101.4.136.101    [email protected]    Mepintiff    Yesterday at 09:33:02 AM    
101.4.136.101       Mepintiff    Yesterday at 09:33:00 AM    
201.12.73.78    [email protected]    Mepintiff    Yesterday at 09:32:15 AM    
201.12.73.78       Mepintiff    Yesterday at 09:32:09 AM    
212.83.167.196       Mepintiff    Yesterday at 09:32:00 AM    
54.205.54.209          April 28, 2015, 10:18:49 PM    
104.194.26.194          April 28, 2015, 09:54:42 PM    
104.194.26.194          April 28, 2015, 09:54:41 PM    
104.194.26.194          April 28, 2015, 09:54:33 PM    
104.194.26.194          April 28, 2015, 09:54:32 PM    
104.194.26.194          April 28, 2015, 09:54:12 PM    
104.194.26.194          April 28, 2015, 09:54:11 PM    
54.153.99.75          April 28, 2015, 08:41:15 PM    
54.153.99.75          April 28, 2015, 08:41:14 PM    
54.153.99.75          April 28, 2015, 08:41:13 PM    
54.153.99.75          April 28, 2015, 08:41:12 PM    
54.205.54.209          April 28, 2015, 08:25:04 PM    

ip address changes frequently so CPanel blocking is useless - right?

What is this persone getting out of coming to my site so frequently?

Thanks for your help.

[Shambles]

Well it's not really a 2.0.* support query, but why not ban his/her email address, if that's the common factor in all the posts?

[Uhura!]

As I said before - the person is already banned. They are banned on the forum based on the email address & username...Yet they still visit. That is the question. What are they getting out of it & do I need to be concerned?

[margarett]

It's a spammer. Most of these IPs are in stopforumspam database.

Well it's not really a 2.0.* support query

No idea where to move this

[Illori]

Well it's not really a 2.0.* support query

No idea where to move this

http://www.simplemachines.org/community/index.php?board=116.0

[roshaoar]

I doubt it's actually a person - it's probably a bot that has your forum on its list. What does this account actually do/post?

[Shambles]

What does this account actually do/post?

If it's banned, I doubt it's posting anything.

[roshaoar]

If it's banned, I doubt it's posting anything.

Heh, true . Fwiw, with bots, my own experience is that trying to outright ban them isn't that effective for all the reasons mentioned. What I prefer to do is intercept them and make them waste their time. For example try posting a contact message on my site selling "seo services". It sends them to an external 30 second delay site and then posts a confirmation that they failed. Since I added that they took me off their list This is because 30s of that bot's time is very expensive to them, especially if they visit several times a day. Remember the people who run these are paid by commission so if their bot gets tangled and stops processing it hurts the heck out of them. This is the way to make frequent visits hurt them, not you.

One other useful trick for bots is to send them to a 0 byte 403 screen using some RewriteCond %{REMOTE_ADDR} redirects or deny from 155.133.18.0/24 198.143.128.0/18 CIDR redirects. But this does require a bit of .htaccess hacking, not for the faint of heart. Redirecting to a 0 byte 403 is a bodge, as in I have a pretty 403 screen as well, but a deliberate bodge. A 0 byte 403 screen gives the bot or spammer no further information about your site, it's just a totally blank white screen. But if you think about it, it is the smart thing to do, because it doesn't give the bot anywhere to go, no further links to follow. It's a complete dead end which once again completely wastes their time. Fyi, I used to have up to 5000 visits from China and Ukraine spambots a day, I'm down to less than 10 now.

[Kindred]

except - if you actually do run an international forum, banning IP addresses like that will probably catch many VALID users as well.

Banning IP addresses is not the way to deal with spammers and spambots.

[roshaoar]

except - if you actually do run an international forum, banning IP addresses like that will probably catch many VALID users as well.

Can do. But it's well known in the botblocking community that there are IP spans that are only used by bots and scammers. Especially the high # non-RIPE IPs, that's a pretty indicative signal. But, yes, if you get into consumer IPs, IP isn't always great. But sometimes you just have to make a judgement - if you spot what looks like a scriptkiddie operating from some dodgy ISP that you've never heard of that's so small (or so fake) that it doesn't even have a web presence, I don't feel too bad about a 10 second fix to prevent them wasting hours of my time. But then I'm unusual in that I do police my raw error and access logs like a hawk, so were there to be a problem I could undo it in 10s too.

[kdmiller45]

curious, Ip's can be spoofed and email address Faked what is the best way to deter this crap
I already use the option to check the email address with M record and have just now reinstalled the stopSpam API key, hopefully that will stop this crap

[Kindred]

kd...  your question really has very little to do with uhura's post...

The spammer is banned and is not getting in to her system at all...

[Uhura!]

kd...  your question really has very little to do with uhura's post...

The spammer is banned and is not getting in to her system at all...

Hi kindred, am I to understand that I don't need to worry about this spammer?

Thanks,
U

[Night09]

If they are banned they may try to access previously saved pages but they will not be able to access them in any way so your safe as far as they are concerned.

[Uhura!]

Thanks everyone