Category: Sad Spammers

When I want to vent about the morons who spam email systems and bombard forums with their useless junk

Another stupid set of spam emails

Yet more stupid spam arrived in my inbox today.

Lets just take two examples from the small tsunami that arrived.

anotherspamm

anotherspamm2

What spammers forget is that sending TWO emails from different people to the SAME address with similar messages in it really does give the game away.

Then why on earth should someone send Security alert emails from an Ipad? They’d be system generated.

Finally why would Rentokil Initial be sending email from a personal address at smile-sumai.jp.

Really guys – are you really so thick you can’t even realise that the junk you are sending out is complete and utter shit?

The scum at Semalt are at it again

I got a lot of hits with a referrer of keywords-monitoring-your-success . com

Lots of different IP addresses – all in Brazil… And guess what : yes its the scum at Semalt up to their old tricks again.

Why can’t they just fuck off and stop pissing people off.

Re-write rules added to block them in future:

# Block access from semalt - its a rogue and serves no purpose
RewriteCond %{HTTP_REFERER} semalt\.com [NC]
RewriteRule .* - [F]
# Semalt under another name
RewriteCond %{HTTP_REFERER} keywords-monitoring-your-success.com [NC,OR]
RewriteCond %{HTTP_REFERER} keywords-monitoring-your-success.com
RewriteRule .* - [F]

Oh and they’re also running free-video-tool . com

Spamming Fuckwits

It’s pretty obvious that spammers (i.e. the people controlling the compromised machines that are doing the work) are a bunch of stupid fuckwits…

This site gets between 10 and 20 spam comments a day… None of them have appeared because I use Askimet :

spamblog

But they obviously never check that its working – mind you I guess they don’t give a shit, they’ve taken the money off the people selling fake NFL jerseys and fake pharmaceuticals so for them its money for old rope (hey – that’s an idea : lets sell Old Rope to people!!)

But the morons pushing out email spam are as bad:

not spam

Come on…. sending email to an address called spambucket is obviously destined for just one location : my spam bucket followed by SpamCop. The attachment was a rogue program – not that I use Windows so it wasn’t going anywhere anyway.

Sometimes they almost get it right – apparently PC world have an order for me :

sillyspam

All I needed to do was log into my PC world account and confirm details .. yeah right…. I’m just like everyone in that I order over £600 worth of computer without remembering… how anyone could fall for this I do not know.

Then there is the downright stupid and useless:

stupid

Lets make up a totally stupid email address and then use the first part of it in the body of the message..

The craziest thing is that THIS post (along with all the other ones I’ve posted about spammers in the past) will attract more spam comments than my other posts…

Bits and bobs

Although I should be working on getting all the data loaded into the Canalplan Boats Database I’ve not been making a lot of progress on getting the new data and the old data mapped into a new structure which I wanted to use to make the data better.

As well as that it’s been a continual battle against the scum who just want to break servers and use them to post spam, send spam or compromise their websites.

Ecatel Limited seem to be a company who delight in hosting scammers and criminals. They had several machines in several different IP address blocks all hammering the xmlrpc.php file on this server. Doing some research into this shows that this problem has been going on for over 18 months and Ecatel do not seem to do anything about it. Emails to their abuse department went unreplied which seems to be pretty much par for the course. So their CIDRs have been firewalled.

The Shellshock attempts continue from various places and although some companies have replied quickly others simply haven’t.

You do wonder how much better the internet could be if people building websites and on-line systems didn’t have to devote significant resources to stopping scum from attempting to break things. All these stupid attempts against servers are also using up resources that should be being used to serve real data to real users.

Todays list of scum

2014-10-23 04:39:51,514 fail2ban.actions: WARNING [apache-wplogin] Ban 198.23.155.76
2014-10-23 11:02:05,033 fail2ban.actions: WARNING [postfix] Ban 111.249.35.151
2014-10-23 12:44:57,061 fail2ban.actions: WARNING [sasl] Ban 63.152.242.19
2014-10-23 12:47:16,215 fail2ban.actions: WARNING [postfix] Ban 49.230.184.69
2014-10-23 12:49:02,731 fail2ban.actions: WARNING [postfix] Ban 185.7.100.97
2014-10-23 12:49:41,087 fail2ban.actions: WARNING [postfix] Ban 103.229.84.194
2014-10-23 12:51:27,010 fail2ban.actions: WARNING [postfix] Ban 59.94.15.250
2014-10-23 12:51:51,892 fail2ban.actions: WARNING [postfix] Ban 94.20.224.54
2014-10-23 12:52:20,205 fail2ban.actions: WARNING [postfix] Ban 190.178.92.83
2014-10-23 12:52:38,306 fail2ban.actions: WARNING [postfix] Ban 69.198.18.202
2014-10-23 12:52:50,037 fail2ban.actions: WARNING [postfix] Ban 118.102.169.44
2014-10-23 12:53:31,943 fail2ban.actions: WARNING [postfix] Ban 79.97.188.35
2014-10-23 12:54:24,326 fail2ban.actions: WARNING [postfix] Ban 5.42.193.34
2014-10-23 12:54:24,600 fail2ban.actions: WARNING [postfix] Ban 117.204.153.6
2014-10-23 12:54:52,445 fail2ban.actions: WARNING [postfix] Ban 122.171.119.247
2014-10-23 12:57:45,569 fail2ban.actions: WARNING [postfix] Ban 117.204.143.124
2014-10-23 12:57:58,709 fail2ban.actions: WARNING [postfix] Ban 154.70.236.29
2014-10-23 13:03:41,906 fail2ban.actions: WARNING [postfix] Ban 139.216.57.220
2014-10-23 13:04:55,166 fail2ban.actions: WARNING [postfix] Ban 116.33.2.37
2014-10-23 13:06:18,096 fail2ban.actions: WARNING [postfix] Ban 123.176.22.30
2014-10-23 13:08:37,083 fail2ban.actions: WARNING [postfix] Ban 77.234.44.138
2014-10-23 13:11:02,561 fail2ban.actions: WARNING [postfix] Ban 105.186.68.107
2014-10-23 13:12:33,356 fail2ban.actions: WARNING [postfix] Ban 74.112.58.73
2014-10-23 13:13:51,867 fail2ban.actions: WARNING [postfix] Ban 179.8.149.180
2014-10-23 13:14:14,576 fail2ban.actions: WARNING [postfix] Ban 197.253.66.208
2014-10-23 13:14:32,456 fail2ban.actions: WARNING [postfix] Ban 82.199.201.242
2014-10-23 13:15:55,821 fail2ban.actions: WARNING [postfix] Ban 67.231.35.166
2014-10-23 13:16:44,822 fail2ban.actions: WARNING [postfix] Ban 97.66.124.251
2014-10-23 13:17:42,694 fail2ban.actions: WARNING [postfix] Ban 124.200.250.27
2014-10-23 13:18:28,604 fail2ban.actions: WARNING [postfix] Ban 111.91.86.171
2014-10-23 13:18:35,479 fail2ban.actions: WARNING [postfix] Ban 123.18.208.252
2014-10-23 13:21:52,572 fail2ban.actions: WARNING [postfix] Ban 39.55.155.246
2014-10-23 13:21:59,394 fail2ban.actions: WARNING [postfix] Ban 122.167.201.219
2014-10-23 13:23:22,519 fail2ban.actions: WARNING [sasl] Ban 93.125.94.2
2014-10-23 13:23:34,367 fail2ban.actions: WARNING [postfix] Ban 221.158.66.84
2014-10-23 13:23:39,667 fail2ban.actions: WARNING [postfix] Ban 94.79.231.59
2014-10-23 13:25:58,138 fail2ban.actions: WARNING [postfix] Ban 5.160.183.163
2014-10-23 13:29:49,723 fail2ban.actions: WARNING [postfix] Ban 68.118.118.10
2014-10-23 13:30:06,548 fail2ban.actions: WARNING [postfix] Ban 50.250.213.34
2014-10-23 13:30:22,595 fail2ban.actions: WARNING [postfix] Ban 116.202.81.162
2014-10-23 13:31:57,825 fail2ban.actions: WARNING [postfix] Ban 39.32.186.142
2014-10-23 13:32:28,672 fail2ban.actions: WARNING [postfix] Ban 194.28.73.230
2014-10-23 13:32:39,027 fail2ban.actions: WARNING [postfix] Ban 113.173.24.237
2014-10-23 13:32:56,914 fail2ban.actions: WARNING [postfix] Ban 86.127.100.34
2014-10-23 13:36:51,449 fail2ban.actions: WARNING [postfix] Ban 121.167.24.204
2014-10-23 13:37:46,247 fail2ban.actions: WARNING [postfix] Ban 59.103.133.23
2014-10-23 13:39:40,248 fail2ban.actions: WARNING [postfix] Ban 1.53.13.143
2014-10-23 13:39:53,154 fail2ban.actions: WARNING [postfix] Ban 77.30.185.250
2014-10-23 13:41:21,550 fail2ban.actions: WARNING [postfix] Ban 14.141.111.226
2014-10-23 13:43:55,238 fail2ban.actions: WARNING [sasl] Ban 201.213.221.103
2014-10-23 13:45:26,703 fail2ban.actions: WARNING [postfix] Ban 124.200.250.26
2014-10-23 13:45:54,620 fail2ban.actions: WARNING [postfix] Ban 122.178.156.172
2014-10-23 13:45:57,720 fail2ban.actions: WARNING [postfix] Ban 176.121.227.102
2014-10-23 13:46:32,047 fail2ban.actions: WARNING [postfix] Ban 103.23.33.158
2014-10-23 13:47:55,975 fail2ban.actions: WARNING [postfix] Ban 122.169.58.113
2014-10-23 13:48:33,866 fail2ban.actions: WARNING [postfix] Ban 208.46.50.130
2014-10-23 13:49:49,784 fail2ban.actions: WARNING [postfix] Ban 167.135.119.251
2014-10-23 13:52:53,732 fail2ban.actions: WARNING [postfix] Ban 139.193.101.138
2014-10-23 13:53:33,484 fail2ban.actions: WARNING [postfix] Ban 43.252.101.98
2014-10-23 13:53:52,645 fail2ban.actions: WARNING [postfix] Ban 117.193.55.91
2014-10-23 13:53:59,459 fail2ban.actions: WARNING [postfix] Ban 121.101.186.118
2014-10-23 13:54:32,347 fail2ban.actions: WARNING [postfix] Ban 192.30.241.146
2014-10-23 13:54:35,170 fail2ban.actions: WARNING [postfix] Ban 209.181.18.217
2014-10-23 13:55:20,781 fail2ban.actions: WARNING [postfix] Ban 178.120.186.83
2014-10-23 13:57:58,082 fail2ban.actions: WARNING [sasl] Ban 87.197.159.118
2014-10-23 13:58:23,294 fail2ban.actions: WARNING [postfix] Ban 119.35.25.251
2014-10-23 14:00:33,406 fail2ban.actions: WARNING [postfix] Ban 94.97.129.113
2014-10-23 14:01:12,811 fail2ban.actions: WARNING [postfix] Ban 117.213.79.39
2014-10-23 14:04:49,980 fail2ban.actions: WARNING [postfix] Ban 115.112.33.53
2014-10-23 14:05:22,824 fail2ban.actions: WARNING [sasl] Ban 181.15.215.181
2014-10-23 14:05:49,183 fail2ban.actions: WARNING [postfix] Ban 121.130.137.95
2014-10-23 14:05:51,867 fail2ban.actions: WARNING [postfix] Ban 221.138.252.114
2014-10-23 14:06:29,756 fail2ban.actions: WARNING [postfix] Ban 198.0.71.201
2014-10-23 14:06:38,342 fail2ban.actions: WARNING [postfix] Ban 39.32.208.77
2014-10-23 14:08:17,665 fail2ban.actions: WARNING [sasl] Ban 70.196.64.104
2014-10-23 14:08:46,309 fail2ban.actions: WARNING [postfix] Ban 72.54.223.53
2014-10-23 14:09:26,133 fail2ban.actions: WARNING [postfix] Ban 151.64.98.8
2014-10-23 14:10:58,584 fail2ban.actions: WARNING [postfix] Ban 199.96.245.158
2014-10-23 14:13:49,421 fail2ban.actions: WARNING [postfix] Ban 91.241.224.135
2014-10-23 14:15:47,858 fail2ban.actions: WARNING [sasl] Ban 71.183.239.18
2014-10-23 14:16:33,898 fail2ban.actions: WARNING [postfix] Ban 74.202.252.56
2014-10-23 14:17:09,129 fail2ban.actions: WARNING [postfix] Ban 39.32.155.178
2014-10-23 14:18:08,113 fail2ban.actions: WARNING [postfix] Ban 12.25.8.201
2014-10-23 14:18:12,973 fail2ban.actions: WARNING [postfix] Ban 112.150.194.150
2014-10-23 14:18:54,821 fail2ban.actions: WARNING [postfix] Ban 64.16.141.26
2014-10-23 14:18:58,961 fail2ban.actions: WARNING [postfix] Ban 97.97.32.66
2014-10-23 14:19:42,557 fail2ban.actions: WARNING [postfix] Ban 115.241.116.191
2014-10-23 14:20:10,477 fail2ban.actions: WARNING [postfix] Ban 24.49.3.240
2014-10-23 14:21:46,013 fail2ban.actions: WARNING [sasl] Ban 98.101.135.206
2014-10-23 14:36:04,447 fail2ban.actions: WARNING [postfix] Ban 154.100.143.195
2014-10-23 14:37:43,726 fail2ban.actions: WARNING [sasl] Ban 76.187.73.212
2014-10-23 14:39:29,745 fail2ban.actions: WARNING [postfix] Ban 124.200.250.21
2014-10-23 15:42:01,739 fail2ban.actions: WARNING [sasl] Ban 111.248.45.220
2014-10-23 18:31:20,220 fail2ban.actions: WARNING [apache-wplogin] Ban 192.99.150.55
2014-10-23 19:39:30,989 fail2ban.actions: WARNING [apache-wplogin] Ban 104.151.230.82

Fail2ban tweaks

So I tweaked Fail2ban so it picked up failed SASL auth sesssion…

There are a LOT of compromised machines out there:

2014-10-21 15:57:08,236 fail2ban.actions: WARNING [postfix] Ban 222.247.167.96
2014-10-21 22:00:08,119 fail2ban.actions: WARNING [postfix] Ban 122.165.90.186
2014-10-21 22:00:09,089 fail2ban.actions: WARNING [postfix] Ban 77.42.202.232
2014-10-21 22:00:09,383 fail2ban.actions: WARNING [postfix] Ban 69.198.18.202
2014-10-21 22:00:09,828 fail2ban.actions: WARNING [postfix] Ban 167.135.119.251
2014-10-21 22:00:10,632 fail2ban.actions: WARNING [postfix] Ban 191.113.84.245
2014-10-21 22:00:11,741 fail2ban.actions: WARNING [postfix] Ban 184.71.165.174
2014-10-21 22:00:13,544 fail2ban.actions: WARNING [postfix] Ban 186.116.237.173
2014-10-21 22:00:14,812 fail2ban.actions: WARNING [postfix] Ban 12.25.8.201
2014-10-21 22:00:15,682 fail2ban.actions: WARNING [postfix] Ban 112.150.194.150
2014-10-21 22:00:16,488 fail2ban.actions: WARNING [postfix] Ban 68.118.118.10
2014-10-21 22:00:17,362 fail2ban.actions: WARNING [postfix] Ban 139.193.101.137
2014-10-21 22:00:19,292 fail2ban.actions: WARNING [postfix] Ban 192.30.241.146
2014-10-21 22:00:19,769 fail2ban.actions: WARNING [postfix] Ban 190.239.170.29
2014-10-21 22:00:20,741 fail2ban.actions: WARNING [postfix] Ban 178.120.155.241
2014-10-21 22:00:20,986 fail2ban.actions: WARNING [postfix] Ban 74.112.58.73
2014-10-21 22:00:30,266 fail2ban.actions: WARNING [postfix] Ban 212.215.218.191
2014-10-21 22:00:30,535 fail2ban.actions: WARNING [postfix] Ban 186.121.93.138
2014-10-21 22:00:31,159 fail2ban.actions: WARNING [postfix] Ban 190.51.59.93
2014-10-21 22:00:31,773 fail2ban.actions: WARNING [postfix] Ban 23.30.82.137
2014-10-21 22:00:32,636 fail2ban.actions: WARNING [postfix] Ban 41.228.195.145
2014-10-21 22:00:33,409 fail2ban.actions: WARNING [postfix] Ban 5.160.182.24
2014-10-21 22:00:33,704 fail2ban.actions: WARNING [postfix] Ban 105.186.70.162
2014-10-21 22:00:34,417 fail2ban.actions: WARNING [postfix] Ban 64.89.211.243
2014-10-21 22:00:34,988 fail2ban.actions: WARNING [postfix] Ban 111.91.86.86
2014-10-21 22:00:35,807 fail2ban.actions: WARNING [postfix] Ban 190.187.47.55
2014-10-21 22:00:36,768 fail2ban.actions: WARNING [postfix] Ban 14.192.128.34
2014-10-21 22:02:46,842 fail2ban.actions: WARNING [postfix] Ban 79.97.188.35
2014-10-21 22:03:10,199 fail2ban.actions: WARNING [postfix] Ban 49.249.55.38
2014-10-21 22:03:31,018 fail2ban.actions: WARNING [postfix] Ban 91.75.74.12
2014-10-21 22:03:49,365 fail2ban.actions: WARNING [postfix] Ban 190.176.210.91
2014-10-21 22:04:17,027 fail2ban.actions: WARNING [postfix] Ban 199.96.245.158
2014-10-21 22:12:58,539 fail2ban.actions: WARNING [postfix] Ban 123.176.22.30