spammer?

[omapie]

Well, this kinda sounds like a stupid (obvious?) question to me but I'm gonna ask it anyway since I'm a newbie to running a forum.

There's a person who's joined 2 of my forums
http://myfibrofriends.org -- specifically for people with fibromyalgia/chronic fatigue syndrome (cfs-me) or similar chronic illnesses; essentially an online support group.
http://jmhs-classmates.net -- a forum specifically for my high school alumni

When I look at their sig in the alumni site, it shows the following:

Code Select Expand


Odds
Spices
How to increase height
West Ham
Premiership
....................
Hosting
Champions League
Nicotine Patch


When I look at their profile under the mff site, it shows:

Code Select Expand

Football
Health
Shoe Shop
West Ham FC
FA Cup
....................
Hosting
Champions League
Nicotine Patch
League Cup
Cheap Hosting
England Football
football forums
Football Posters
Football Tickets
Birmingham
Manchester City
[URL=http://www.middlesbroughf

Granted, they might be just fine... but when I see a sig like this, I become suspicious. I wouldn't have thought anything except the odds that there'd be a member that was in both of these 2 forums... well, not good. Possible yes. Probably? imho.. no.

Granted, they haven't posted anything yet. Not even to the Member Websites board -- which is what I suspected to see..

So, now, when I went over to the TPM site, I find this person has joined there too. Now I'm really suspicious. Maybe I'm overly suspicious but... hmmm.

So here's my question:
Is this a spammer?
I haven't pm'd them yet to ask their name or other info -- if they actually have a reason to be at the hs alumni site, then they'd be able to tell me their year of graduation or their relationship. Course I have no way of verifying that. And I'd allow people in that forum even if they aren't an alumni but if they're a friend of, staff, etc. It's loose.

Any thoughts on what my best course of action here?

[Zetan]

That looks very similar to a "Members" sig that the Admin recently banned from here. IIRC, they had been attempting to hack another site which belongs to some of the team.

Have you traced the IP address?

With the results of a trace, you can use google to search and you may find this has been posted on other sites as a Spam Bot or Spammer.

If in doubt, ban them. I would for having a signature like that.

[omapie]

will do that right now...
When I do a track id from w/i their profile...
from the hs site, it shows:

Code Select Expand

Track IP
Enter IP (range):   

Look up IP on a regional whois-server 79.181.132.102
AfriNIC (Africa)
APNIC (Asia Pacific region)
ARIN (North America, a portion of the Caribbean and sub-Saharan Africa)
LACNIC (Latin American and Caribbean region)
RIPE (Europe, the Middle East and parts of Africa and Asia)

Members from IP (range) 79.181.132.102
IP address Display name
79.181.132.102 peace890

Messages posted from IP (range) 79.181.132.102
Below is a list of all messages posted from this IP (range).
Pages: [1]
IP address Poster Subject Date
79.181.132.102 JMHS Welcoming Committee Welcome peace890! Yesterday at 06:48:38 AM

Error messages from IP (range) 79.181.132.102
Below is a list of all recent error messages generated by this IP (range).
Pages: [1]
IP address Display name Message Date
No error messages from the specified IP (range) found

from the mff site, it shows:

Code Select Expand


Track IP
Enter IP (range):   

Look up IP on a regional whois-server 79.181.132.102
AfriNIC (Africa)
APNIC (Asia Pacific region)
ARIN (North America, a portion of the Caribbean and sub-Saharan Africa)
LACNIC (Latin American and Caribbean region)
RIPE (Europe, the Middle East and parts of Africa and Asia)

Members from IP (range) 79.181.132.102
IP address Display name
79.181.132.102 peace890

Messages posted from IP (range) 79.181.132.102
Below is a list of all messages posted from this IP (range).
Pages: [1]
IP address Poster Subject Date
No messages from the specified IP (range) found

Error messages from IP (range) 79.181.132.102
Below is a list of all recent error messages generated by this IP (range).
Pages: [1]
IP address Display name Message Date
No error messages from the specified IP (range) found

Not sure exactly what that tells me

When I put that IP in google, it shows no results.
...

Is this even close to what you mean, Zetan?


TY!


Lori

[Zetan]

Here is a tool I use:

http://www.dnsstuff.com/

For quick tracing of IP addresses use: IPWHOIS Lookup

From the IP Address, it originates from Israel.


Also, you can search for the website they have in their profile. member@somewhere.com. << Google the web address. And if they have entered a default website, search that too.

It looks suspicious to me 

[omapie]

That is a nice tool! So that's how you told they originated in Israel?

OK. So on both sites:

Code Select Expand

Hostname: bzq-79-181-132-102.red.bezeqint.net
email given: arsenalfcyears@yahoo.co.uk

So the email they use is useless to me since a yahoo email is essentially untraceable right -- from the perspective of a forum... Yes?

It's theoretically possible as we do have some hs alumni overseas but... I'd guess unlikely that they'd also have FM &/or CFS/ME or related illnesses. If they had that, odds are good they'd be back in the states.

Most likely, they'd have no reason to be in both groups ... unless they knew me & just wanted to see what I was up to. ...in which case, I'd KNOW that! Well... theoretically. LOL OY!


And it's (theoretically) possible that they also have an interest in TPM also... but I wouldn't put it anywhere near the "likely" category...

Thus, my conclusion is they're a spammer. Solid logic?

TY!

Hugs!


Lori

[G6Cad]

It's a spammer yes, been banned from several forums already.
Add a ban and forget about it, we are not a spam forum support, we support tinyportal here.

[omapie]

Cool. Yes. I know this is TP support here. Thought it was okay since it's related to a forum & this is a general board which says, "...talk about anything and everything in this board." I was just trying to figure out how ya'll come to these conclusions so I don't ask more stupid questions.


Thanks for the help though, Zetan. Greatly appreciate the assist.

Take good care!

Lori

[catchpen]

Around 4 members here too with the same type sigs and home pages, 2 with the same IP's.  I deleted some one of the sigs, but the others never post. Nothing wrong done yet but kinda weird, I'm waiting for the spam D-day anytime now.  Hopefully they're reading this , there are more effective, friendlier ways to advertise a site.

"they had been attempting to hack another site which belongs to some of the team."

How do verify hack attempts? I'm just asking because I don't know.

[G6Cad]

Again, the best answers about spam and hack, is provided from forums that have support for this kind of things. So a google would show you the way