How Did This Forum Spammer (sagepowder) Do This

Jan 7, 2007

I just found posts every a few days from an apparent spammer "sagepowder" in my forum (not so popular and has nothing to do with skiing). The subject is always "new here".

The content is "Any snowboarders or skiiers on this forum? I am planning a trip to BC on a snowboarding trip next week" or "I am new here, just saying hello".

I checked the apache log and it doesn't seem to be a robot script posting this. i.e. it browses to the index page, picked up my hidden field that blocks robots, post new topic, the go back to index page.

What surprised me is that when I google this guy, I got 108,000 results with the same content on tons of forums! All with total post number of 1 or 2 on each forum:

How did he do this? How to block this?

View 7 Replies


My Server Seems To Be A Spammer

Apr 29, 2009

I have recently been receiving reports from AOL's feedback loop that my server is sending out spam. I have checked the whole server, but cannot find anything strange.

There are some strange things with these feedback reports. I'll post a few lines below (i crossed out my domain with xxx):


Received: from andersenreesel by with local (Exim 4.23)

Received: (qmail 64859 invoked by uid 24901)

Received: from janislanhami by with local (Exim 4.26)

Received: (qmail 43829 invoked by uid 147); 08 Apr 2009 21:22:39 -0000

Received: from raphaelpinkertone by with local (Exim 4.23)

Received: from imanoldelphine by with local (Exim 4.23)

Received: from conrado by with local (Exim 4.23)

The first issue i have is with the subdomains, like "dispatched", "standei", "hostic", etc. These subdomains do not exist on my system. Also, my server does not run the exim MTA.

Another issue i have is the "invoked by uid" statements with uid's 147 and 24901. These UID's do not exist on my system. The passwd file uid's go to around 110.

Apart from these strange things, the IP that is listed in the upper part of the headers:


Received: from ( [])

The domain and IP address is correct there, which should indicate that the spam was sent from my system. Or wasn't it?

View 11 Replies View Related

IIS SMTP Spammer

May 10, 2009

to stop the IIS SMTP Spammers how you find the culprit spammers site I tried the smtp monitor but not avail.

View 10 Replies View Related

Chinese Spammer ...

Jun 24, 2008

I host a vBulletin forum on a US server. I've been getting a lot of signups from one particular spammer, wanting to post about gold harvesting for WoW. I've blocked his IP's, however he keeps using proxies.

He constantly signs up under the name "Array"... Is there a way I can block him for good? I can't moderate user sign-ups, as I'm mostly away from my computer and can't moderate them all the time.

View 1 Replies View Related

How To Catch This Spammer

May 16, 2007

None of domain in this email is hosted with us but there are thousand of emails day some body blast in our queue. We are failed to detect. We have enabled phpnobody spam logging but failed to get track of this user.

how to catch this spammer. There are no clues of to catch him.

[root@sm4 ~]# /root/qmHandle -m3261696

Received: (qmail 7056 invoked from network); 16 May 2007 05:34:18 -0500
Received: from (HELO User) (
by with SMTP; 16 May 2007 05:34:18 -0500
Reply-To: <>
From: "Bank of America Military Bank"<>
Subject: Notification from Bank of America Military Bank
Date: Wed, 16 May 2007 04:44:51 -0700
MIME-Version: 1.0
Content-Type: text/html;
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

<title>Military Bank Online and Bill Payer Deactivation</title>
<FONT face=Arial size=2> </FONT>
<p><font face="Arial" size="2" color="#FFFFFF"> ...<img border="0" src=""></font></p>
<p><font face="Arial" size="2">&nbsp;&nbsp; Dear
<DIV><font face="Arial" size="2">&nbsp;&nbsp; This is your official notification
from Bank of America Military Bank that the service(s) listed below<BR>
&nbsp;&nbsp; will be deactivated and deleted if not renewed immediately. Previous
notifications have<BR>
&nbsp;&nbsp; been sent to the Billing Contact assigned to this account. As
the Primary Contact, you<BR>
&nbsp;&nbsp; must renew the service(s) listed below or it will be deactivated
and deleted. <BR>
&nbsp;&nbsp; <b> <a target="_blank" href=""><FONT color=#003399>Renew
Now</FONT></a>&nbsp;</b>your <b>Military Bank Online </b>and<b> Bill Payer </b>
<DIV><font face="Arial" size="2">&nbsp;</font></DIV>
<DIV><font face="Arial" size="2"><BR>
&nbsp;&nbsp; SERVICE: <b>Military Bank Online </b>and<b> Bill Payer</b>.<BR>
&nbsp;&nbsp; EXPIRATION: <b>May,&nbsp;18 2007</b></font></DIV>
<DIV><font face="Arial" size="2">&nbsp;</font></DIV>
<DIV><font face="Arial" size="2"><BR>
&nbsp;&nbsp; Thank you for using Military Bank Online.
<br> &nbsp;&nbsp; We appreciate your business and the opportunity to serve you.</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;&nbsp;&nbsp;Bank of America Military Bank
Member Service</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;</font></DIV>
<DIV><font face="Arial" size="2"><BR>
&nbsp;&nbsp; *****************************************************************************<BR>
&nbsp;&nbsp; *****************************************************************************</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;&nbsp; Please do not reply to this message.
For any inquiries, contact Member Service.</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;&nbsp; <BR>
&nbsp;&nbsp; Copyright 2007 &nbsp;Bank of America Corporation. All rights reserved.</font></DIV>

None of domain in this email is hosted with us but there are thousand of emails day some body blast in our queue. We are failed to detect. We have enabled phpnobody spam logging but failed to get track of this user.

how to catch this spammer. There are no clues of to catch him.

View 10 Replies View Related

Found The Spammer

Dec 31, 2007

How can I found the spammer on our server?

one of our customer trying to send mail with a PHP file! but I cannot found this account, can you help me to found this user?

View 6 Replies View Related

Hostmonster And Bluehost Spammer

Dec 26, 2008

Hostmonster and Bluehost Spammer

What is the relationship between Hostmonster and Bluehost?

One spammer has a domain with an NS1.HOSTMONSTER.COM but their IP belongs to Bluehost.

View 7 Replies View Related

How To Monitor Spammer Sactivity

May 26, 2007

I just setup my own LAMP server.

It is only used for my own domains so I want to be able to watch all mail that gets sent from my server, via php or otherwise.

Basically I just want to be able to personally monitor what mail is getting sent from my server so that I can watch for possible spammer activity.

I am using postfix and webmin.. I have sendmail installed to, but I don't think it is getting used..

I guess theres got to be a log somwhere... but I am not sure where it is?

I have postfix set to CC me of all mail that gets sent but, it doesnt seem to work all the time.. just for certain things..

View 3 Replies View Related

Keep Getting An Email Spammer On My Server

May 26, 2008

Now first I will say I have NO idea how such spamming works, how a punk can get on my server and sent emails out.

I have had a team to look at it they also did something, but now it happens again for the 5th time, what can i do, are there any software or tools one can use like a antivirus to check the server and how can I avoid such sh..

View 14 Replies View Related

How I Can Stop Spammer From My Server

Jul 14, 2008

How i can stop Spammer from my server?

my control panel is CPANEL !

what software i must install?

View 4 Replies View Related

Spammer On CPanel Server

Mar 31, 2008

i have the following inside: /usr/local/apache/domlogs

all this domains are NOT hosted on my server (there are a lot more of this entries.)

I has ben told that this domain namens are used while spaming.

Is there any way to idetify what acocunt has ben hacked and sends spaming via pop3 or apache.

I note a lot of pop3 connections fron russian, china vietnam and high cpu load this happens.

(nobody sernder has already ben dsable il WHM tweaks)

View 0 Replies View Related

What Is This Email Spammer Trying To Accomplish

Sep 26, 2007

I recently moved web services for one of my hosted domains (let's call it from one server (let's call it .org) to another server (let's call it .net) has been on .org for about 5 years. .org handled all web services, and all email. I recently updated's DNS record to point and to the .net server. I didn't change the MX record or to point to .net. Mail continues to be delivered normally to on the .org server.

Except now spammers are hitting the .net server, e.g.

Sep 26 09:26:03 host postfix/smtpd[15098]: NOQUEUE: reject: RCPT from unknown[]: 554 5.7.1 <>: Relay access denied; from=<> proto=SMTP helo=<>

Is it normal practice for spammers to send dictionary attack based spam to a domain's server that doesn't even handle email? All the spam coming is clearly just random email addresses not based on anything that exsists at the domain, and most of the addresses are so very random I can't imagine they exsist anywhere.

View 1 Replies View Related

Anyone Else Seeing WordPress Spammer DDOS

Jan 5, 2007

For about a month or so now I have a domain I host under serious attack from what I think are spammers. It's a wordpress site, and they are getting big numbers of POST requests to the WordPress comments file, e.g.


POST /wp-comments-post.php HTTP/1.1
It's a well distributed attack, and I'm doing well with some scripts I wrote to block the requests to the wp-comments-post.php file. The real comment file has long since been moved, so any POST to the file gets firewalled. It's several thousand IPs from all over the place.

I don't believe it's a malicious attempt to bring the site down, but I'm guessing it's a blog comment spammer that has something set wrong and he's pounding this site to death by accident. I could be wrong on that though.

Anyone have any good defense scripts to share?

View 7 Replies View Related

How We Can STOPED FOREVER To This Spammer

May 14, 2007

in our case, HACKER no DELETE files...

He send Spam by POST to file.php

We have APACHE_suexec + PHP in SAFE_MODE=true;

Server is down 3 times in < of 24 hours by this motive.
In this moment We have more of 20.000 mails to send to Bellsouth and Yahoo...

We know this becouse we run

exim -bpr | exiqsumm -c | head

Count Volume Oldest Newest Domain
----- ------ ------ ------ ------
26797 66MB 7h 5m
3260 615KB 3h 3h
1253 540KB 9h 2h
1134 329KB 3h 2h
926 261KB 5h 3h
226 258KB 3h 3h

Wath we can do?

How we can stoped this mails?

How we can STOPED FOREVER to this spammer?

View 2 Replies View Related

Plesk 12.x / Windows :: MailEnable Locate Spammer

Nov 5, 2014

My System is a Windows Server 2012 r2 with Plesk 12.

On this system i have installed MailEnable as my Mailserver.

So at the moment something is spam on this server, but i can't find out who is it.

Received: from win02.XXXXXX([MY IP] helo=WIN02.home)
(envelope-from <root@XXXXXXXX>)
id 1XlyHP-00038b-R0
for x; Wed, 05 Nov 2014 11:57:37 +0100


The header is meaning that the spams come from root@, but there is no account with the name root@...

On linux it is so easy to find the spam with qmail or postfix. Why mailenable it is so difficult

View 3 Replies View Related

Plesk 12.x / Linux :: Disable Php Mail For Spammer Clients?

Dec 9, 2014

Sometimes my clients install untrusted scripts to their account what causes spamming, because these scripts sending high number of spam emails. Is there an automatically way to disable php mail function, or disable the account temporary?


View 3 Replies View Related

Hundreds Of "Mail Delivery Failed" Thanks To Spammer

Sep 22, 2007

Someone f'in spammer has used my legitimate email address as the from address for their spam emails. Now I am getting hundreds of

"Mail delivery failed: returning message to sender" in my inbox.

I use cpanel to host the domain/email, is there anything I can do?

View 2 Replies View Related


Jan 5, 2007

I just toke a Virtual dedicated server based on linux-vserver technology with 512Mo of ram burstable to 3 Go, to host my ipb active forum (20,000 registred members ~80 simultalinous)..

the probleme is the vds can't handle the forum due to bad memory Usage..

Look at the memstat output :


root@xxxxxx:/etc/init.d# memstat
676k: PID 2303 (/dev/zero)
436k: PID 2308 (/lib/tls/
11956k: PID 4215 (/SYSV00000000)
244k: PID 4234 (/usr/lib/
34500k: PID 4280 (/lib/tls/
252k: PID 4287 (/lib/tls/
396k: PID 4527 (/usr/lib/
264k: PID 4529 (/lib/tls/
392k: PID 4558 (/usr/lib/
264k: PID 4563 (/lib/tls/
236k: PID 4569 (/usr/lib/
3560k: PID 4714 (/lib/tls/
3556k: PID 4791 (/lib/tls/
3476k: PID 4792 (/lib/tls/
3588k: PID 4793 (/lib/tls/
3468k: PID 4794 (/lib/tls/
3564k: PID 4795 (/lib/tls/
3620k: PID 4796 (/lib/tls/
3472k: PID 4797 (/lib/tls/
3468k: PID 4819 (/lib/tls/
460k: PID 5064 (/lib/tls/
248k: PID 5087 (/lib/tls/
248k: PID 5090 (/lib/tls/
8532k: PID 6351 (/SYSV00000000)
320k: PID 7933 (/usr/lib/gconv/
307124k: PID 7969 (/lib/tls/
240k: PID 7970 (/usr/lib/locale/locale-archive)
980k: PID 12506 (/lib/tls/
752k: PID 13316 (/lib/tls/
664k: PID 17042 (/dev/zero)
404k: PID 17195 (/lib/tls/
3328k: PID 24943 (/SYSV00000000)
12248k: PID 25310 (/SYSV00000000)
11128k: PID 25311 (/SYSV00000000)
11772k: PID 25312 (/SYSV00000000)
11072k: PID 25313 (/SYSV00000000)
12028k: PID 25314 (/SYSV00000000)
12028k: PID 25316 (/SYSV00000000)
11688k: PID 25317 (/SYSV00000000)
12340k: PID 25318 (/SYSV00000000)
11224k: PID 25319 (/SYSV00000000)
11796k: PID 25320 (/SYSV00000000)
11548k: PID 25322 (/SYSV00000000)
12012k: PID 25323 (/SYSV00000000)
11736k: PID 25324 (/SYSV00000000)
11440k: PID 25325 (/SYSV00000000)
11540k: PID 25326 (/SYSV00000000)
9344k: PID 25327 (/SYSV00000000)
11164k: PID 25328 (/SYSV00000000)
12080k: PID 25329 (/SYSV00000000)
10136k: PID 25330 (/SYSV00000000)
12084k: PID 25331 (/SYSV00000000)
396k: PID 32054 (/lib/tls/
428k: PID 32055 (/lib/tls/
428k: PID 32073 (/lib/tls/
428k: PID 32074 (/lib/tls/
428k: PID 32075 (/lib/tls/
428k: PID 32076 (/lib/tls/
428k: PID 32077 (/lib/tls/
396k: PID 32087 (/usr/lib/
268k: PID 32090 (/lib/tls/
396k: PID 32140 (/usr/lib/
264k: PID 32142 (/lib/tls/
724k: /SYSV00000000 4215 6351 24943 25310 25311 25312 25313 25314 25316 ...
1280k: /dev/zero 17042
1280k: /dev/zero 17042
1280k: /dev/zero 2303
1280k: /dev/zero 2303
68k: /usr/lib/courier/authlib/authdaemond.mysql 32055 32073 32074 32075...
612k: /bin/bash 7933 17195
64k: /usr/lib/ 4215 6351 24943 25310 25311 25312 2531...
1644k: /usr/lib/locale/locale-archive 7933 7970 17195
1124k: /usr/lib/ 4215 6351 24943 25310 25311 25312 25313 ...
12k: /lib/ 2303 13316 17042
8k: /lib/ 4215 6351 24943 25310 25311 25312 25313 253...
8k: /usr/bin/logger 7970
248k: /lib/ 7933 17195
20k: /lib/ 2303 4215 4234 4527 4558 4569 6351 13316 170...
32k: /lib/ 2303 4215 5064 5090 6351 13316 17042 24943 253...
28k: /lib/ 2303 4215 4287 5064 6351 7969 13316 17042 24...
12k: /lib/security/ 2303 17042
12k: /lib/security/ 2303 17042
8k: /lib/security/ 2303 17042
4k: /lib/security/ 2303 17042
8k: /lib/security/ 2303 17042
44k: /lib/security/ 2303 17042
12k: /sbin/portmap 4287
28k: /sbin/syslogd 4234
408k: /usr/lib/ 4215 6351 24943 25310 25311 25312 25...
80k: /usr/lib/ 4215 6351 24943 25310 25311 25312 2...
136k: /usr/lib/ 4215 6351 24943 25310 25311 25312 2531...
416k: /usr/lib/ 4215 6351 24943 25310 25311 25312 25313 25...
1008k: /usr/lib/i686/cmov/ 2303 2308 4215 4280 4714 479...
196k: /usr/lib/i686/cmov/ 4215 4714 4791 4792 4793 4794 4...
12k: /usr/lib/perl/5.8.4/auto/Cwd/ 4215 6351 24943 25310 25311 25...
68k: /usr/lib/ 2303 2308 4215 5064 6351 7969 13316 17042 2...

View 4 Replies View Related

SMF Forum Hosting

Jan 10, 2009

I own a smf forum with usually 100-150 online users and sometimes it reaches 600-1000. My hosting refuses to host my forum anymore cause there is heavy cpu usage on their server.

So I want to ask you if there is any share web hosting provider that can host my forum with a reasonable prise.

View 8 Replies View Related

VBulletin Forum On Vps

Oct 25, 2009

My site has outgrown my current host and I'm strongly leaning towards a vps. I am relatively inexperienced with web hosting as for the last 18 months I've had very few issues with my current host ( They are currently saying my site is very memory and processor intensive which is why I'm going to have to leave them soon(I can't pay the dedicated server prices that would give my site the stability I desire).

About my site:

My site has 18,000+ users, its about 18 months old. 5,632 threads, 78,967 posts. It used about 150gig of bandwidth last month. The site is growing quickly (IMO). The site makes some money, but not enough to justify spending what it would cost for a dedicated server.

I'm happy to provide any other information, but what I am looking for is suggestions on:

1) Is a VPS the right choice for my site in your opinion.

2) What hosting company's would you suggest I look into.

3) How much ram/processor speed should I be looking for

4) any other information you feel I should know about this.

View 9 Replies View Related

Forum Under Attack

Feb 4, 2008

Our forum is under attack...and our host won't do anything except tell us that our load is too high and that they might turn off our account.

But, we've already turned off the forum...the only load is a note that says it's down for html...nothing.

In a very short amount of time it has has over 300,000 page requests for the same three pages.

Is there anything on my side (since I don't run the server) that I can do to stop this or prevent it...etc?

View 10 Replies View Related

Low End VPS To Power Forum

Jun 21, 2008

"Can i host a small forum at a 64mb ram vps with lighttpd and mysql? How many users can i have online?" I said that he can do that.Is this answer true?

View 14 Replies View Related

How Much Forum Bandwidth?

Jun 19, 2008

How much bandwidth does a forum take to run?

View 14 Replies View Related

Hosting A Forum On Vps

Dec 19, 2008

I want to host a invision forum. I have a lot of exp admining and modding but I have never run one myself.

I plan on using 15-30 gigs of material on site and the rest will be offsite storage.

I do not know how many members I will have it could be just a couple of hundred to a couple of thousand.

My question. I was planning on going with WiredTree because of all the great reiviews out there. And buying thier vps512 which has 60 gigs of storage and 800 monthly bandwith.

Will that be enough do you think? More, less? I would like to stay within 50-100 dollars. since I am mainly running this for recreation and not looking to make a profit.

I have never hosted a website or such before, but after reading here and doing research I do not really want a shared server.

View 5 Replies View Related

SMF Forum Optimising

Sep 3, 2008

After several stressful hours of reading these forums I have finally decided to post my own question. I have lurked and read here for months and picked my own reseller hosting after reading up on here.

I have a client with a problem with her SMF forum...

She set it up 6 months ago and needs to upgrade her hosting. Her current host is Ausweb and she has been suspended for abuse.

The scenario I need help with is SMF forum v.1.1.5
Traffic per month: 11-15 gbs
Hits per month: 10,000
Storage: 1084.8/2000 MB
Members: >200

She has been suspended 3 times last month, charged apparently for an upgrade and has forked out almost $1500 for 12 months from April, which I calculate to be $125 per month for 12 months... which should be a dedicated server!

Does she need a dedicated server?

Would a VPS suffice?

If she does.. who is economical as at this point it is non profit site although we are looking at changing that, through advertising.

What is the best scenario with the least added expense for this disillusioned forum owner who has a successful site but has had a horrendous experience with hosting?

View 14 Replies View Related

Community Forum

Aug 25, 2008

I've got my new hosting provider choice narrowed down to two providers (ServIt & WiredTree) for a Managed VPS. From the reviews here they both seem to be very similiar in customer support and reliability. The only difference I have found is that ServIt does have a community forum and WiredTree does not have a forum. It's wierd to be choosing a hosting provider based on this, so I thought I would come get your opinions on this.

View 14 Replies View Related

Phpbb3 Forum

Oct 18, 2008

I am trying to create a phpbb3 forum that can hold like 100 members. I am looking for hosting that will support my forum, is a decent price, and if I don't have to lock in any months thats an added bonus.

View 11 Replies View Related

Vps Specs To Set Up A Forum

Aug 27, 2008

We're setting up a vBulletin forum, and I'd like to know what we'll need from a vps. We expect 5000-10000 hits a day, maybe 30-60 users on at a time, and we'd like to keep quick load speeds.

So how much ram would we need to achieve fast speeds?

How many mysql database might we need (just roughly for such a sized forum)?

How much bandwidth will we need?

Plus any other info you can give!

I could also do with some VPS hosting recommendations. We'll be adding other sites (with less traffic) in the VERY near future, so we'd like them to be accomodated. A host with good support/ response time is a must, and one with excellent uptime to!

View 4 Replies View Related

Where To Host My Forum?

Dec 4, 2008

I have no experience in MySQL / database.. But I want to open a forum to learn some stuffs.

View 11 Replies View Related

Forum Integeration

Jun 21, 2008

install a phpbb3 or a SMF forum on my template html file for my web hosting company, i basically just want the forum to be under my site banner

View 7 Replies View Related

Hosting A Forum

Apr 2, 2008

What kind of webhost will I need for phpBB forum?

Here are the requirements :

A webserver or web hosting account running on any major Operating System with support for PHP

A SQL database system, one of:
FireBird 2.0 or above
MySQL 3.23 or above
MS SQL Server 2000 or above (directly or via ODBC)
PostgreSQL 7.x or above

PHP 4.3.3 or above with support for the database you intend to use. The optional presence of the following modules within PHP will provide access to additional features, but they are not required.
zlib Compression support
Remote FTP support
XML support
Imagemagick support

Of course free hosts are preferred, but nothing too expensive will do fine aswell. n_n

View 7 Replies View Related

Copyrights 2005-15, All rights reserved