The @just-do-ua.ru email addresses

[stubo]

I know you guys already know about this, but is there not something you can do to stop it, or is there anything I can do to stop people signing up using that email address.

Its getting really tiresome having to delete and ban these accounts everyday.

[Brian]

Hi, stubo.

We recommend you navigate to Settings > Forum Settings > Login & Registration and turn on the Restrict Registration feature to require the accounts to be approved before they can post. This will eliminate the headache of having to remove both their accounts and the spam they create by preventing them from spamming at all.

I've spent the majority of this morning removing these accounts from our service manually. Unfortunately their email addresses aren't limited to just that domain so it's not as simple as blocking the domain from our service since they're coming from multiple random domains as suspected. Once one domain they use is blocked they'll move on to another one. Usually what will happen is they'll register using a more widely used domain that we can't block like Gmail or Hotmail.

[stubo]

Feb 8, 2018 10:40:33 GMT -8 Brian said:

Hi, stubo .

We recommend you navigate to Settings > Forum Settings > Login & Registration and turn on the Restrict Registration feature to require the accounts to be approved before they can post. This will eliminate the headache of having to remove both their accounts and the spam they create by preventing them from spamming at all.

I've spent the majority of this morning removing these accounts from our service manually. Unfortunately their email addresses aren't limited to just that domain so it's not as simple as blocking the domain from our service since they're coming from multiple random domains as suspected.

Thanks Brian,

Luckily none have posted on my forum and we are quick to remove them as soon as they sign up. As it stands it probably wouldn't make much difference using the approve registrations feature, I will keep it in mind if they do start spamming my forum.

Do you guys have a list of domains they are using, just so I can let my staff know.

[Brian]

We haven't compiled a list, but the one you mentioned is the most prominent one.

As soon as you see a post that looks like the same type of spam you can probably assume that the domain its email address is on is a spam domain if it's just a random domain and not a known mail provider.

[millright]

My forum is getting hit with them too. I've shad to set mine to require approval. I still think proboards should block to domain altogether. At least if they do try to use gmail or another common domain they will have to fight with creating each address.

[Ghost77]

Feb 8, 2018 10:40:33 GMT -8 Brian said:

Hi, stubo .


I've spent the majority of this morning removing these accounts from our service manually. Unfortunately their email addresses aren't limited to just that domain so it's not as simple as blocking the domain from our service since they're coming from multiple random domains as suspected. Once one domain they use is blocked they'll move on to another one. Usually what will happen is they'll register using a more widely used domain that we can't block like Gmail or Hotmail.

I've just found a couple of pending registrations with this domain, they are showing up with a display name "account_disabled" - is that due to what you mention above about removing them? If so, thanks, it makes it super easy to spot them before I even have to go the pending registrations screen. 

[Brian]

Feb 8, 2018 13:08:45 GMT -8 Ghost77 said:

Feb 8, 2018 10:40:33 GMT -8 Brian said:

Hi, stubo .


I've spent the majority of this morning removing these accounts from our service manually. Unfortunately their email addresses aren't limited to just that domain so it's not as simple as blocking the domain from our service since they're coming from multiple random domains as suspected. Once one domain they use is blocked they'll move on to another one. Usually what will happen is they'll register using a more widely used domain that we can't block like Gmail or Hotmail.

I've just found a couple of pending registrations with this domain, they are showing up with a display name "account_disabled" - is that due to what you mention above about removing them? If so, thanks, it makes it super easy to spot them before I even have to go the pending registrations screen. 

Yup! Any that show up with that as their display name were either me or another employee deleting them.

The tool that we use to mass delete them changes their display name to that. Any posts they made on any forum on ProBoards are deleted, and they get locked out of their global account the moment we hit the delete button.

[cfleet1]

LOL this is crazy. I get at least 10 a day. Do some forums get more than others based on traffic?

[Kami]

Feb 8, 2018 17:15:35 GMT -8 cfleet1 said:

LOL this is crazy. I get at least 10 a day. Do some forums get more than others based on traffic?

That's likely. My forum hasn't gotten any, but we're pretty low activity since we're just a casual place with a handful of core participants.

[saltin]

I am currently getting 3 [@just-do-ua.ru] applications a day. Everyday. It's always insta-ban based on all the feedback I seen from the support board but they are tenacious, they just keep coming back. Worse that roaches

So far I have only banned accounts+emails but not IP's to avoid potential collateral damage with legitimate members but maybe I should do their IP's too. What is everyone doing?

Brian the [Account_Disabled] nickname is a nice touch I like it. I just noticed that designation today, it helps make the bad accounts stand out more for easier targeting

[Scott]

Feb 9, 2018 0:08:35 GMT -8 saltin said:

I am currently getting 3 [@just-do-ua.ru] applications a day. Everyday. It's always insta-ban based on all the feedback I seen from the support board but they are tenacious, they just keep coming back. Worse that roaches

So far I have only banned accounts+emails but not IP's to avoid potential collateral damage with legitimate members but maybe I should do their IP's too. What is everyone doing?

Brian the [Account_Disabled] nickname is a nice touch I like it. I just noticed that designation today, it helps make the bad accounts stand out more for easier targeting

IMO this is a good approach. Apparently the IPs they use keep changing so banning an IP won't necessarily block a group of spammers en masse.

[stubo]

Today is the first time I've not had any. Fingers crossed thats it done with

[Brian]

I've only had to delete 4 spammers following Pat's gigantic service-wide purge he did prior to this post.

support.proboards.com/post/7100458/thread

It's not completely over yet but there's definitely much less spam today compared to every other day since it started.

[cfleet1]

Feb 8, 2018 21:37:19 GMT -8 Kami said:

Feb 8, 2018 17:15:35 GMT -8 cfleet1 said:

LOL this is crazy. I get at least 10 a day. Do some forums get more than others based on traffic?

That's likely. My forum hasn't gotten any, but we're pretty low activity since we're just a casual place with a handful of core participants.

I think many of these new memberships are just eager to get in on our Pokemon draft. lol