gmail.com 50% spammers ?!

with a mysql select on my forum db for @gmail users, it seems, that 50% are spammers, and only the other 50% are regular accounts.

Spam came back!

New kind of spam is hiting my forum.

The mail server is everytime the same "gmail.com". Language and time are correct for my italian forum. No other informations are provided in the user account. No websites, no signatures. I can't block this recognizing user infos.

I must have an idea!

A spammer is breaking the wall

This morning, after an entire month of serenity, a spammer breaks the MSW and my forum. His mail server is gmail.com and i cannot stop it. In the next days i will study this case to fix this bug in my precious forum.

blacklist.php - update 08 - 25/10/2007

fromru.com today added to the list. will this be the last update?
Here you can read the updated blacklist.php file content:

// ---------------------------------------
function isSpam($eml)
{
$retVal = false;
$blackList = array( '1gb.info',
'2000lv.com',
'acceptcredit4u.info',
'achlan.cn',
'acquireton.com',
'adof.biz',
'ajrq.info',
'allandsads.cn',
'allandsmovies.cn',
'allcarehome.org',
'allfarm.cn',
'allsexmovie.info',
'amorki.pl',
'asff.info',
'atlaskit.com',
'autogid.org',
'avrilka.net',
'axigenmail.com',
'bestcarehome.org',
'bestcarhireforu.biz',
'bestfarmshop.cn',
'bigmir.net',
'bimgir.net',
'bk.ru',
'bljat.info',
'bluebottle.com',
'bonbon.net',
'bulk-actionz.info',
'buy-24h.net.ru',
'buziaczek.pl',
'chineseplugins.org',
'chukcarbo.com',
'clipssite.cn',
'clxub.com',
'cvportal.net',
'dfm.com',
'diet-us.info',
'dkblog.org',
'doge7k.com',
'dorspaceebook.com',
'downloadcrackfreesoftware.com',
'e-nation.ee',
'ebookcomspace.com',
'elfox.net',
'elovejob.info',
'erositaly.org',
'farminlive.cn',
'fda-medications.com',
'fene4ek.net',
'fola.biz',
'forward-privacy.org',
'fromru.com',
'fvoe.biz',
'gaohgy.com',
'gawab.com',
'gerop.cn',
'goak.info',
'goldwarez.org',
'goodnesss.com',
'goolook.ru',
'greatfarm.cn',
'greatwall36.org',
'healthinsurance4u.biz',
'hhwntai.cn',
'hhrntai.cn',
'hhrntaiccc.cn',
'homeallhome.org',
'homehome.org',
'hotpop.com',
'hotsearchusa.com',
'hyipprogram.org',
'i.ua',
'idbud.info',
'idlyn.info',
'ihan.info',
'inbox.ru',
'inet.ua',
'izmail.net',
'jetfix.ee',
'jrobi.info',
'kdmf-division.info',
'kinozal.tv',
'kqtr.info',
'kremenchug.ws',
'krim.ws',
'kzro.net',
'lipetsk.in',
'list.ru',
'lugarus.com',
'lviv.in',
'lvovs.com',
'macb-download.info',
'mail.by',
'mail.com',
'mail.health-ua.com',
'mail.ru',
'mail.saratov.com',
'mail333.com',
'mainru.com',
'medmail.info',
'metaping.com',
'moviesandklips.cn',
'mykqtr.info',
'mykqtr.info',
'mymail-in.net',
'mysspaccedorr.com',
'mysspaccedorrr.com',
'mysspaccedorrrr.com',
'mytop-in.net',
'neo-explode.org',
'nightmail.ru',
'o2.pl',
'onet.eu',
'onlinebetter.org',
'online-webportal.biz',
'orkeor.cn',
'penispillsenlargement.co.uk',
'peugeot-club.org',
'phreaker.net',
'playstationcrack.com',
'pmrmail.com',
'pozitifff.com',
'qwoe.biz',
'ramireschat.com',
'refinancce.biz',
'rfbjr.info',
'safebox.ru',
'saginaw-home-buyers-agent.com',
'sdfl.biz',
'sevastopol.in',
'simferopol.krim.ws',
'soccer-league.biz',
'spyslay.com',
'stylebrand.com',
'sweetville.net',
'tenbit.pl',
'terbuny.net',
'thesitelink.biz',
'tlen.pl',
'topmagic.org',
'trivas.cn',
'tyrists.info',
'tut.by',
'ua-news.net',
'ua.fm',
'uaclub.net',
'uastar.net',
'ukr.net',
'ukrmail.org',
'uncaf.cn',
'vilip.info',
'webcivil.org',
'webforpeople.org',
'wels.com',
'wp.pl',
'wpof.biz',
'yalta.krim.ws',
'yandex.ru',
'yardsormeters.info',
'yellow-jackets.com',
'youriloan.com',
'yourkqtr.info',
'zadonsk.net',
'zaraq.cn',
'zelmira.cn',
'zenxengine.cn',
'zeos.net',
'zinsco.cn',
'zirkon.cn',
'zoomers.cn',
'zubba.cn',
'zukav.cn',
'zuzanna.cn');

$eml = substr($eml, strrpos($eml, "@")+1);
$retVal=in_array($eml,$blackList);


if ($retVal==FALSE){
$dBlackList=array('.cn','.ru');
$eml=substr($eml,-3);
$retVal=in_array($eml,$dBlackList);
}
return $retVal;
}
?>

An easy antispam for phpBB

An easy antispam for phpBB, is what Davide Denicolo wrote on OntITSecurity .
This tool and my MSW will block all kind of spammers.

blacklist.php - update 07 - 22/10/2007

trivas.cn, zuzanna.cn, hhrntaiccc.cn, gaohgy.com, metaping.com, axigenmail.com, lugarus.com and siteformovies.cn today added to the list. cinese and russian servers will automatically denied in user's email.
Here you can read the updated blacklist.php file content:


// ---------------------------------------
function isSpam($eml)
{
$retVal = false;
$blackList = array( '1gb.info',
'2000lv.com',
'acceptcredit4u.info',
'achlan.cn',
'acquireton.com',
'adof.biz',
'ajrq.info',
'allandsads.cn',
'allandsmovies.cn',
'allcarehome.org',
'allfarm.cn',
'allsexmovie.info',
'amorki.pl',
'asff.info',
'atlaskit.com',
'autogid.org',
'avrilka.net',
'axigenmail.com',
'bestcarehome.org',
'bestcarhireforu.biz',
'bestfarmshop.cn',
'bigmir.net',
'bimgir.net',
'bk.ru',
'bljat.info',
'bluebottle.com',
'bonbon.net',
'bulk-actionz.info',
'buy-24h.net.ru',
'buziaczek.pl',
'chineseplugins.org',
'chukcarbo.com',
'clipssite.cn',
'clxub.com',
'cvportal.net',
'dfm.com',
'diet-us.info',
'dkblog.org',
'doge7k.com',
'dorspaceebook.com',
'downloadcrackfreesoftware.com',
'e-nation.ee',
'ebookcomspace.com',
'elfox.net',
'elovejob.info',
'erositaly.org',
'farminlive.cn',
'fda-medications.com',
'fene4ek.net',
'fola.biz',
'forward-privacy.org',
'fvoe.biz',
'gaohgy.com',
'gawab.com',
'gerop.cn',
'goak.info',
'goldwarez.org',
'goodnesss.com',
'goolook.ru',
'greatfarm.cn',
'greatwall36.org',
'healthinsurance4u.biz',
'hhwntai.cn',
'hhrntai.cn',
'hhrntaiccc.cn',
'homeallhome.org',
'homehome.org',
'hotpop.com',
'hotsearchusa.com',
'hyipprogram.org',
'i.ua',
'idbud.info',
'idlyn.info',
'ihan.info',
'inbox.ru',
'inet.ua',
'izmail.net',
'jetfix.ee',
'jrobi.info',
'kdmf-division.info',
'kinozal.tv',
'kqtr.info',
'kremenchug.ws',
'krim.ws',
'kzro.net',
'lipetsk.in',
'list.ru',
'lugarus.com',
'lviv.in',
'lvovs.com',
'macb-download.info',
'mail.by',
'mail.com',
'mail.health-ua.com',
'mail.ru',
'mail.saratov.com',
'mail333.com',
'mainru.com',
'medmail.info',
'metaping.com',
'moviesandklips.cn',
'mykqtr.info',
'mykqtr.info',
'mymail-in.net',
'mysspaccedorr.com',
'mysspaccedorrr.com',
'mysspaccedorrrr.com',
'mytop-in.net',
'neo-explode.org',
'nightmail.ru',
'o2.pl',
'onet.eu',
'onlinebetter.org',
'online-webportal.biz',
'orkeor.cn',
'penispillsenlargement.co.uk',
'peugeot-club.org',
'phreaker.net',
'playstationcrack.com',
'pmrmail.com',
'pozitifff.com',
'qwoe.biz',
'ramireschat.com',
'refinancce.biz',
'rfbjr.info',
'safebox.ru',
'saginaw-home-buyers-agent.com',
'sdfl.biz',
'sevastopol.in',
'simferopol.krim.ws',
'soccer-league.biz',
'spyslay.com',
'stylebrand.com',
'sweetville.net',
'tenbit.pl',
'terbuny.net',
'thesitelink.biz',
'tlen.pl',
'topmagic.org',
'trivas.cn',
'tyrists.info',
'tut.by',
'ua-news.net',
'ua.fm',
'uaclub.net',
'uastar.net',
'ukr.net',
'ukrmail.org',
'uncaf.cn',
'vilip.info',
'webcivil.org',
'webforpeople.org',
'wels.com',
'wp.pl',
'wpof.biz',
'yalta.krim.ws',
'yandex.ru',
'yardsormeters.info',
'yellow-jackets.com',
'youriloan.com',
'yourkqtr.info',
'zadonsk.net',
'zaraq.cn',
'zelmira.cn',
'zenxengine.cn',
'zeos.net',
'zinsco.cn',
'zirkon.cn',
'zoomers.cn',
'zubba.cn',
'zukav.cn',
'zuzanna.cn');

$eml = substr($eml, strrpos($eml, "@")+1);
$retVal=in_array($eml,$blackList);


if ($retVal==FALSE){
$dBlackList=array('.cn','.ru');
$eml=substr($eml,-3);
$retVal=in_array($eml,$dBlackList);
}
return $retVal;
}
?>

10 spammers came through the wall

10 spammers came through the Miccolis Spam Wall in 4 days with the registration moderation disabled. They are not too much... I guess. But a little rework of the wall is needed. With the next version, cinese and russian email servers will not be allowed for the registering member.

Registration moderation is disabled

The registration moderation is disabled from today. will the msw stop the spam? I hope!
My forum users will come in the community more rapidly. Will spam stay out? I hope!

blacklist.php - update 06 - 18/10/2007

hhwntai.cn and hhrntai.cn today added to the list.
Here you can read the updated blacklist.php file content:

// ---------------------------------------
function isSpam($eml)
{
$retVal = false;
$blackList = array( '1gb.info',
'2000lv.com',
'acceptcredit4u.info',
'achlan.cn',
'acquireton.com',
'adof.biz',
'ajrq.info',
'allandsads.cn',
'allandsmovies.cn',
'allcarehome.org',
'allfarm.cn',
'allsexmovie.info',
'amorki.pl',
'asff.info',
'atlaskit.com',
'autogid.org',
'avrilka.net',
'bestcarehome.org',
'bestcarhireforu.biz',
'bestfarmshop.cn',
'bigmir.net',
'bimgir.net',
'bk.ru',
'bljat.info',
'bluebottle.com',
'bonbon.net',
'bulk-actionz.info',
'buy-24h.net.ru',
'buziaczek.pl',
'chineseplugins.org',
'chukcarbo.com',
'clipssite.cn',
'clxub.com',
'cvportal.net',
'dfm.com',
'diet-us.info',
'dkblog.org',
'doge7k.com',
'dorspaceebook.com',
'downloadcrackfreesoftware.com',
'e-nation.ee',
'ebookcomspace.com',
'elfox.net',
'elovejob.info',
'erositaly.org',
'farminlive.cn',
'fda-medications.com',
'fene4ek.net',
'fola.biz',
'forward-privacy.org',
'fvoe.biz',
'gawab.com',
'gerop.cn',
'goak.info',
'goldwarez.org',
'goodnesss.com',
'goolook.ru',
'greatfarm.cn',
'greatwall36.org',
'healthinsurance4u.biz',
'hhwntai.cn',
'hhrntai.cn',
'homeallhome.org',
'homehome.org',
'hotpop.com',
'hotsearchusa.com',
'hyipprogram.org',
'i.ua',
'idbud.info',
'idlyn.info',
'ihan.info',
'inbox.ru',
'inet.ua',
'izmail.net',
'jetfix.ee',
'jrobi.info',
'kdmf-division.info',
'kinozal.tv',
'kqtr.info',
'kremenchug.ws',
'krim.ws',
'kzro.net',
'lipetsk.in',
'list.ru',
'lviv.in',
'lvovs.com',
'macb-download.info',
'mail.by',
'mail.com',
'mail.health-ua.com',
'mail.ru',
'mail.saratov.com',
'mail333.com',
'mainru.com',
'medmail.info',
'moviesandklips.cn',
'mykqtr.info',
'mykqtr.info',
'mymail-in.net',
'mysspaccedorr.com',
'mysspaccedorrr.com',
'mysspaccedorrrr.com',
'mytop-in.net',
'neo-explode.org',
'nightmail.ru',
'o2.pl',
'onet.eu',
'onlinebetter.org',
'online-webportal.biz',
'orkeor.cn',
'penispillsenlargement.co.uk',
'peugeot-club.org',
'phreaker.net',
'playstationcrack.com',
'pmrmail.com',
'pozitifff.com',
'qwoe.biz',
'ramireschat.com',
'refinancce.biz',
'rfbjr.info',
'safebox.ru',
'saginaw-home-buyers-agent.com',
'sdfl.biz',
'sevastopol.in',
'simferopol.krim.ws',
'soccer-league.biz',
'spyslay.com',
'stylebrand.com',
'sweetville.net',
'tenbit.pl',
'terbuny.net',
'thesitelink.biz',
'tlen.pl',
'topmagic.org',
'tyrists.info',
'tut.by',
'ua-news.net',
'ua.fm',
'uaclub.net',
'uastar.net',
'ukr.net',
'ukrmail.org',
'uncaf.cn',
'vilip.info',
'webcivil.org',
'webforpeople.org',
'wels.com',
'wp.pl',
'wpof.biz',
'yalta.krim.ws',
'yandex.ru',
'yardsormeters.info',
'yellow-jackets.com',
'youriloan.com',
'yourkqtr.info',
'zadonsk.net',
'zaraq.cn',
'zelmira.cn',
'zenxengine.cn',
'zeos.net',
'zinsco.cn',
'zirkon.cn',
'zoomers.cn',
'zubba.cn',
'zukav.cn');

$eml = substr($eml, strrpos($eml, "@")+1);
$retVal=in_array($eml,$blackList);

if ($retVal==TRUE){
return TRUE;
}else{
return FALSE;
}
}
?>

blacklist.php - update 05 - 17/10/2007

Here you can read the updated blacklist.php file content:

// ---------------------------------------
function isSpam($eml)
{
$retVal = false;
$blackList = array( '1gb.info',
'2000lv.com',
'acceptcredit4u.info',
'achlan.cn',
'acquireton.com',
'adof.biz',
'ajrq.info',
'allandsads.cn',
'allandsmovies.cn',
'allcarehome.org',
'allfarm.cn',
'allsexmovie.info',
'amorki.pl',
'asff.info',
'atlaskit.com',
'autogid.org',
'avrilka.net',
'bestcarehome.org',
'bestcarhireforu.biz',
'bestfarmshop.cn',
'bigmir.net',
'bimgir.net',
'bk.ru',
'bljat.info',
'bluebottle.com',
'bonbon.net',
'bulk-actionz.info',
'buy-24h.net.ru',
'buziaczek.pl',
'chineseplugins.org',
'chukcarbo.com',
'clipssite.cn',
'clxub.com',
'cvportal.net',
'dfm.com',
'diet-us.info',
'dkblog.org',
'doge7k.com',
'dorspaceebook.com',
'downloadcrackfreesoftware.com',
'e-nation.ee',
'ebookcomspace.com',
'elfox.net',
'elovejob.info',
'erositaly.org',
'farminlive.cn',
'fda-medications.com',
'fene4ek.net',
'fola.biz',
'forward-privacy.org',
'fvoe.biz',
'gawab.com',
'gerop.cn',
'goak.info',
'goldwarez.org',
'goodnesss.com',
'goolook.ru',
'greatfarm.cn',
'greatwall36.org',
'healthinsurance4u.biz',
'homeallhome.org',
'homehome.org',
'hotpop.com',
'hotsearchusa.com',
'hyipprogram.org',
'i.ua',
'idbud.info',
'idlyn.info',
'ihan.info',
'inbox.ru',
'inet.ua',
'izmail.net',
'jetfix.ee',
'jrobi.info',
'kdmf-division.info',
'kinozal.tv',
'kqtr.info',
'kremenchug.ws',
'krim.ws',
'kzro.net',
'lipetsk.in',
'list.ru',
'lviv.in',
'lvovs.com',
'macb-download.info',
'mail.by',
'mail.com',
'mail.health-ua.com',
'mail.ru',
'mail.saratov.com',
'mail333.com',
'mainru.com',
'medmail.info',
'moviesandklips.cn',
'mykqtr.info',
'mykqtr.info',
'mymail-in.net',
'mysspaccedorr.com',
'mysspaccedorrr.com',
'mysspaccedorrrr.com',
'mytop-in.net',
'neo-explode.org',
'nightmail.ru',
'o2.pl',
'onet.eu',
'onlinebetter.org',
'online-webportal.biz',
'orkeor.cn',
'penispillsenlargement.co.uk',
'peugeot-club.org',
'phreaker.net',
'playstationcrack.com',
'pmrmail.com',
'pozitifff.com',
'qwoe.biz',
'ramireschat.com',
'refinancce.biz',
'rfbjr.info',
'safebox.ru',
'saginaw-home-buyers-agent.com',
'sdfl.biz',
'sevastopol.in',
'simferopol.krim.ws',
'soccer-league.biz',
'spyslay.com',
'stylebrand.com',
'sweetville.net',
'tenbit.pl',
'terbuny.net',
'thesitelink.biz',
'tlen.pl',
'topmagic.org',
'tyrists.info',
'tut.by',
'ua-news.net',
'ua.fm',
'uaclub.net',
'uastar.net',
'ukr.net',
'ukrmail.org',
'uncaf.cn',
'vilip.info',
'webcivil.org',
'webforpeople.org',
'wels.com',
'wp.pl',
'wpof.biz',
'yalta.krim.ws',
'yandex.ru',
'yardsormeters.info',
'yellow-jackets.com',
'youriloan.com',
'yourkqtr.info',
'zadonsk.net',
'zaraq.cn',
'zelmira.cn',
'zenxengine.cn',
'zeos.net',
'zinsco.cn',
'zirkon.cn',
'zoomers.cn',
'zubba.cn',
'zukav.cn');

$eml = substr($eml, strrpos($eml, "@")+1);
$retVal=in_array($eml,$blackList);

if ($retVal==TRUE){
return TRUE;
}else{
return FALSE;
}
}
?>

blacklist.php - update 04 - 12/10/2007

Here you can read the updated blacklist.php file content:

// ---------------------------------------
function isSpam($eml)
{
$retVal = false;
$blackList = array( '1gb.info',
'2000lv.com',
'acceptcredit4u.info',
'achlan.cn',
'adof.biz',
'ajrq.info',
'allandsads.cn',
'allandsmovies.cn',
'allcarehome.org',
'allfarm.cn',
'allsexmovie.info',
'amorki.pl',
'asff.info',
'atlaskit.com',
'autogid.org',
'avrilka.net',
'bestcarehome.org',
'bestcarhireforu.biz',
'bestfarmshop.cn',
'bigmir.net',
'bimgir.net',
'bk.ru',
'bljat.info',
'bluebottle.com',
'bonbon.net',
'bulk-actionz.info',
'buy-24h.net.ru',
'buziaczek.pl',
'chineseplugins.org',
'chukcarbo.com',
'clipssite.cn',
'clxub.com',
'cvportal.net',
'dfm.com',
'diet-us.info',
'dkblog.org',
'doge7k.com',
'dorspaceebook.com',
'downloadcrackfreesoftware.com',
'e-nation.ee',
'ebookcomspace.com',
'elfox.net',
'elovejob.info',
'erositaly.org',
'farminlive.cn',
'fda-medications.com',
'fene4ek.net',
'fola.biz',
'forward-privacy.org',
'fvoe.biz',
'gawab.com',
'gerop.cn',
'goak.info',
'goldwarez.org',
'goodnesss.com',
'goolook.ru',
'greatfarm.cn',
'greatwall36.org',
'healthinsurance4u.biz',
'homeallhome.org',
'homehome.org',
'hotpop.com',
'hotsearchusa.com',
'hyipprogram.org',
'i.ua',
'idbud.info',
'idlyn.info',
'ihan.info',
'inbox.ru',
'inet.ua',
'izmail.net',
'jetfix.ee',
'jrobi.info',
'kdmf-division.info',
'kinozal.tv',
'kqtr.info',
'kremenchug.ws',
'krim.ws',
'kzro.net',
'lipetsk.in',
'list.ru',
'lviv.in',
'lvovs.com',
'macb-download.info',
'mail.by',
'mail.com',
'mail.health-ua.com',
'mail.ru',
'mail.saratov.com',
'mail333.com',
'mainru.com',
'medmail.info',
'mykqtr.info',
'mykqtr.info',
'mymail-in.net',
'mysspaccedorr.com',
'mysspaccedorrr.com',
'mysspaccedorrrr.com',
'mytop-in.net',
'neo-explode.org',
'nightmail.ru',
'o2.pl',
'onet.eu',
'onlinebetter.org',
'online-webportal.biz',
'orkeor.cn',
'penispillsenlargement.co.uk',
'peugeot-club.org',
'phreaker.net',
'playstationcrack.com',
'pmrmail.com',
'pozitifff.com',
'qwoe.biz',
'ramireschat.com',
'refinancce.biz',
'rfbjr.info',
'safebox.ru',
'saginaw-home-buyers-agent.com',
'sdfl.biz',
'sevastopol.in',
'simferopol.krim.ws',
'soccer-league.biz',
'spyslay.com',
'stylebrand.com',
'sweetville.net',
'tenbit.pl',
'terbuny.net',
'thesitelink.biz',
'tlen.pl',
'topmagic.org',
'tyrists.info',
'tut.by',
'ua-news.net',
'ua.fm',
'uaclub.net',
'uastar.net',
'ukr.net',
'ukrmail.org',
'uncaf.cn',
'vilip.info',
'webcivil.org',
'webforpeople.org',
'wp.pl',
'wpof.biz',
'yalta.krim.ws',
'yandex.ru',
'yardsormeters.info',
'yellow-jackets.com',
'youriloan.com',
'yourkqtr.info',
'zadonsk.net',
'zaraq.cn',
'zelmira.cn',
'zenxengine.cn',
'zeos.net',
'zinsco.cn',
'zirkon.cn',
'zoomers.cn',
'zubba.cn',
'zukav.cn');

$eml = substr($eml, strrpos($eml, "@")+1);
$retVal=in_array($eml,$blackList);

if ($retVal==TRUE){
return TRUE;
}else{
return FALSE;
}
}
?>

blacklist.php - update 03 - 12/10/2007

6 new servers were registered.
Here you can read the updated blacklist.php file content:

// ---------------------------------------
function isSpam($eml)
{
$retVal = false;
$blackList = array( '1gb.info',
'2000lv.com',
'acceptcredit4u.info',
'achlan.cn',
'adof.biz',
'ajrq.info',
'allandsads.cn',
'allandsmovies.cn',
'allcarehome.org',
'allfarm.cn',
'allsexmovie.info',
'amorki.pl',
'asff.info',
'atlaskit.com',
'autogid.org',
'avrilka.net',
'bestcarehome.org',
'bestcarhireforu.biz',
'bestfarmshop.cn',
'bigmir.net',
'bimgir.net',
'bk.ru',
'bljat.info',
'bluebottle.com',
'bonbon.net',
'bulk-actionz.info',
'buy-24h.net.ru',
'buziaczek.pl',
'chineseplugins.org',
'chukcarbo.com',
'clipssite.cn',
'clxub.com',
'cvportal.net',
'dfm.com',
'diet-us.info',
'dkblog.org',
'doge7k.com',
'dorspaceebook.com',
'downloadcrackfreesoftware.com',
'e-nation.ee',
'ebookcomspace.com',
'elovejob.info',
'erositaly.org',
'farminlive.cn',
'fda-medications.com',
'fene4ek.net',
'fola.biz',
'forward-privacy.org',
'fvoe.biz',
'gawab.com',
'gerop.cn',
'goak.info',
'goldwarez.org',
'goodnesss.com',
'goolook.ru',
'greatfarm.cn',
'greatwall36.org',
'healthinsurance4u.biz',
'homeallhome.org',
'homehome.org',
'hotpop.com',
'hotsearchusa.com',
'hyipprogram.org',
'i.ua',
'idbud.info',
'idlyn.info',
'ihan.info',
'inbox.ru',
'inet.ua',
'izmail.net',
'jetfix.ee',
'jrobi.info',
'kdmf-division.info',
'kinozal.tv',
'kqtr.info',
'kremenchug.ws',
'krim.ws',
'kzro.net',
'lipetsk.in',
'list.ru',
'lviv.in',
'lvovs.com',
'macb-download.info',
'mail.by',
'mail.com',
'mail.health-ua.com',
'mail.ru',
'mail.saratov.com',
'mail333.com',
'mainru.com',
'medmail.info',
'mykqtr.info',
'mykqtr.info',
'mymail-in.net',
'mysspaccedorr.com',
'mysspaccedorrr.com',
'mysspaccedorrrr.com',
'mytop-in.net',
'neo-explode.org',
'nightmail.ru',
'o2.pl',
'onet.eu',
'onlinebetter.org',
'online-webportal.biz',
'orkeor.cn',
'penispillsenlargement.co.uk',
'peugeot-club.org',
'phreaker.net',
'playstationcrack.com',
'pmrmail.com',
'pozitifff.com',
'qwoe.biz',
'ramireschat.com',
'refinancce.biz',
'rfbjr.info',
'safebox.ru',
'saginaw-home-buyers-agent.com',
'sdfl.biz',
'sevastopol.in',
'simferopol.krim.ws',
'soccer-league.biz',
'spyslay.com',
'stylebrand.com',
'sweetville.net',
'tenbit.pl',
'terbuny.net',
'thesitelink.biz',
'tlen.pl',
'topmagic.org',
'tyrists.info',
'tut.by',
'ua-news.net',
'ua.fm',
'uaclub.net',
'uastar.net',
'ukr.net',
'ukrmail.org',
'uncaf.cn',
'vilip.info',
'webcivil.org',
'webforpeople.org',
'wp.pl',
'wpof.biz',
'yalta.krim.ws',
'yandex.ru',
'yardsormeters.info',
'yellow-jackets.com',
'youriloan.com',
'yourkqtr.info',
'zadonsk.net',
'zaraq.cn',
'zelmira.cn',
'zenxengine.cn',
'zeos.net',
'zinsco.cn',
'zirkon.cn',
'zoomers.cn',
'zubba.cn',
'zukav.cn');

$eml = substr($eml, strrpos($eml, "@")+1);
$retVal=in_array($eml,$blackList);

if ($retVal==TRUE){
return TRUE;
}else{
return FALSE;
}
}
?>

Spam attack decreases his strength!!!

Two weeks ago, in only seven days, more then 130 ghost subscrivers went on my forum. I spent more then three hours to clean it.

This week, in six days, only ten ghost subscribers are passed through the wall. This is a success... isn't it?

152 known spam addresses

Now MSW knows 152 international spam addresses, and the blacklist grows everyday.

It seems to run correctly!

From this night, no one of the managed spam emails comes trough the wall to make ghost forum subscriptions.

Now I can see the light!

blacklist.php - update 02 - 06/10/2007

Here you can read the new blacklist.php file content:

// ---------------------------------------
function isSpam($eml)
{
$retVal = false;
$blackList = array( '1gb.info',
'2000lv.com',
'acceptcredit4u.info',
'achlan.cn',
'adof.biz',
'ajrq.info',
'allandsads.cn',
'allandsmovies.cn',
'allcarehome.org',
'allfarm.cn',
'allsexmovie.info',
'amorki.pl',
'asff.info',
'atlaskit.com',
'autogid.org',
'avrilka.net',
'bestcarehome.org',
'bestcarhireforu.biz',
'bestfarmshop.cn',
'bigmir.net',
'bimgir.net',
'bk.ru',
'bljat.info',
'bluebottle.com',
'bonbon.net',
'bulk-actionz.info',
'buy-24h.net.ru',
'buziaczek.pl',
'chineseplugins.org',
'chukcarbo.com',
'clipssite.cn',
'clxub.com',
'cvportal.net',
'dfm.com',
'diet-us.info',
'doge7k.com',
'dorspaceebook.com',
'downloadcrackfreesoftware.com',
'e-nation.ee',
'ebookcomspace.com',
'elovejob.info',
'erositaly.org',
'farminlive.cn',
'fda-medications.com',
'fene4ek.net',
'fola.biz',
'forward-privacy.org',
'fvoe.biz',
'gawab.com',
'gerop.cn',
'goak.info',
'goldwarez.org',
'goodnesss.com',
'goolook.ru',
'greatfarm.cn',
'greatwall36.org',
'healthinsurance4u.biz',
'homeallhome.org',
'homehome.org',
'hotpop.com',
'hotsearchusa.com',
'i.ua',
'idbud.info',
'idlyn.info',
'ihan.info',
'inbox.ru',
'inet.ua',
'izmail.net',
'jetfix.ee',
'jrobi.info',
'kdmf-division.info',
'kinozal.tv',
'kqtr.info',
'kremenchug.ws',
'krim.ws',
'kzro.net',
'lipetsk.in',
'list.ru',
'lviv.in',
'lvovs.com',
'macb-download.info',
'mail.by',
'mail.com',
'mail.health-ua.com',
'mail.ru',
'mail.saratov.com',
'mail333.com',
'mainru.com',
'medmail.info',
'mykqtr.info',
'mykqtr.info',
'mymail-in.net',
'mysspaccedorr.com',
'mysspaccedorrr.com',
'mysspaccedorrrr.com',
'mytop-in.net',
'neo-explode.org',
'nightmail.ru',
'o2.pl',
'onlinebetter.org',
'online-webportal.biz',
'orkeor.cn',
'peugeot-club.org',
'phreaker.net',
'pmrmail.com',
'pozitifff.com',
'qwoe.biz',
'ramireschat.com',
'refinancce.biz',
'rfbjr.info',
'safebox.ru',
'saginaw-home-buyers-agent.com',
'sdfl.biz',
'sevastopol.in',
'simferopol.krim.ws',
'soccer-league.biz',
'spyslay.com',
'stylebrand.com',
'sweetville.net',
'tenbit.pl',
'terbuny.net',
'thesitelink.biz',
'tlen.pl',
'topmagic.org',
'tyrists.info',
'tut.by',
'ua-news.net',
'ua.fm',
'uaclub.net',
'uastar.net',
'ukr.net',
'ukrmail.org',
'uncaf.cn',
'vilip.info',
'webcivil.org',
'webforpeople.org',
'wp.pl',
'wpof.biz',
'yalta.krim.ws',
'yandex.ru',
'yardsormeters.info',
'yellow-jackets.com',
'youriloan.com',
'yourkqtr.info',
'zadonsk.net',
'zelmira.cn',
'zenxengine.cn',
'zeos.net',
'zinsco.cn',
'zirkon.cn',
'zoomers.cn',
'zubba.cn',
'zukav.cn');

$eml = substr($eml, strrpos($eml, "@")+1);
$retVal=in_array($eml,$blackList);

if ($retVal==TRUE){
return TRUE;
}else{
return FALSE;
}
}
?>

blacklist.php - update 01 - 06/10/2007

Here you can read the blacklist.php file content:

// ---------------------------------------
function isSpam($eml)
{
$retVal = false;
$blackList = array( '1gb.info',
'2000lv.com',
'acceptcredit4u.info',
'achlan.cn',
'adof.biz',
'ajrq.info',
'allandsads.cn',
'allandsmovies.cn',
'allcarehome.org',
'allfarm.cn',
'allsexmovie.info',
'amorki.pl',
'asff.info',
'atlaskit.com',
'autogid.org',
'avrilka.net',
'bestcarehome.org',
'bestcarhireforu.biz',
'bestfarmshop.cn',
'bigmir.net',
'bimgir.net',
'bk.ru',
'bljat.info',
'bluebottle.com',
'bonbon.net',
'bulk-actionz.info',
'buy-24h.net.ru',
'buziaczek.pl',
'chineseplugins.org',
'chukcarbo.com',
'clipssite.cn',
'clxub.com',
'cvportal.net',
'dfm.com',
'diet-us.info',
'doge7k.com',
'dorspaceebook.com',
'downloadcrackfreesoftware.com',
'e-nation.ee',
'ebookcomspace.com',
'elovejob.info',
'erositaly.org',
'farminlive.cn',
'fda-medications.com',
'fene4ek.net',
'fola.biz',
'forward-privacy.org',
'fvoe.biz',
'gawab.com',
'gerop.cn',
'goak.info',
'goldwarez.org',
'goodnesss.com',
'goolook.ru',
'greatfarm.cn',
'greatwall36.org',
'healthinsurance4u.biz',
'homeallhome.org',
'homehome.org',
'hotpop.com',
'hotsearchusa.com',
'i.ua',
'idbud.info',
'idlyn.info',
'ihan.info',
'inbox.ru',
'inet.ua',
'izmail.net',
'jetfix.ee',
'jrobi.info',
'kdmf-division.info',
'kinozal.tv',
'kqtr.info',
'krim.ws',
'kzro.net',
'lipetsk.in',
'list.ru',
'lviv.in',
'lvovs.com',
'macb-download.info',
'mail.by',
'mail.com',
'mail.health-ua.com',
'mail.ru',
'mail.saratov.com',
'mail333.com',
'mainru.com',
'medmail.info',
'mykqtr.info',
'mykqtr.info',
'mymail-in.net',
'mysspaccedorr.com',
'mytop-in.net',
'neo-explode.org',
'nightmail.ru',
'o2.pl',
'onlinebetter.org',
'online-webportal.biz',
'orkeor.cn',
'peugeot-club.org',
'phreaker.net',
'pmrmail.com',
'pozitifff.com',
'qwoe.biz',
'ramireschat.com',
'refinancce.biz',
'rfbjr.info',
'safebox.ru',
'saginaw-home-buyers-agent.com',
'sdfl.biz',
'sevastopol.in',
'simferopol.krim.ws',
'soccer-league.biz',
'spyslay.com',
'stylebrand.com',
'sweetville.net',
'tenbit.pl',
'terbuny.net',
'thesitelink.biz',
'tlen.pl',
'topmagic.org',
'tyrists.info',
'tut.by',
'ua-news.net',
'ua.fm',
'uaclub.net',
'uastar.net',
'ukr.net',
'ukrmail.org',
'uncaf.cn',
'vilip.info',
'webcivil.org',
'webforpeople.org',
'wp.pl',
'wpof.biz',
'yalta.krim.ws',
'yandex.ru',
'yardsormeters.info',
'yellow-jackets.com',
'youriloan.com',
'yourkqtr.info',
'zadonsk.net',
'zelmira.cn',
'zenxengine.cn',
'zeos.net',
'zinsco.cn',
'zirkon.cn',
'zoomers.cn',
'zubba.cn',
'zukav.cn');

$eml = substr($eml, strrpos($eml, "@")+1);
$retVal=in_array($eml,$blackList);

if ($retVal==TRUE){
return TRUE;
}else{
return FALSE;
}
}
?>

Instructions to mod

This is the MSW_Miccolis_Spam_Wall.txt content:

#################################################################
## MOD Title: MSW - Miccolis Spam Wall
## MOD Author: mvincent <> (Vincenzo Miccolis) N/A
## MOD Description:
##
##
## Let's make sure the users mail server doesn't appear in the black list
## and ensure that they were trying to spam the forum
## (Prevents spam attacks)
## http://miccolisspamwall.blogspot.com/
##
## When you find a 'AFTER, ADD'-Statement, the Code have to be added after the last
## line quoted in the 'FIND'-Statement.
## When you find a 'BEFORE, ADD'-Statement, the Code have to be added before the
## first line quoted in the 'FIND'-Statement.
## When you find a 'REPLACE WITH'-Statement, the Code quoted in the
## 'FIND'-Statement have to be replaced completely with the quoted Code in the
## 'REPLACE WITH'-Statement.
##
##
##
## MOD Version: 1.0.0
##
## Installation Level: Easy
## Installation Time: 5-10 Minutes
## Files To Edit:
## includes/usercp_register.php
## language/lang_italian/lang_main.php
## language/lang_english/lang_main.php
## modz/MSW/blacklist.php
##
##############################################################
## Author Notes:
## for blacklist.php updates visit http://miccolisspamwall.blogspot.com/
##
##############################################################
## MOD History:
##
## 2007-10-05 - Version 1.0.0
## - first release
##
##############################################################
## Before Adding This MOD To Your Forum, You Should Back Up All Files Related To This MOD
##############################################################

#
#-----[ DIY INSTRUCTIONS ]---------------------------------------------
#
before you make updates to the phpbb installation, you must to upload
the modz/MSW/blacklist.php


#
#-----[ OPEN ]---------------------------------------------
#
includes/usercp_register.php

#
#-----[ FIND ]---------------------------------------------
# Line 43
$unhtml_specialchars_replace = array('>', '<', '"', '&');

#
#-----[ AFTER, ADD ]---------------------------------------------
#

// MSW - Miccolis Spam Wall - include functions
// ---------------------------------------
include ($phpbb_root_path . 'mods/msw/blacklist.'.$phpEx);
// ---------------------------------------
//

#
#-----[ FIND ]---------------------------------------------
# Line 264
message_die(GENERAL_MESSAGE, $lang['Username_taken'], '', __LINE__, __FILE__);
}

#
#-----[ AFTER, ADD ]---------------------------------------------
#

//
// MSW - Miccolis Spam Wall - email check operation
//
if ($mode == 'register' && (isSpam($email) == true))
{
message_die(GENERAL_MESSAGE, $lang['Spam_email'], '', __LINE__, __FILE__);
}
//

#
#-----[ OPEN ]---------------------------------------------
#
language/lang_italian/lang_main.php

#
#-----[ FIND ]---------------------------------------------
# Line 1044
$lang['Friend_email_too_long'] = 'I caratteri dell\'indirizzo email superano il limite previsto.';
$lang['Message_too_long'] = 'I caratteri del messaggio superano il limite previsto.';

#
#-----[ AFTER, ADD ]---------------------------------------------
#

//
// MSW - Miccolis Spam Wall - message for SPAM detection
//
$lang['Spam_email'] = 'Spiacenti, ma questo indirizzo email non è utilizzabile (SPAM MAIL).';
//

#
#-----[ OPEN ]---------------------------------------------
#
language/lang_english/lang_main.php

$lang['Friend_email_too_long'] = 'The email address you specified is too long.';
$lang['Message_too_long'] = 'The message you entered is too long.';

#
#-----[ AFTER, ADD ]---------------------------------------------
#

//
// MSW - Miccolis Spam Wall - message for SPAM detection
//
$lang['Spam_email'] = 'Sorry, this email adress is disabled (SPAM MAIL).';
//

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#

# EoM

MSW is born

This night, after years of heavy spam cleaning operations on my phpbb2.0.22 board, I wrote the solution of my nightmare problems... I hope.

MSW - Miccolis Spam Wall
MOD Version: 1.0.0