[Operators] Rosters flood
Evgeniy Khramtsov
xramtsov at gmail.com
Tue Sep 7 01:50:13 CDT 2010
07.09.2010 16:45, Yann Leboulanger wrote:
> On 09/07/2010 05:59 AM, Evgeniy Khramtsov wrote:
>> Recently our SPAM filter on jabber.ru detected massive flood targeted
>> users rosters. Sample spam jids:
>>
>> 40tman_rullezz_1z2m6g at gornyak.net
>> 40tman_rullezz_ezz00545se at highsecure.ru
>> 40tman_rullezz_zum6y31 at jabber.zs1.wroc.pl
>> 40tman_rullezz_m8mlc9 at deshalbfrei.org
>> 40tman_rullezz_am5oi at jabber.ozerki.net
>> 40tman_rullezz_on5b7o3 at codingteam.net
>> 40tman_rullezz_fi0p6 at gornyak.net
>> 40tman_rullezz_csb26vy_ at jabba.mgw.pl
>> 40tman_rullezz_5wracfj at jabbers.org.ru
>> 40tman_rullezz_59tv8wpfn at jabber.zs1.wroc.pl
>> 40tman_rullezz_iiy13 at dominion.dn.ua
>> ...
>>
>> A complete list of JIDs: http://kuku.jabber.ru/~xram/40tman.log
>> Sorted by servers: http://kuku.jabber.ru/~xram/40tman-servers.log
>>
>> Any idea how to fight against this?
>>
>
> I also have this kind of JIDs and also lots of ws_conference_jabber_ru*
>
> No idea where they come from...
>
Well, if you are wondered: they came from Ukrainian person, called
"40tman" and Russian person called "tengiz". They are abusing our users
within a year or more. Initially they flooded our conferences, but
recently started flooding users rosters directly.
--
Regards,
Evgeniy Khramtsov, ProcessOne.
xmpp:xram at jabber.ru.
More information about the Operators
mailing list