Avoid mkes.com from touching your server - spammer

**Fakher** · August 20th, 2012, 03:28

Hello,
All hosts, please never ever allow this domain to get any single hosting account with you
mkes.com
Unfortunately i did host him on my fee hosting server and this guy was sending thousands of spam emails from my server. Look at this copy as we got an abuse report.

Attn: Sir/Madam,

I am Senior Manager, Societe General Bank. Your sincere partnership is required to enable me transfer some funds(12 Million GBP) for both of us. If interested, get back to me via my personal email: mikes1960@rocketmail.com for details.

Best Regards,
Mike Smith.

I checked my mail queue and ll you believe 80000+ emails were in queue .... :O
This was because hourly limit set by me was 100 emails/hour for all free hosting accounts.

check out image attached about the emails he sent this is last 20 days report.

View Sent Summary
[IMG]www.hostingdreams.net/spam_only/mkes.png[/IMG]

www.hostingdreams.net/spam_only/mkes.png

His details at Hosting Dreams are
IP = 79.108.250.104
Username = desty
email = lsanchez@inbox.com

Regards
Fakher

**masterbo** · August 20th, 2012, 04:26

I wonder, is there a well-known database of troublemaking users?
This is first time I see 4-1-9 messages being sent in such a straightforward way.

**Fakher** · August 20th, 2012, 04:37

Well i don't how did he get that much IDs to spam. Removal of queued emails from the server still in progress and they were as below when i saw them first time
Delivery Queue 86397 emails
Deletion in progress less then 20000 thousand now.

**wswd** · August 20th, 2012, 04:40

So just using 80,000 total emails (sounds like there were more), and 2400 emails per day...he was sending spam for 33+ days, and you never noticed?

You are going to have a lot more abusing users on your hosting if you aren't noticing something like that for over a month.

**Fakher** · August 20th, 2012, 04:44

yah i was busy changing my website and doing some modifications on forum's front end. Server loads did never go up and i didn't faced any downtime, more over i did never think that some thing like this ll happen as daily mail limit is set to 100emails/hour for every user, I ll have to reconsider this 100/hour now ....
From now onwards i shall be checking this on daily basis.

**masterbo** · August 20th, 2012, 05:10

To me, most strange thing is no one has complained about the spam during this month.
So, good luck in studying your servers and locking out abusers.

Update: here's the link I told about: FraudRecord.

**JJW** · August 20th, 2012, 07:09

Originally Posted by masterbo

I wonder, is there a well-known database of troublemaking users?
This is first time I see 4-1-9 messages being sent in such a straightforward way.

Yes there is a plugin for whmcs call fraudrecord

**JJW** · August 20th, 2012, 07:10

we use this now.

**sander k** · August 20th, 2012, 10:25

Originally Posted by JJW

we use this now.

You got a link to that plugin?
As I am going to start up a free hoster again pretty soon

**JJW** · August 20th, 2012, 10:29

http://www.fraudrecord.com

**JJW** · August 20th, 2012, 10:32

We are also going to be adding a geoip addon also for whmcs.

**sander k** · August 20th, 2012, 10:34

Originally Posted by JJW

http://www.fraudrecord.com

Thanks for the URL mate, going to check this one out.

Originally Posted by JJW

We are also going to be adding a geoip addon also for whmcs.

Got that one running allready and it helps a lot

**wswd** · August 20th, 2012, 19:05

Perhaps it's answered in the forum somewhere...I didn't read through it, but what do they do with the information? Never heard of fraudrecord before. Does the plugin ultimately flag users from their database when they try signing up in your WHMCS? If they just collect the information, it doesn't do me much good.

**masterbo** · August 20th, 2012, 19:31

Originally Posted by wswd

Perhaps it's answered in the forum somewhere...I didn't read through it, but what do they do with the information? Never heard of fraudrecord before. Does the plugin ultimately flag users from their database when they try signing up in your WHMCS? If they just collect the information, it doesn't do me much good.

As far as I understand - according to the explanations on FraudRecord - they do not keep any information (domain names etc), but keep a convoluted hash of those. I.e., if hashes match, then there's possibility the customer is a problematic one.

So, no real data are stored and can't be stored/used for any purposes.

**JJW** · August 22nd, 2012, 08:54

No If you would like to see it in action wswd i can give you a temp_admin account so you can see it. It does not automatically flag them that i have found yet. We are looking at hopefully modifying there whmcs plugin to do that so it automatically markes as fraud as the system works very well.

I am waiting on the geoip plugin that is supposed to be going free and opensource to be released. Sander is the one your using free?