[Solved] Suspended: Sandysgg

[sassysandy]

a. sandysgg

 

b. stevie

 

c. sgg.heliohost.org

[Tjoene]

This support request is being escalated to our root admin.

[wolstech]

To add to tjoene, the reason given for the suspension was:

Sending spam mail.

We received an abuse report for the account. The content shows that it appears to be a spambot registering on a forum at http://sgg.heliohost.org/phpbb. It picked a real email address, and the owner of the email address reported the registration email as spam.

 

Krydos has to make the final decision on this issue, but he often unsuspends these as long as you agree to fix the issue.

[sassysandy]

If I can get back on to the forum I will attemp to fix the issue but obviously while the account is suspended I can do nothing.

 

Any advice as to how to stop this in the settings of phpbb would be helpful.

[wolstech]

You generally need to install an antispam mod that makes it impossible for the bot to ever register (your best bet are those that ask a question like "What color is the ball in this picture? (picture here)" that a bot won't understand). Captchas also help, but bots are getting very good at them these days.

 

Or you can just disable the email functionality entirely. It won't fix your forum being abused, but it will reduce the odds of being suspended again.

[Krydos]

@admins, thanks for explaining all of that.

 

The only thing I have to add is the actual abuse report:

We have received a complaint about your account. Please investigate and fix within
24 hours.

Hurricane Electric Abuse Department
support@he.net

From fbl@madm-pitbull.atl.sa.earthlink.net  Mon Aug 24 11:45:08 2015
Return-Path: <fbl@madm-pitbull.atl.sa.earthlink.net>
X-Original-To: report@abuse.he.net
Delivered-To: report@abuse.he.net
Received: from he.net (he.net [216.218.186.2])
       by abuse.he.net (Postfix) with SMTP id AA9A45401D0
       for <report@abuse.he.net>; Mon, 24 Aug 2015 11:45:08 -0700 (PDT)
Received: from hazard.mail.atl.earthlink.net ([207.69.200.161]) by he.net for
<abuse@he.net>; Mon, 24 Aug 2015 11:46:32 -0700
Received: from madm-pitbull.atl.sa.earthlink.net ([209.86.64.160])
       by hazard.mail.atl.earthlink.net with esmtp (Exim 3.36 #1)
       id 1ZTxXK-0003b0-00
       for abuse@he.net; Mon, 24 Aug 2015 15:36:06 -0400
Received: (from fbl@localhost)
       by madm-pitbull.atl.sa.earthlink.net (8.13.8/8.13.8/Submit) id t7OIj6FK003765;
       Mon, 24 Aug 2015 14:45:06 -0400
Message-Id: <201508241845.t7OIj6FK003765@madm-pitbull.atl.sa.earthlink.net>
Content-Transfer-Encoding: binary
Content-Type: multipart/report; boundary="_----------=_1440441906358220";
report-type="feedback-report"
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.029 (F2.74; T1.38; A2.12; B3.07; Q3.07)
Date: Mon, 24 Aug 2015 14:45:06 -0400
Subject: FW: =?UTF-8?B?V2VsY29tZSB0byAiU2F0aXNmYWN0aW9uIEZvcnVtIg==?=
To: abuse@he.net
From: fbl@abuse.earthlink.net

This is a multi-part message in MIME format.

----------=_1440441906358220
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Content-Type: text/plain

This is an automated report for an email message received by fbl@abuse.earthlink.net

----------=_1440441906358220
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Content-Type: message/feedback-report

Feedback-Type: abuse
Version: 1
Source-IP: 65.19.143.2
Feedback-Agent: SpoonFeed/0.1
Received-Date: Mon, 24 Aug 2015 11:15:57 -0400

----------=_1440441906358220
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: message/rfc822

Return-Path: <sandysgg@stevie.heliohost.org>
Received: from mx-jacana.atl.sa.earthlink.net ([207.69.195.26])
       by mdl-harvest.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id
1ztTtz5Si3Nl36V0; Mon, 24 Aug 2015 11:15:57 -0400 (EDT)
Received: from stevie.heliohost.org ([65.19.143.2])
       by mx-jacana.atl.sa.earthlink.net (EarthLink SMTP Server) with ESMTP id
1ztTty1lD3Nl34e0
       for <wlpf151@earthlink.net>; Mon, 24 Aug 2015 11:15:56 -0400 (EDT)
Received: from sandysgg by stevie.heliohost.org with local (Exim 4.80)
       (envelope-from <sandysgg@stevie.heliohost.org>)
       id 1ZTtTv-0003Ss-0T
       for wlpf151@earthlink.net; Mon, 24 Aug 2015 08:15:53 -0700
To: =?UTF-8?B?WFByR00=?= <wlpf151@earthlink.net>
Subject: =?UTF-8?B?V2VsY29tZSB0byAiU2F0aXNmYWN0aW9uIEZvcnVtIg==?=
From: <sassysandyrrr@gmail.com>
Reply-To: <sassysandyrrr@gmail.com>
MIME-Version: 1.0
Message-ID: <4c0911aeb4d6873f8e24524326f72b62@sgg.heliohost.org>
Date: Mon, 24 Aug 2015 08:16:18 -0700
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: phpBB3
X-MimeOLE: phpBB3
X-phpBB-Origin: phpbb://sgg.heliohost.org/phpbb
X-AntiAbuse: Board servername - =?UTF-8?B?c2dnLmhlbGlvaG9zdC5vcmc=?=
X-AntiAbuse: User_id - 1
X-AntiAbuse: Username - =?UTF-8?B?QW5vbnltb3Vz?=
X-AntiAbuse: User IP - 188.138.159.69
X-AntiAbuse: This header was added to track abuse, please include it with any abuse
report
X-AntiAbuse: Primary Hostname - stevie.heliohost.org
X-AntiAbuse: Original Domain - earthlink.net
X-AntiAbuse: Originator/Caller UID/GID - [11232 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - stevie.heliohost.org
X-Get-Message-Sender-Via: stevie.heliohost.org: authenticated_id: sandysgg/only user
confirmed/virtual account not confirmed
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php /home1/sandysgg/public_html/phpbb/ucp.php 
X-Source-Dir: sgg.heliohost.org:/public_html/phpbb
X-ELNK-Received-Info: spv=0;
X-Authentication-Results: dkim="fail"; (2:no or failed dkim processing);
dmarc="none"; (1); dwl="miss"; den="not exempt"
X-ELNK-AV: 0
X-ELNK-Info: sbv=0; sbrc=.0; sbf=bb; sbw=000;

Welcome to Satisfaction Forum forums

Please keep this email for your records. Your account information is as
follows:

----------------------------
Username: XPrGM

Board URL: http://sgg.heliohost.org/phpbb
----------------------------

Your account is currently inactive and will need to be approved by an
administrator before you can log in. Another email will be sent when this
has occurred.

Your password has been securely stored in our database and cannot be
retrieved. In the event that it is forgotten, you will be able to reset it
using the email address associated with your account.

Thank you for registering.

-- 
Thanks, The Management


----------=_1440441906358220--

The account sandysgg has been unsuspended.

[sassysandy]

Thank you.

 

I have switched the registration process to Admin only so no e-mail is sent when a new user attempts to register on the forum. I hope that this will prevent similar issues in the future.