Porn spam

[tjudy]

There is a single user who registered on 7/18, and his only activity was also on 7/18 in a time period that encompasses when the spam PM's were sent. His IP address originates in Argentina. I sent him an email and PM asking him to respond to me. He may be a victim as well... I do not know. If he does not respond I will see what can be done to determine if his registration carried a hack script in here with it... but I am totally clueless as to how to figure that out.

 

[Microman]

Ted,
As soon as i realised that some idiot had used my PM to send the spam i looked in my Sent Messages folder. My sent messages folder is completely empty with no sign at all of a PM to Norm. You wouldnt guess that the account had been compromised at all.
So sorry i cant help you here Ted....
Mark...

 

[mummymonkey]

Pr0n

I got one from tetras.
Title: youtube.com - better version.
Sent: 2008-07-19 @ 12:46am

 

[RiC]

Got mine from mati, a user registered in January 2005 and who posted one single post:

http://forum.apistogramma.com/showthread.php?t=2776

 

[tjudy]

Here is what I think happened...

THere is one user who registered on July 18 and has a last activity log in the time frame that all of the spam PM messages were sent. Literally all of the users that have been listed, except microman, have not been active in over a year except for July 18, hour 18, between the 5th and 11th minute of that hour. Too much coincidence in my opinion. I will ban that new user and his IP. There are no other members with that address.
I think that the attack was a one-time thing, and that the user has to be in to make it happen again... otherwise new PM's should be arriving, but they are not.

Ted

 

[mummymonkey]

passwords

On I hunch I tried something and it worked.
I'll PM you the info Ted.

 

[Microman]

You are correct Graham....
I can also log in through other accounts and now i also now know how its done.
I logged into the first one you logged into.
Mark...

 

[tjudy]

Thanks for the heads up Graham. I will make an announcement and sticky it. I will also see if there is a way to prevent people from using usernames as passwords. Anyone know if this is possible in VBulletin?