The Russians are after me!!
The main reason was that there was a user called "!!cacer!!" and it just didn't sound like the kind of username somebody would choose.
On further inspection I found a whole list of suspicious usernames:
- abal -
- abser -
- alarol -
!!!aaa!!!
- abased -
- aamdas -
!!!acb!!!
!!cacer!!
Now on my forums I have turned on the e-mail varification.
So if somebody signs up to my forums they receive an e-mail with a link which they need to click on.
This activates their account - if they don't get the e-mail their account remains disabled, you get the idea.
Every single one of the above accounts had an e-mail address:
@xoxma.net
They must have been valid e-mail addresses or else they would never have received their "please click on this link to activate you account" messages.
Of the 8 accounts, 7 of themw ere listed as "active".
None of them had made any posts in any of my forums.
Finally each of them had listed "my website" in their profiles as "porn sounding" - 6 of them failed to resolve.
If their intention was spamming, well they didn't really try and why my forums? It is not as if they are high traffic etc.
Or was it an exploit they were trying to use?
I'm using phpBB 2.0.8c which is the latest build, however the bottom of the forums always just display 2.0.8
I've deleted all of the offending accounts and added the domain @xoxma.net to my banned list so they won't be able to sign up for any new accounts.
Has anybody seen anything similar?
