Increased spam activity for meettomy.site from compromised accounts

[glasguensis]

On our forum, although we’ve seen mostly old accounts being used, we’ve also had a couple where the user had posted in the last day or so. Fortunately most of the accounts, even if old, had few enough posts (or had never posted) that they were trapped by the MQ filter. For the rest we just need to react when we see them.

[thecoalman]

The main reason I mentioned putting the user on MQ (by whatever method) was the issue of emails. If it’s a genuine user who’s old email address is redundant he’ll never see the password reset email.

He's setting the failed login attempts to 99, the user (or bot) has to pass captcha before being presented with login screen. It's a setting under security settings to prevent brute force attacks on an account.

[P_I]

Why is it impossible to put accounts in to another group?

If you could run a query (or even have a regular cron) that puts any account that hasn't logged in for, say, 2 years, in to the NRU or a group of your choosing with a mod queue on it, why not? People who leave forums for that amount of time rarely come back, and if they do, they could still post but it would need approval which is fine. If it's a hacked account being used for spam it wouldn't show on the forum and could be dealt with quietly by the team. Win win.

From my read of the extension Auto Groups features

Add users to group(s) based on days passed since their last visit.

If I understand that correctly then it could be used to put them into either the Newly Registered Users (NRU) group or a "On Moderation Queue" group.

[HiFiKabin]

From my read of the extension Auto Groups features

Add users to group(s) based on days passed since their last visit.

If I understand that correctly then it could be used to put them into either the Newly Registered Users (NRU) group or a "On Moderation Queue" group.

Although so far my boards have escaped the onslaught that it what I have done to pre-empt the problem.

[KevC]

From my read of the extension Auto Groups features

Excellent spot. That sounds like the perfect solution.

[Mick]

Looking at a lot of these ‘users’ details many of them look like sleeper accounts especially the newer ones. They all seem to be advertising similar stuff so I would assume they’re all being driven from the same place. Either way, a good prune would be a start.

[Talk19Zehn]

Hello Derky, I'm sorry if such an attack was launched.

When I visit the website "m e e t t o m y . s i t e", it is recognised as a phishing website and blocked.

phishing-website-blocked1.png

If I follow things up, for example via / per

https://alldomains.hosting/en/whois.html or for example

https://www.whois.com/whois/meettomy.site

this website is *)registered On: 2023-10-17 and an end is displayed for the duration of one year (as of today!) - Expires On: 2024-10-17.

The idea

Code: Select all

UPDATE phpbb_users
SET user_login_attempts = 99
WHERE user_type = 0
	AND user_inactive_reason = 0
	AND user_lastvisit < 1704063600;

I find this good at first. I'm surprised by 99 login attempts and a user type = 0. Okay, you've explained why you prefer this approach.

Only on the FLY:
I'm not so sure whether a user-type is greater or less than 2 and in my opinion it would contain user_inactive_reason depending on the last login (?), compare ACP.
Is (was) there no connection there?

As well as a timestamp can / should be directed to the *)registered on date (?).

I could be wrong ...

Furthermore, I would inform Go-Daddy about this abuse, as this is apparently a typical way of dealing with stolen websites and more in order to then offer one's own site for sale (?). Possibly by deception of false facts, because the domain mercedesforum.nl carries an almost inconspicuous addition /be .... (?) ....

Best wishes and regards

[KevC]

I just used the auto groups ext on one of my forums where I had seen the same activity of old accounts logging back in to post spam.

As P_I expertly noted, you can set a group membership on 'days since last visit'.
I made a mod queue group with NEVER permissions for the ability to post anywhere unapproved, stopped profile edits (meaning they can't instead just edit links in to the profile or the sig) and stopped all email and PM ability.

I set membership to 700 days since the last visit as that seems reasonable.

And then bam, 27000 accounts are all secured from further attack. Problem solved and it's a rolling solution with no further intervention.

[ssl]

There is an extension provided for this scenario, User Reminder

[Mick]

Again, that’s relying on emails.

[ssl]

For accounts that use junk mailboxes, like spammers, this extension is perfect.
Furthermore, serious users always have an up-to-date email address.

[Mick]

But the up to date email address may not be the same one they had originally.

[P_I]

Furthermore, serious users always have an up-to-date email address.

I wish that were true. Despite posting repeated reminders on boards that I'm running we regularly find email notifications being bounced because members do not keep their email addresses updated and current. For far too many once they register and activate that's the last time they update their email address.

[HiFiKabin]

For far too many once they register and activate that's the last time they update their email address.

... and even with a board wide notice reminding everyone, no one does anything about it.

[alvo]

It's not sleeper accounts and it may have something to do with the newer phpBB code.

Until a week ago I was running version 3.0.1; it's only since upgrading to 3.3.11 that this has happened to me. I have 8000 users who have posted within the last year, and 32000 other accounts are all inactive.