Red flag?! Spam attack on multiple xenforo boards if not all

[Bram]

Dear @XenForo team

Our boards are currently flooded by old accounts with zero posts all posting spam messages containing this link

www.bece.com.au

At first i thought this was local problem but visiting other xenforo boards i know i see all of them being receiving a lot of messages with this url.

This might be a wave of spam coming in and they are all avoiding the spam cleaner becuase they are years old accounts.

 

[Chris D]

Old accounts do not automatically bypass spam checking measures.

It is possible to configure XF to do that, but it's not something we do by default.

 

[Bram]

They are caught in our approval queue, but i am just posting it here so you guys and other forum owners running Xenforo are aware this happens now in the last hour.

 

[Bram]

if you are affected as well ban this ip: 5.188.84.240

 

[smozgur]

Our boards are currently flooded by old accounts with zero posts all posting spam messages containing this link

We found two posts like this, both posted today.

How does this happen? One of the accounts has a legitimate post in the past. Does it mean those accounts are compromised?

 

[Paul B]

One of the accounts has a legitimate post in the past.

That's a standard spammer tactic.

Does it mean those accounts are compromised?

Possibly.
Or perhaps it's just a spammer playing the long game.

The IP addresses and account activity should provide some clues.

 

[smozgur]

Thanks, @Brogan.

Or perhaps it's just a spammer playing the long game.

The user's legitimate post is two years old and the IP addresses are totally different. Assuming it is a compromise and applying security lock on the account.

 

[Claudio]

and they are all avoiding the spam cleaner becuase they are years old accounts.

The spam cleaner can be set up to ignore the user registration date or post count so you can mark anyone as spammer.

if you are affected as well ban this ip: 5.188.84.240

If you mark this user as spammer the IP will be submitted to StopForumSpam if you set up the API key:

 

[Bram]

We found two posts like this, both posted today.

How does this happen? One of the accounts has a legitimate post in the past. Does it mean those accounts are compromised?

An affected user said his account got hacked due to an apple data leak and the force behind it seems to be originating from the Ukrain.

This is why people should stop using the same password for all their accounts as this is the end result.