Spammers posting through existing accounts with no need to login?

beerForo said:
Hit by this today, same IP, old account with real posts. Does banning the IP do it? Or wasn't there some fix in one of these posts, a file?
Click to expand...
All of the accesses on two forums I was monitoring all used the same Moldova IP address, so this stopped the immediate threat. But yeah...beyond today, I have a feeling this will grow like wildfire, now that a new method has been put into use.

The OzzModz add-on has already blocked login attempts, and all are from different IP addresses. Were they the same spambot? No idea. But to me, any unauthorized access is unwanted, so, good riddance!
 
Wildcat Media said:
The OzzModz add-on has already blocked login attempts, and all are from different IP addresses. Were they the same spambot? No idea. But to me, any unauthorized access is unwanted, so, good riddance!
Click to expand...

Very possible it’s the same bot program, they can appear as being from any IP
 
Feanor said:
If these logins and passwords have been compromised, it may be helpful to allow the spammer to do their thing so you know which accounts need to be to reset.
Click to expand...
Keeping them out completely is best. But the whole incident does make me want to expand on your idea and reset the passwords on all the dormant accounts. I think one of my add-ons can do that (Dragonbytes Security?), or maybe XF can do it also.

It might also do well for XF to incorporate a new password policy system where we can perhaps automatically expire a password that hasn't been accessed for a period of our choosing (one year, for example). We might need a disclaimer during registration telling new members that if they don't access their accounts after X number of days/years/months that the password will automatically be reset.
 
Ozzy47 said:
Very possible it’s the same bot program, they can appear as being from any IP
Click to expand...
I'd bet it's the same also. 👍 This single Moldovan server woke a lot of us up to the exploit, but I agree--now that it has proven to work, we'll see a lot more of the same exploit from all over the world.

Well, some of us will see it...but others who install the (cough) right add-on (cough) have already dealt with it. 😁
 
Feanor said:
Banning the IP is just a temporary bandaid. If these logins and passwords have been compromised, it may be helpful to allow the spammer to do their thing so you know which accounts need to be to reset.
Click to expand...
agree - i have un-banned the ip. gonna see how many more he's got
 
Last edited:
I don't see it as a huge deal, they are effectively giving themselves away with each post. Simply delete the post and force password reset on that account. Wash, rinse, and repeat if it happens again. Eventually all the weak passwords will be weeded out.

Mind you that is ok for smaller forums, for larger forums that might be a task and a half.
 
Last edited:
MapleOne said:
I don't see it as a huge deal, they are effectively giving themselves away with each post. Simply delete the post and force password reset on that account. Was, rinse, and repeat if it happens again. Eventually all the weak passwords will be weeded out.

Mind you that is ok for smaller forums, for larger forums that might be a task and a half.
Click to expand...

170,000 members, 6 million posts over the last 20+ years... yep, - a task and a half
 
Screenshot (4).png


I have some of the OzzMods addons installed and when I look at the logs the vast majority of all nefarious activity comes from two ip addresses

33.139.53.81 & 33.139.53.82

I get a lot of crap from India too but these two IP addresses are spending way too much time snooping on my site. Been watching them for days hit every link they can including contact form, logins etc.
 
MapleOne said:
I get a lot of crap from India too but these two IP addresses are spending way too much time snooping on my site. Been watching them for days hit every link they can including contact form, logins etc.
Click to expand...
How are you watching them to know what they have been doing? Another add-on to log actions ??
 
MapleOne said:
I get a lot of crap from India too but these two IP addresses are spending way too much time snooping on my site. Been watching them for days hit every link they can including contact form, logins etc.
Click to expand...

I don't seem to get a lot of activity on this one forum in terms of spammers, but I also set up two lists of IP address blocks I generated and exported as text files at ip2location.com and inserted them into my firewall (using ipset and iptables), so I have a lot of countries blocked already. But with Cloudflare between us and the Internet, I don't know how effective that is anymore. I have set up challenges at Cloudflare to slow them down, but blocking IPs isn't possible unless it's through a paid account.
 
MapleOne said:
View attachment 280217


I have some of the OzzMods addons installed and when I look at the logs the vast majority of all nefarious activity comes from two ip addresses

33.139.53.81 & 33.139.53.82

I get a lot of crap from India too but these two IP addresses are spending way too much time snooping on my site. Been watching them for days hit every link they can including contact form, logins etc.
Click to expand...


I get a lot of crap caught by @Ozzy47's 'Contact Us Log' from that datacentre 🤔

1674126862708.png
 
I went to use the Batch User Update to apply a security lock to all users who have not logged in since 1/1/2020, it found 6,000 users, and said it updated them, but didn't actually apply the security lock to those users. Xenforo says this is a bug that will be fixed in the next release and they don't have a workaround, but surely there is a MYSQL statement that could safely be applied to address this?
 
ActorMike said:
I went to use the Batch User Update to apply a security lock to all users who have not logged in since 1/1/2020, it found 6,000 users, and said it updated them, but didn't actually apply the security lock to those users. Xenforo says this is a bug that will be fixed in the next release and they don't have a workaround, but surely there is a MYSQL statement that could safely be applied to address this?
Click to expand...
I've run it over 500k members without issue.
I don't know what criteria is triggering that bug but I'm running latest XF version and not impacted.
 
loulou said:
I've run it over 500k members without issue.
I don't know what criteria is triggering that bug but I'm running latest XF version and not impacted.
Click to expand...
I got a support message confirming the bug for batch updating users and that it will be fixed in the next release.
 
You must log in or register to reply here.
Back
Top Bottom