Strange registrations

[_| () R | Z]

hmm strange:

http://domain.prenames.com/index.php...s.com&x=35&y=8

http://domain.prenames.com/index.php....com&x=21&y=10

all registerd by the same guy, both main sites are down, all registered on this date: created: 2004-02-19 22:33:36 and the time between the creation is 4 seconds! but the copywright states: (C) 2000

[stark427]

I'm sorry for that, my bad

Here is a screenie :

[colicab-d]

From the look of that image it seems like a robot... its just someone has made it malicious in the respect it uses seemingly valid usernaes etc, and probs random dates etc, taken from adb of stuff.

id like to know if all these registrations are filing there profile sout in capslock as it may be the only sign that is indeed a robot or group..

[Mijae]

Now that you mention it, I saw one of these at my forums a few days ago, but I just ignored it by banning the member.

I'll go check it out.

[Mac Write]

Just disabling the memberlist to guests isn't good enough. if you click on someone's username in a post or announcement, you get a popup with a link to their homepage. You need to remove the ability for guests to view the homepage link from the postbit template. Where else can people view peoples homepage link other then the profile page (disabled for guests on my new forums http://mac.bigt.ca). You can see what I have done there. I am paranoid about spammers now and am making


What template is the announcement postbit in? I can't figure it out. I removed the homepage link in the postbit template but it still shows in the announcement postbit, and the announcement template doesn't have a postbit.

[tamarian]

Update:

We've had 2 new members with similar profiles, and same links listed above. We decided to not ban them, and just watch what they do. They basically started posting on topic, no spam, no links, and nothing out of the ordinary. We've emailed them about their homepage links, and they were shocked to know they were there.

[Steve Machol]

I had one of these on my forum too. I suspect this is caused by spyware on the user's computer.

[cosmin]

--
just want to report that i have had almost 10 new members in the past few days that have either used the Silent Spamming technique with usernames that look like this:

!! membername !!

... and i read the article posted by Kathy early in this thread and took the pre-caution of adding a robots.txt file as mentioned in the article.

However, what is dumbfounding me is I have had existing members all of a sudden realizing they have adult links in their profiles! they are complaining of other members stealing or 'hacking' into the profile and stealing their password, etc.

it is good to know that other forums are experiencing this issue, but what can be done from a vBULLETIN soft security to counter this so called possibility of 'spyware' etc.. ???

[tamarian]

it is good to know that other forums are experiencing this issue, but what can be done from a vBULLETIN soft security to counter this so called possibility of 'spyware' etc.. ???

I don't think vB can do much about user's PC's. Maybe obfiscate the form field name for homepage to something weird.....

But the best thing to do is inform members that they need to install ad-aware or similar spy-bot tools, to clean their PC.

[Paul]

Seeing this too

I just popped in to search for something about this when I found your thread.

We're seeing the exact same pattern from what appear to be real users. So far we haven't contacted any of them as we wanted to rule out what it might be. We don't show the homepage field anywhere in the forum, but the registration data clearly shows that a number of members have porn urls in their homepage field and are active posters that seem to be unaware of it. It's not like these are accounts registered only to get into the memberlist.php listing--they are actively participating on the forum and not as automatons.

My immediate suspicion was that this was the work of a virus or other malware, however quick searches on the web sites of antivirus vendors turn up nothing. I can only assume that the program looks for a homepage field and inserts the text on registration.

Again these are posters that are posting normal threads and replies and seem to be completely oblivious to the fact that they've got these addresses in their profiles.

Is anyone aware of a known program or virus that would do this?

[Paul]

Also wanted to mention that the addresses are generally different, both by domain and by directory and file, and lead to affiliate adult web sites. I have seen a few domains repeated, however, but the end always appears to be a random string of words.

The actual site you end up at has a different URL.

[LeeCHeSSS]

Is anyone aware of a known program or virus that would do this?

Well since google toolbar can automatically fill in form fields, then spyware certainly can as well...

[aneeley]

It looks like a page make to exploit google's ranking system. So, their site will turn up higher on lists when searched for words listed on that page.

[Paul]

It looks like a page make to exploit google's ranking system. So, their site will turn up higher on lists when searched for words listed on that page.

I don't think why it's being done is really at question--it goes without saying that someone is trying to get more traffic. The real question here is how is it getting there in the first place and who is responsible for it.

Has someone hired a bunch of people to post on forums but include these links in their profiles or is this being accomplished programatically without the user's knowledge? Is there a useragent string we could check for the people that have this installed?

[Kathy]

Has someone hired a bunch of people to post on forums but include these links in their profiles or is this being accomplished programatically without the user's knowledge? Is there a useragent string we could check for the people that have this installed?

I doubt its someone paying to have people post on forums. I find a few of these every week...and I clean them out. Initially when I found them I questioned the member. She was horrified that the url was in her profile and asked me how it got there.....From then on, the story was the same. Shock by the member as she found the url in her profile that she didn't put there.