ÄTpumpUnderScoreupp

filler56789 · 22nd January 2023, 19:05

Maybe the Admin should create a script or something to block every post which contains the godd@mn string
(@ pump _ upp)
that leads to the godd@mn biTCHcoin $påm site?

LoRd_MuldeR · 23rd January 2023, 00:07

At the moment, all that we moderators can do is deleting those Spam posts as they pop up. Which is what I have been doing quite a lot, over the past days.

Since these posts seem to come mostly from "legitimate" accounts, which apparently have been compromised (probably by brute-forcing weak passwords), completely banning the affected accounts doesn't seem adequate.

StainlessS · 23rd January 2023, 01:54

Something that had me a little flustered was,
I reported a spam post by a compromised [EDIT: seemingly] genuine user, and posted that I had done so,
My post was deleted, and the spam post was not.

"did the spammer have moderator rights" was question that I was asking myself.
Spammer was actually on-line at the time.

Swede · 25th January 2023, 05:41

All of those posts came from 109.107.166.230 which of course is banned from now on (but I guess of no use) My best guess is that this was a robot that used weak passwords to compromise old accounts (pls. dont use password as password).

wonkey_monkey · 25th January 2023, 14:53

Phew, I use password2, I'm safe.

StainlessS · 25th January 2023, 17:44

109.107.166.230, would seem to be Moldova. [ https://iplookup.flagfox.net/ ]

Quote:

Phew, I use password2, I'm safe.

Great minds think alike, I use that too.

gonca · 27th January 2023, 22:13

Quote:

Originally Posted by StainlessS

109.107.166.230, would seem to be Moldova. [ https://iplookup.flagfox.net/ ]

Great minds think alike, I use that too.

Great, now I know both your passwords

wonkey_monkey · 27th January 2023, 23:11

Nice try but I just changed it to password3.

filler56789 · 28th January 2023, 00:56

Back on-topic...

Quote:

Originally Posted by StainlessS

"did the spammer have moderator rights"

was question that I was asking myself.

I.I.R.C., that was the THIRD time that it happened in Doom9's forumware :-/
The first time happened in 2010
(I.I.R.C., again).

LoRd_MuldeR · 28th January 2023, 18:51

We have no indication that a moderator account was "hijacked". Just normal user accounts with, presumably, weak passwords. That's it.

22nd January 2023, 19:05	#1 \| Link
filler56789 SuperVirus Join Date: Jun 2012 Location: Antarctic Japan Posts: 1,341	ÄTpumpUnderScoreupp Maybe the Admin should create a script or something to block every post which contains the godd@mn string (@ pump _ upp) that leads to the godd@mn biTCHcoin $påm site? __________________ «Your software patents have expired.»

23rd January 2023, 00:07	#2 \| Link
LoRd_MuldeR Software Developer Join Date: Jun 2005 Location: Last House on Slunk Street Posts: 13,244	At the moment, all that we moderators can do is deleting those Spam posts as they pop up. Which is what I have been doing quite a lot, over the past days. Since these posts seem to come mostly from "legitimate" accounts, which apparently have been compromised (probably by brute-forcing weak passwords), completely banning the affected accounts doesn't seem adequate. __________________ Go to https://standforukraine.com/ to find legitimate Ukrainian Charities 🇺🇦✊ Last edited by LoRd_MuldeR; 23rd January 2023 at 00:13.

23rd January 2023, 01:54	#3 \| Link
StainlessS HeartlessS Usurer Join Date: Dec 2009 Location: Over the rainbow Posts: 10,571	Something that had me a little flustered was, I reported a spam post by a compromised [EDIT: seemingly] genuine user, and posted that I had done so, My post was deleted, and the spam post was not. "did the spammer have moderator rights" was question that I was asking myself. Spammer was actually on-line at the time. __________________ I sometimes post sober. StainlessS@MediaFire ::: AND/OR ::: StainlessS@SendSpace "Some infinities are bigger than other infinities", but how many of them are infinitely bigger ???

25th January 2023, 14:53	#5 \| Link
wonkey_monkey Formerly davidh***** Join Date: Jan 2004 Posts: 2,456	Phew, I use password2, I'm safe. __________________ My AviSynth filters / I'm the Doctor

27th January 2023, 23:11	#8 \| Link
wonkey_monkey Formerly davidh***** Join Date: Jan 2004 Posts: 2,456	Nice try but I just changed it to password3. __________________ My AviSynth filters / I'm the Doctor

25th January 2023, 05:41	#4 \| Link
Swede Deputy Join Date: Jan 2002 Location: Sthlm, Sweden Posts: 1,441	All of those posts came from 109.107.166.230 which of course is banned from now on (but I guess of no use) My best guess is that this was a robot that used weak passwords to compromise old accounts (pls. dont use password as password).

28th January 2023, 18:51	#10 \| Link
LoRd_MuldeR Software Developer Join Date: Jun 2005 Location: Last House on Slunk Street Posts: 13,244	We have no indication that a moderator account was "hijacked". Just normal user accounts with, presumably, weak passwords. That's it. __________________ Go to https://standforukraine.com/ to find legitimate Ukrainian Charities 🇺🇦✊ Last edited by LoRd_MuldeR; 28th January 2023 at 18:53.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode