Welcome to Geeklog Wednesday, May 22 2013 @ 07:48 AM EDT
You may want to check if you have a registered user on your site who's email address is new@sys54.3fn.net or new1@sys54.3fn.net (or a variation thereof). On at least two Geeklog sites (including geeklog.net) that user has suddenly started posting comment spam (for drugs and pills) after the account lay dormant for a year or longer. The oldest accounts found so far date back to August 2004.
Account names differ but follow a pattern: 9NoraRebecca, 3BillAlika, 7FlossieOma, 9AlmaNoguri
We suggest that you delete or at least ban that user (banning a user is only supported as of Geeklog 1.4.0). If you find any interesting variation of the above patterns and suspect it's the same user, feel free to email us and send us the details.
Here's what others have to say about 'A spammer's "sleeper" account on Geeklog sites':
The following comments are owned by whomever posted them. This site is not responsible for what they say.
username: 0PattyReuben
email address: new@sys54.3fn.net
reg date: August, 20, 2004
last login: January, 10, 2006
IP address: 216*
spamments: 52
impact: pathetic...
So sad people do things like this... No life what so ever :(
---
Victor B. Gonzalez -
http://aeonserv.com
Welcome back Mr. Professional Theme maker!
Sam
---
Victor B. Gonzalez -
http://aeonserv.com
- 1NametheunKodo, new@sys54.3fn.net, 2004-08-11
- 2GregNepartak,new1@sys54.3fn.net,2005-03-17
Thanks for the tip.
If you have phpMyAdmin access, the quickest way to find these users is to run this query:
SELECT * FROM gl_users WHERE email LIKE '%sys54%'
---
Geeklog components by PortalParts -- www.portalparts.com
Infact make all links nofollow unless the user has a follow permission set!
---
Shane | www.EyeCraveDVD.com
select * from gl_users where email like '%3fn%';---
Victor B. Gonzalez -
http://aeonserv.com