Resources

Getting started

Support

Development

Topics

User Functions

Events

There are no upcoming events

What's New

Stories

No new stories

Comments last 2 weeks

No new comments

Trackbacks last 2 weeks

No new trackback comments

Links last 2 weeks

No recent new links

NEW FILES last 14 days

No new files

Welcome to Geeklog Wednesday, May 22 2013 @ 07:48 AM EDT

> >

A spammer's "sleeper" account on Geeklog sites

Spam
  • Friday, January 13 2006 @ 06:25 PM EST
  • Contributed by:
  • Views:
    10,874

You may want to check if you have a registered user on your site who's email address is new@sys54.3fn.net or new1@sys54.3fn.net (or a variation thereof). On at least two Geeklog sites (including geeklog.net) that user has suddenly started posting comment spam (for drugs and pills) after the account lay dormant for a year or longer. The oldest accounts found so far date back to August 2004.

Account names differ but follow a pattern: 9NoraRebecca, 3BillAlika, 7FlossieOma, 9AlmaNoguri

We suggest that you delete or at least ban that user (banning a user is only supported as of Geeklog 1.4.0). If you find any interesting variation of the above patterns and suspect it's the same user, feel free to email us and send us the details.

What's Related

Story Options

Trackback

Trackback URL for this entry:
http://www.geeklog.net/trackback.php/sleeper

Here's what others have to say about 'A spammer's "sleeper" account on Geeklog sites':

The following comments are owned by whomever posted them. This site is not responsible for what they say.

  • A spammer's "sleeper" account on Geeklog sites
  • Authored by:vbgunz on Saturday, January 14 2006 @ 12:08 AM EST

username: 0PattyReuben
email address: new@sys54.3fn.net
reg date: August, 20, 2004
last login: January, 10, 2006
IP address: 216*
spamments: 52
impact: pathetic...

So sad people do things like this... No life what so ever :(

---
Victor B. Gonzalez -
http://aeonserv.com

  • A spammer's "sleeper" account on Geeklog sites
  • Authored by:samstone on Saturday, January 14 2006 @ 02:40 AM EST
I think what's even more shocking is seeing Victor B. Gonzalez online. I had the check several time to make sure I was not reading an old thread.

Welcome back Mr. Professional Theme maker!

Sam
  • A spammer's "sleeper" account on Geeklog sites
  • Authored by:vbgunz on Sunday, January 15 2006 @ 05:04 PM EST
Thanks Sam :)

---
Victor B. Gonzalez -
http://aeonserv.com
  • A spammer's "sleeper" account on Geeklog sites
  • Authored by:Blaine on Saturday, January 14 2006 @ 09:53 AM EST
I found two such accounts on my site

- 1NametheunKodo, new@sys54.3fn.net, 2004-08-11
- 2GregNepartak,new1@sys54.3fn.net,2005-03-17

Thanks for the tip.

If you have phpMyAdmin access, the quickest way to find these users is to run this query:
SELECT * FROM gl_users WHERE email LIKE '%sys54%'

---
Geeklog components by PortalParts -- www.portalparts.com
  • A spammer's "sleeper" account on Geeklog sites
  • Authored by:bjudson on Sunday, January 15 2006 @ 02:59 AM EST
As a potential fix; why don't you edit all links including trackback, and anonymous comments to add <a rel="nofollow" href="blahblahblah">blahblah</a> ???

Infact make all links nofollow unless the user has a follow permission set!
  • A spammer's "sleeper" account on Geeklog sites
  • Authored by:eyecravedvd on Sunday, January 15 2006 @ 08:06 AM EST
I'm glad this person has been caught. Even though some of us go hammered by them ([link:http://www.geeklog.net/forum/viewtopic.php?forum=3&showtopic=62602])

---
Shane | www.EyeCraveDVD.com

  • A spammer's "sleeper" account on Geeklog sites
  • Authored by:drkrum on Monday, January 16 2006 @ 05:32 PM EST
yup, I had one of those as well. found it by running: select * from gl_users where email like '%3fn%';
  • A spammer's "sleeper" account on Geeklog sites
  • Authored by:vbgunz on Thursday, February 16 2006 @ 10:16 PM EST
A new user with the handle FannyGabby at IP 205.178.145.65, just spammed my site again... Just letting everyone know...

---
Victor B. Gonzalez -
http://aeonserv.com

Post a Comment

Your Name
Create Account
Allowed HTML Tags:
<p>, <b>, <strong>, <i>, <a>, <em>, <br>, <tt>, <hr>, <li>, <ol>, <ul>, <code>, <pre>, [code], [raw], [page_break], [staticpage:]InformationInformation[staticpage: id alternate title] - Displays a link to a static page using the static page title as the title. An alternate title may be specified but is not required. , [event:]InformationInformation[event: id alternate title] - Displays a link to an Event Link from the Calendar using the Event Title as the title. An alternate title may be specified but is not required. , [poll:]InformationInformation[poll: id alternate title] - Displays a link to a poll using the Poll Topic as the title. An alternate title may be specified but is not required. , [link:]InformationInformation[link: id alternate title] - Displays a link to a Link from the Links Plugin using the Link Title as the title. An alternate title may be specified but is not required. , [faq:], [forum:]InformationInformation[forum: id alternate title] - Displays a link to a forum topic using the text 'here' as the title. An alternate title may be specified but is not required. , [file:], [story:]InformationInformation[story: id alternate title] - Displays a link to a Story using the Story Title as the title. An alternate title may be specified but is not required. , [user:]InformationInformation[user: name alternate title] - Displays a link to a User using the Username as the title. An alternate title may be specified but is not required.
 

Security code
This question is for testing whether you are a human visitor and to prevent automated spam submissions.

What code is in the image?
Enter the bolded text, case sensitive!
Important Stuff
  • Please try to keep posts on topic.
  • Try to reply to other people comments instead of starting new threads.
  • Read other people's messages before posting your own to avoid simply duplicating what has already been said.
  • Use a clear subject that describes what your message is about.
  • Your email address will NOT be made public.