Welcome, Guest!!
follow us on... rss

Author Topic: Curious spammer activity  (Read 4880 times)

Jintan

  • Newbie
  • *
  • Posts: 6
    • View Profile
Curious spammer activity
« on: July 11, 2009, 10:59:23 AM »
I appreciate the work you all do. The lists here make confirming spam squirrel login attempts much easier. I had this one register at the forum today, and it is known on the BotScout list.

Buy cialis

212.95.54.172
inhargeberhat @ gmail.com

Very stealth-like name there. When I went to do the ban, I noticed it was "Modifying Password". This is after the registration was completed so not part of that. I have thought about it, and just can't see the purpose of a password change. Thanks.

MysteryFCM

  • Moderator
  • Full Member
  • *****
  • Posts: 200
    • View Profile
    • I.T. Mate
Re: Curious spammer activity
« Reply #1 on: July 11, 2009, 11:05:15 AM »
Hiya dude :)

I've never actually known a spambot do that, as there's usually little reason for it.

The IP belongs to our friends at the IST btw ;)

http://hosts-file.net/?s=212.95.54.172
Regards
Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

Jintan

  • Newbie
  • *
  • Posts: 6
    • View Profile
Re: Curious spammer activity
« Reply #2 on: July 11, 2009, 11:16:11 AM »
Light speed reply there. I'll have to think on it some more - must be a purpose to doing that. Just happened to catch it right at that moment, and I likely wouldn't have had reason to check further. Gracias.

MysteryFCM

  • Moderator
  • Full Member
  • *****
  • Posts: 200
    • View Profile
    • I.T. Mate
Re: Curious spammer activity
« Reply #3 on: July 11, 2009, 11:20:45 AM »
The only possible reason I could think of, is to try and appear a little more "human", but given the nature of the activity, this is not one of the things things I'd have thought of if I was trying to do such.
Regards
Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

Mike

  • Administrator
  • Sr. Member
  • *****
  • Posts: 300
    • View Profile
Re: Curious spammer activity
« Reply #4 on: July 11, 2009, 01:02:48 PM »
It's also possible the bot was just blindly following links and testing various exploits on whatever form it found. It may also have been changing the password to a common password that it uses on all of its successful logins (so the accounts it makes can all use the same password).

The only possible reason I could think of, is to try and appear a little more "human", but given the nature of the activity, this is not one of the things things I'd have thought of if I was trying to do such.
Please don't PM me for assistance- post your questions in the forum where others can see them.

Jintan

  • Newbie
  • *
  • Posts: 6
    • View Profile
Re: Curious spammer activity
« Reply #5 on: July 11, 2009, 06:57:10 PM »
Last poster Anan here:

http://www.forumpostersunion.com/showthread.php?t=3041&page=5

Quote
They are not using just bots.
For everyone info, they are not using just bots. I've put my own question in my language (Thai) in the registration page. They can still pass through.

The language angle makes for a convincing argument. Yes? Though still does not lock down why a password change - Mike's idea of simplifying is one,  though not sure where that takes them after. Naive name choice makes them a given to get banned - would think the botmakers would know that.