Hacker/Spammer attack on SPAM forum

[lyle]

I have now gotten more than a few messages from folks that are on SPAM that they have been "permenantly banned by the Administrator" .. . . It seems someone with less than honorable intent is coming after SPAM. Several of those are also mods on SPAM. I've let mostrich know and if any of you would be willing to send me your pw to SPAM, I'd like to check things out. 

I told Chris (cbaltrin) that the IP associated with his profile was one that was banned, but I've gone back and it has changed. Cue the weird music. 

Lyle.

[stikpusher]

Yup, me too! I was wondering what I did… 🤔
I guess that it is guilt by association with the rest of you ruffians… 😏

[brandonk]

[stikpusher]

Guys, it’s a password gathering attack. If you tried to log in, they have it. They got mine so I had to do a reset.

[jeaton01]

I get the banned message too, guess I am not going there. Tell me when you have the "Indians" surrounded, Lyle!

[lyle]

These clowns have basically taken the forum over. Not sure for what I can get in, do stuff, but nothing changes. If you look at the moderator logs, it shows it started around 5:40am this morning when mostrich banned the ip that seems to be the “mother ship”. It show registered to a locationn in BC Canada… 108 60 13 41 if Amy one here can unleash the fires of hell upon them, do it! I want them to have explosive diarrhea along with uncontrolled sneezing fits!

[speedgraflex]

Brent was kind enough to inform me via Facebook. I don’t know why anyone would bother hurting SPAM. It’s not a harmful place. I feel whoever is doing this must have some mental health issues.

I wonder if for the past few years this person has somehow used the forum as a tool to do something else, what I don’t know. I don’t want to spend too much time engaging with damaged individuals but this feels more like a vendetta as the result of previous attacks to the site.

If any SPAM member would like to post completed work through the FB page, let me know. It’s still healthy.

[stikpusher]

Seems to be working ok there now…

[keavdog]

Seems to be back to normal

[lyle]

Jun 30, 2024 16:28:04 GMT -5 keavdog said:

Seems to be back to normal

Okie dokie…I have deleted six spammer accounts from Russia, not with love, since yesterday evening. All of them have .ru extensions on the email they posted. All used this IP to register. We obviously can’t ban the IP. 

Any ideas?

[keavdog]

Contact the service provider and let them know they may have a compromised server.

[lyle]

Jul 1, 2024 8:34:35 GMT -5 keavdog said:

Contact the service provider and let them know they may have a compromised server.

I've asked Torben to do that. These clowns are coming in abut 1-2 an hour, or were for a bit.l

[Steve Zuleski]

I would be concerned about them trashing the content. That would bite.

[lyle]

Jun 30, 2024 15:39:22 GMT -5 speedgraflex said:

Brent was kind enough to inform me via Facebook. I don’t know why anyone would bother hurting SPAM. It’s not a harmful place. I feel whoever is doing this must have some mental health issues.

I wonder if for the past few years this person has somehow used the forum as a tool to do something else, what I don’t know. I don’t want to spend too much time engaging with damaged individuals but this feels more like a vendetta as the result of previous attacks to the site.

If any SPAM member would like to post completed work through the FB page, let me know. It’s still healthy.

we are back online. These guys have sppoofed/faked the IP address that is needed to register as one that is needed on the DotEasy system whichs hosts SPAM. That way, the IP cannot be banned. 

Why pick on SPAM? Well, simply because 1) they can, 2) we are small and not "important" and as such fly below the radar. 

Years ago, we found hundreds of gamers on a server used for the student management software at JCPS. Someone had accidentally left a port open to the outside and these guys found it. They had it loaded up a lot. No damage, it was sort of their golden goose until found. These people get into networks anyway they can and use that for other access. Go look up the $0.25 error that led to a bunch of hackers being caught a few decades ago....

[lyle]

Jul 1, 2024 9:05:22 GMT -5 Steve Zuleski said:

I would be concerned about them trashing the content. That would bite.

It would indeed. SPAM has been through that one other time when the proboards site was abrutly shut down after an individual with an axe to grind went after us. No investigarion, go chance to defend, just gone. All data lost. 

[406 Silverado]

Man that is friggin' NUTS right there. I hope you guys get it sorted out as that has the potential to be a lot more trouble the longer they have any kind of presence on the site.

[stikpusher]

Jul 1, 2024 9:26:27 GMT -5 lyle said:

Jul 1, 2024 9:05:22 GMT -5 Steve Zuleski said:

I would be concerned about them trashing the content. That would bite.

It would indeed. SPAM has been through that one other time when the proboards site was abrutly shut down after an individual with an axe to grind went after us. No investigarion, go chance to defend, just gone. All data lost. 

Don't even get me started on that one...