Toadfish Monastery

On The Beach => Electronics and TechnoLust => Topic started by: Aggie on June 05, 2008, 10:02:02 PM

Title: Website Spammer Discombobulation
Post by: Aggie on June 05, 2008, 10:02:02 PM
I've been getting an unusually large number of bots signing up to my personal website lately.  Not a big deal, other than I need to go in and clean them out periodically (and I'm likely shutting it down soon anyways).

What's got me discombobulated is that the latest one to sign up appears to have its username based on search terms I've entered in Google over the past few months (probably February?).  Nothing racy, mind. ;)

W.....T.....F.....?  ???
Title: Re: Website Spammer Discombobulation
Post by: Sibling Lambicus the Toluous on June 05, 2008, 10:13:57 PM
Spyware on your computer?

I can only assume that it's either been sitting there monitoring your browsing the whole time, or it's recent and has gained access to your history files.
Title: Re: Website Spammer Discombobulation
Post by: Aggie on June 05, 2008, 10:34:04 PM
Very likely spyware, but how the hell is it tying my searches back to my website?
Title: Re: Website Spammer Discombobulation
Post by: Sibling Zono (anon1mat0) on June 05, 2008, 10:34:40 PM
What's scarier, spyware or someone monitoring your traffic? :help:

Or it may be a fluke.
Title: Re: Website Spammer Discombobulation
Post by: Sibling Lambicus the Toluous on June 05, 2008, 11:01:04 PM
Quote from: Agujjim on June 05, 2008, 10:34:04 PM
Very likely spyware, but how the hell is it tying my searches back to my website?
Could be that it's spamming all sorts of message boards that you visit, but you're only privy to the details for yours.

Has the Monastery been experiencing anything similar?  Attempted creation of user accounts that seem like random combinations of words?
Title: Re: Website Spammer Discombobulation
Post by: Aggie on June 05, 2008, 11:18:51 PM
Quote from: Sibling Lambicus the Toluous on June 05, 2008, 11:01:04 PMHas the Monastery been experiencing anything similar?  Attempted creation of user accounts that seem like random combinations of words?

We had an account show up with a username based on a member's real name - which shouldn't have appeared anywhere. 

I found this one weird (my site) because the previous 20 or so bogus users were random mashes of letters/pseudowords, this one was three separate words.

Quote from: Sibling Zono (anon1mat0) on June 05, 2008, 10:34:40 PM
What's scarier, spyware or someone monitoring your traffic? :help:

Or it may be a fluke.

Doubt it was a fluke - the username was 'bursitis ibuprofen dosage'.  I need to confirm whether I actually entered all three consecutively at any time - it's possible since it's all in reference to some shoulder issues I was having earlier this year and I definitely searched the latter two in combination.
Title: Re: Website Spammer Discombobulation
Post by: Griffin NoName on June 07, 2008, 01:35:46 AM
.....I'd suspect when you searched you clicked links to sites which passed those search terms on, from a browser window where you had previously accessed your website.

.....on the other hand don't rule out coincidence. Most of my searches look like yours, only the condition and medications are different. There is probably a bot that works on the basis that most people make this type of search all the time. :daz:

< I suppose I should anticipate a new user called "severe depression elderly" >

But. Spyware does seem more likely. Download and run a few spyware tools - they don't all catch the same spyware, so it's worth running severeal.
Title: Re: Website Spammer Discombobulation
Post by: Aggie on June 07, 2008, 05:38:18 AM
Any recommendations?
Title: Re: Website Spammer Discombobulation
Post by: Sibling Zono (anon1mat0) on June 07, 2008, 06:03:33 AM
The typical ones are SpybotSD (http://www.safer-networking.org/en/mirrors/index.html) and AdAware (http://www.download.com/Ad-Aware-2008/3000-8022_4-10045910.html).

Install, update, scan, enjoy...  :P
Title: Re: Website Spammer Discombobulation
Post by: Griffin NoName on June 07, 2008, 03:59:45 PM
Concur with Zono.