[3.3.x] Support Forum • Re: [split from] Increased spam activity for meettomy.site from compromised accounts

I have spent some time looking at this IP address's activity.
3.253.53.146
This IP address is on the banned list.

The most activity is password changes.
I found two Dating spam posts made from accounts that had password changed by IP 3.253.53.146.
Of those I looked over most for a years worth and find that some are still able to change their password after being disabled.

ALL of those I find still able to change password after being disabled were all account disabled in one action.

Feralkiwi118.149.77.153Mon Apr 15, 2024 4:13 pmUsers deactivated
» bailencitor, Clausell, rajaimran, civic, Lothar63, 007jb, dahpelua007, clerigues, jofeji, fulgen, pitagorin, manuel79es, SERCOPA, Bouaziziabdelhafid07, nierle, Salcornet, Juanpe76, theasters, meira, ijobain, trekstor, Saleroso, Jogre, OdomWebster, Lugasa64, vitorpereira1957, Mat95rix7, Tonytiger1, cokeaddict, Ambain, helrique@hotmaildotcom, Onubense79, Angelofhell91, zy4vtvwx2, Carlos1995, serbalabari, shankyto, humbertones, josdef, diegogb90, SINIESTRO.TOTAL, jiji52, fenoallain, lopezmer3, Javier Jurado, Oskcarcas, Lambretta, etorom, Antonio Gandullo, oscarfp, paquito2222, Quereda, riccco, jmbm, aaron_012, cuentamymars, aljs137, agarrigues5

The match criteria here is this:
IP address used for the password change is 3.253.53.146
A password change was made after the account was disabled Mon Apr 15, 2024 4:13 pm

There are likely more form this same Mon Apr 15, 2024 4:13 pm disable action.
I have found no other password changes form IP 3.253.53.146 made to a disabled account that were not disabled on Mon Apr 15, 2024 4:13 pm disable action.
These accounts, OdomWebster, Onubense79, vitorpereira1957, say "Account deactivated by administrator".

I tested with my non moderator account and yes if the account is disabled no forgot password email is sent.

.

OdomWebster3.253.53.146Wed May 29, 2024 8:22 amChanged user password
» OdomWebster
OdomWebster3.253.53.146Wed May 29, 2024 8:21 amChanged user password
» OdomWebster
Onubense793.253.53.146Wed Jul 17, 2024 4:09 amChanged user password
» Onubense79
Onubense793.253.53.146Sun Jul 14, 2024 5:15 amChanged user password
» Onubense79
Onubense793.253.53.146Sun Jul 14, 2024 5:15 amChanged user password
» Onubense79
vitorpereira19573.253.53.146Tue Aug 27, 2024 5:40 amChanged user password
» vitorpereira1957
vitorpereira19573.253.53.146Wed Aug 21, 2024 8:02 amChanged user password
» vitorpereira1957
vitorpereira19573.253.53.146Wed Aug 21, 2024 8:02 amChanged user password
» vitorpereira1957
vitorpereira19573.253.53.146Wed Aug 21, 2024 8:01 amChanged user password
» vitorpereira1957
vitorpereira19573.253.53.146Wed Aug 21, 2024 8:00 amChanged user password
» vitorpereira1957
vitorpereira19573.253.53.146Mon Aug 19, 2024 2:43 amChanged user password
» vitorpereira1957
vitorpereira19573.253.53.146Sat Jul 27, 2024 3:47 amChanged user password
» vitorpereira1957
vitorpereira19573.253.53.146Sat Jul 27, 2024 3:46 amChanged user password
» vitorpereira1957
vitorpereira19573.253.53.146Sat Jul 27, 2024 3:45 amChanged user password
» vitorpereira1957
vitorpereira19573.253.53.146Sat Jul 27, 2024 3:43 amChanged user password
» vitorpereira1957

I note also here how often a password is logged as changed by this IP 3.253.53.146.
Up to 3 times a minute and 15 times at once.

jiji523.253.53.146Mon Dec 04, 2023 6:24 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 6:47 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 6:48 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 6:49 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 6:49 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 6:49 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 6:51 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 6:51 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 6:52 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 6:52 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 6:52 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 7:07 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 7:07 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 7:12 amChanged user password
» jiji52
jiji523.253.53.146Mon Dec 04, 2023 7:12 amChanged user password
» jiji52

I again suggest board administrators should look for password change activity on their boards.
Sort by IP and look through for a large amount from one IP address.

Owen

Statistics: Posted by Feralkiwi2 — Wed Sep 11, 2024 1:42 am

---