The Scammer/Bot Situation is Escalating

[Tcoat]

Originally Posted by nissanfanatic

Yep, obviously a bot because I'm suggesting that the forum be updated to software that was released sometime less than seven years ago with who knows how many vulns, and giving you a possibility on how people's passwords are being stolen.

Exactly what a Bot would say!

[Ultramaroon]

Originally Posted by weederr33

Ok bot.

lol

[pope]

One of the forums I was on *check notes* almost 20 years ago combated spam/scam accounts through a variety of measures:

1. New account registrations required:

a. Completing a registration questionnaire
b. Waiting for a mod/admin to review the answers and approve account and issue temporary password

i. Mods verified IP matched users claimed region of residence
ii. Mods verified questionnaire answers were not duplicates
iii. Mods verified prospective new users were not connecting from the same IP as a previously banned account

c. Restricted new users to a new users section until they verified acknowledgment of the rules by following the instructions in the last rule to create an introduction post that told the forum about themself

2. All users accounts inactive for 90 days had permissions set to read only until contacting a mod and having permissions restored

3. Mod accounts were stripped of elevated permissions after 30 days of inactivity

4. Forum software was kept up to date

5. Ownership of forum, assets, administration accounts, etc. was turned over to parties interested in maintaining the site when current owners lost interest

[NoHaveMSG]

Originally Posted by pope

One of the forums I was on *check notes* almost 20 years ago combated spam/scam accounts through a variety of measures:

A forum I still check a couple times a year, and have been on for the last 15-20 years did it by asking you to answer a question on registration that you would only know the answer to if you had any actual interest in the subject. Something like "Who is the drift king?" Never saw a scammer or bot. Some hackers did get into it through an issue in the software and locked the admin out of the site unless they paid a ransom in bitcoin. They ended up just redoing the whole forum and losing tons of historical data

[Spuds]

I recall my roommate in college was blacklisted by Google for having a monetized website with too much obviously non-human traffic. Him personally, not just the website. Then again I really didn't care much about his side gig so maybe I don't know what I am talking about.

[Ultramaroon]

Originally Posted by pope

One of the forums I was on *check notes* almost 20 years ago combated spam/scam accounts through a variety of measures:

1. New account registrations required:

a. Completing a registration questionnaire
b. Waiting for a mod/admin to review the answers and approve account and issue temporary password

i. Mods verified IP matched users claimed region of residence
ii. Mods verified questionnaire answers were not duplicates
iii. Mods verified prospective new users were not connecting from the same IP as a previously banned account

c. Restricted new users to a new users section until they verified acknowledgment of the rules by following the instructions in the last rule to create an introduction post that told the forum about themself

2. All users accounts inactive for 90 days had permissions set to read only until contacting a mod and having permissions restored

3. Mod accounts were stripped of elevated permissions after 30 days of inactivity

4. Forum software was kept up to date

5. Ownership of forum, assets, administration accounts, etc. was turned over to parties interested in maintaining the site when current owners lost interest

[pope]

That’s the point

[Ultramaroon]

Originally Posted by pope

That’s the point

oh. oops.

[spike021]

Originally Posted by weederr33

How are they stealing people's profiles?

people reuse passwords, passwords get stolen in breaches, people don't update them everywhere, and these forums are hardly modern and admins are kinda out of touch, so theyre not gonna do a force password reset for affected people.

[spike021]

Originally Posted by pope

One of the forums I was on *check notes* almost 20 years ago combated spam/scam accounts through a variety of measures:

1. New account registrations required:

a. Completing a registration questionnaire
b. Waiting for a mod/admin to review the answers and approve account and issue temporary password

i. Mods verified IP matched users claimed region of residence
ii. Mods verified questionnaire answers were not duplicates
iii. Mods verified prospective new users were not connecting from the same IP as a previously banned account

c. Restricted new users to a new users section until they verified acknowledgment of the rules by following the instructions in the last rule to create an introduction post that told the forum about themself

2. All users accounts inactive for 90 days had permissions set to read only until contacting a mod and having permissions restored

3. Mod accounts were stripped of elevated permissions after 30 days of inactivity

4. Forum software was kept up to date

5. Ownership of forum, assets, administration accounts, etc. was turned over to parties interested in maintaining the site when current owners lost interest

[Ultramaroon]

Originally Posted by Spuds

I recall my roommate in college was blacklisted by Google for having a monetized website with too much obviously non-human traffic. Him personally, not just the website. Then again I really didn't care much about his side gig so maybe I don't know what I am talking about.

[Spuds]

Originally Posted by Ultramaroon

I apparently need to check my office for hidden cameras...

[Ultramaroon]

Originally Posted by Spuds

I apparently need to check my office for hidden cameras...

Nice tie

[Tcoat]

Originally Posted by spike021

people reuse passwords, passwords get stolen in breaches, people don't update them everywhere, and these forums are hardly modern and admins are kinda out of touch, so they're not gonna do a force password reset for affected people.

I know very little about how people get the login info but what I do know is there are far more here than I would ever expect from anybody getting lists someplace else or "guessing" passwords. There were another 16 today (not including 2 from yesterday still going today). There are an average of 14 a day, everyday, for the last month. That is more than I would ever believe that they guessed at or got from a common list.
They are all old accounts with no posts for over a year. If it was leaked lists it should be more random with active or recent users being involved but they just don't appear to be. My best guess is that as you said there was some sort of breach on this forum that has not been closed and the scammers (these are not bots) just gather up a few accounts each day. Hell, more than once I have watched some newly registered user scan the members list for an hour and then the old accounts start logging in one after the other and sending their PMs. I don't spend all day staring at activates either I probably spend a half an hour total just doing random looks. The patterns are so clear that it doesn't take much to predict who will do what.
I don't care about the spam bots just report and they go away but these scammers are what can kill a forum very quickly.