[Operators] Strange registrations

Matthew Wild mwild1 at gmail.com
Mon Aug 11 15:01:16 CDT 2008


On Mon, Aug 11, 2008 at 8:49 PM, Florian Jensen <admin at flosoft.biz> wrote:
> Hi everyone,
>
> I noticed some weird registrations today.
>
> [20:16:30] <im.flosoft.biz> The user 'tydavbzh at im.flosoft.biz' was just
> created on node ejabberd at localhost.
> [20:49:09] <im.flosoft.biz> The user 'odedh at im.flosoft.biz' was just
> created on node ejabberd at localhost.
> [21:07:18] <im.flosoft.biz> The user 'k6jabex at im.flosoft.biz' was just
> created on node ejabberd at localhost.
> [21:23:08] <im.flosoft.biz> The user 'kasper90 at im.flosoft.biz' was just
> created on node ejabberd at localhost.
> [21:44:24] <im.flosoft.biz> The user '3oyifixts4h at im.flosoft.biz' was just
> created on node ejabberd at localhost.
>
> Has anyone seen similar? Any idea what the source of it is? Another hack
> attack (spam bots)?

Mmm, re-posting to the right list... :)

I've had a couple of registrations on my (private) server also.
Private in so much as, it's not listed on any list of public servers.
They must be harvesting from somewhere.

The registrations on my server matched the same pattern, and when I
checked (unlike last time) they have a random password also. I
disabled IBR last night.

I believe I still have the IPs, I'll dig them up.

Matthew


More information about the Operators mailing list