[Operators] Strange registrations

Florian Jensen admin at flosoft.biz
Mon Aug 11 15:23:56 CDT 2008


Hi,

right, I also checked the passwords. They are completely random.
It's strange that an non public server gets attacked too.

Greets,

Florian Jensen

On Mon, 11 Aug 2008 21:01:16 +0100, "Matthew Wild" <mwild1 at gmail.com>
wrote:
> On Mon, Aug 11, 2008 at 8:49 PM, Florian Jensen <admin at flosoft.biz>
wrote:
>> Hi everyone,
>>
>> I noticed some weird registrations today.
>>
>> [20:16:30] <im.flosoft.biz> The user 'tydavbzh at im.flosoft.biz' was just
>> created on node ejabberd at localhost.
>> [20:49:09] <im.flosoft.biz> The user 'odedh at im.flosoft.biz' was just
>> created on node ejabberd at localhost.
>> [21:07:18] <im.flosoft.biz> The user 'k6jabex at im.flosoft.biz' was just
>> created on node ejabberd at localhost.
>> [21:23:08] <im.flosoft.biz> The user 'kasper90 at im.flosoft.biz' was just
>> created on node ejabberd at localhost.
>> [21:44:24] <im.flosoft.biz> The user '3oyifixts4h at im.flosoft.biz' was
> just
>> created on node ejabberd at localhost.
>>
>> Has anyone seen similar? Any idea what the source of it is? Another hack
>> attack (spam bots)?
> 
> Mmm, re-posting to the right list... :)
> 
> I've had a couple of registrations on my (private) server also.
> Private in so much as, it's not listed on any list of public servers.
> They must be harvesting from somewhere.
> 
> The registrations on my server matched the same pattern, and when I
> checked (unlike last time) they have a random password also. I
> disabled IBR last night.
> 
> I believe I still have the IPs, I'll dig them up.
> 
> Matthew
-- 
Flosoft.biz / CEK Media Service
CEK Media Service
Seestr. 8
73773 Aichwald
Germany


More information about the Operators mailing list