qwertySMF

[Phil Serna]

What is this? It just joined my site and I was curious to see what else came up with "qwertySMF" in google.. Looks like it joined a few sites just within the last day, but no posts.

[ccbtimewiz]

Appears to be some person pretending to be having fun. Or maybe just a bot. Does it matter?

This isn't much of a support question.. unless you're worried this person/bot is some type of hacker?

[Phil Serna]

Appears to be some person pretending to be having fun. Or maybe just a bot. Does it matter?

This isn't much of a support question.. unless you're worried this person/bot is some type of hacker?

I'm not sure what to think thats why I'm asking

[ccbtimewiz]

It's just some person. Simply ban this person from your website if you're worried about the condition of your site.

[Phil Serna]

Yeah, I think that would make me feel more comfortable. Thanks

[netcms]

Well,

Here's your answer: hxxp:www.stopforumspam.com/search?q=qwertySMF [nonactive]
I think it's a prepartion for mass spam since he joined quite a few forums.
Ban him an keep a close look for who's joining.

Cheers,
netcms

[vypergt]

Yeah he joined my other forum. Odd

[evolver]

Mine to (hxxp:www.bassq.com [nonactive]).

The strangest thing is that I normally get an e-mail when new members sign up. But when "qwertySMF" joined my forum i did not get an e-mail.

Strange...

[StarWars Fan]

Here's the info with email ommited:

Name:    qwertySMF
Posts:    0 (N/A per day)
IP:    89.76.10.138 
Date Registered:    Yesterday at 03:35:26 PM

[juanidn2]

In my forum he registedred Today at 2 AM.

IP:      89.76.10.138
Server name: hxxp:chello089076010138.chello.pl [nonactive]
Mail:      [email protected]

¿Should I ban him?

Whois:

remarks:        Any abuse activities including, but not limited to spamming,
remarks:        hacking and intrusion attempts coming from hxxp:chello.pl [nonactive] address
remarks:        space shall be reported ONLY to:
remarks:
remarks:        [email protected]

[Phil Serna]

ban him. take no chance

[Dazed]

One of our secondary site had this show. Glad I started searching. Seems just a tad strange as this is a family site without much exposure...

Code Select Expand

Name:  qwertySMF
Posts: 0 (N/A per day)
Position: Newbie
IP: 89.76.10.138
Hostname:
chello089076010138.chello.pl
Date Registered: Today at 12:49:10 AM
Last Active: Never
ICQ:
AIM:
MSN:
YIM:
Email: [email protected]

[vypergt]

i deleted that account.

[Lancer873]

He joined my site as well hxxp:sonyloyal.uni.cc [nonactive]
He seems to have a valid e-mail address though, although the e-mail site is in another language... Idk whether or not I should ban him, I think I'll give him a chance, but I'll keep my eye on him... Did he get into any PHP forums? Or did he only log into SMF?

[olabaz]

I want him to join mine, I could use members

[EdwinK]

You can post your forum on some mailinglists and it will be filled soon. Make sure you make it so that members can join directly

[Phil Serna]

He joined my site as well http://sonyloyal.uni.cc
He seems to have a valid e-mail address though, although the e-mail site is in another language... Idk whether or not I should ban him, I think I'll give him a chance, but I'll keep my eye on him... Did he get into any PHP forums? Or did he only log into SMF?

I think he was on themixingbowl

[netcms]

Well maybe someone found a nice SQL injection and mass applied it.
Let's hope not since maybe the next step is making himself admin/moderator and doing funny things.
Out of curiosity what's your time stamp of registration: (select memberName, dateRegistered from TABLE_NAME where memeberName='qwertySMF' 1218395516 (2008-08-10 22:11.56)
To display it in a readable format try this:
----
<?php
$dateRegistered='1218395516';
$registerDate = date("Y-m-d G:i.s", $dateRegistered);
echo "registered: " . $registerDate;
?>
----
Now for some nice logs:
89.76.10.138 - - [10/Aug/2008:22:11:52 +0300] "GET /forum/index.php?action=register HTTP/1.0" 200 18442 "http://[CENSORED]/forum/index.php?action=register" "Mozilla/5.0 (Windows; U; Windows NT 5.1; PL; rv:1.7.13) Gecko/20060414"
89.76.10.138 - - [10/Aug/2008:22:11:54 +0300] "GET /forum/index.php?PHPSESSID=6nr1e5gaasgcog1aci5275ur90&action=verificationcode;rand=cbf70f1014db354119c1cc6726270f6c HTTP/1.0" 200 1403 "http://[CENSORED]/forum/index.php?action=register" "Mozilla/5.0 (Windows; U; Windows NT 5.1; PL; rv:1.7.13) Gecko/20060414"
89.76.10.138 - - [10/Aug/2008:22:11:56 +0300] "POST /forum/index.php?PHPSESSID=6nr1e5gaasgcog1aci5275ur90&action=register2 HTTP/1.0" 302 - "http://[CENSORED]/forum/index.php?action=register" "Mozilla/5.0 (Windows; U; Windows NT 5.1; PL; rv:1.7.13) Gecko/20060414"
89.76.10.138 - - [10/Aug/2008:22:11:58 +0300] "GET /forum/index.php?action=login2;sa=check;member=146 HTTP/1.0" 302 - "http://[CENSORED]/forum/index.php?action=register" "Mozilla/5.0 (Windows; U; Windows NT 5.1; PL; rv:1.7.13) Gecko/20060414"
89.76.10.138 - - [10/Aug/2008:22:11:59 +0300] "GET /forum/index.php HTTP/1.0" 200 64516 "http://[CENSORED]/forum/index.php?action=register" "Mozilla/5.0 (Windows; U; Windows NT 5.1; PL; rv:1.7.13) Gecko/20060414"

2 seconds to complete the registration? hmm...
Friendly advice: backup your forum just in case.0
Or maybe I'm overreacting...

[danskmacabre]

I got this user registering at one of my sites as well.
I banned him.

[ReVoKe]

wow hes in my site too