Hi, right, I also checked the passwords. They are completely random. It's strange that an non public server gets attacked too.
Greets, Florian Jensen On Mon, 11 Aug 2008 21:01:16 +0100, "Matthew Wild" <[EMAIL PROTECTED]> wrote: > On Mon, Aug 11, 2008 at 8:49 PM, Florian Jensen <[EMAIL PROTECTED]> wrote: >> Hi everyone, >> >> I noticed some weird registrations today. >> >> [20:16:30] <im.flosoft.biz> The user '[EMAIL PROTECTED]' was just >> created on node [EMAIL PROTECTED] >> [20:49:09] <im.flosoft.biz> The user '[EMAIL PROTECTED]' was just >> created on node [EMAIL PROTECTED] >> [21:07:18] <im.flosoft.biz> The user '[EMAIL PROTECTED]' was just >> created on node [EMAIL PROTECTED] >> [21:23:08] <im.flosoft.biz> The user '[EMAIL PROTECTED]' was just >> created on node [EMAIL PROTECTED] >> [21:44:24] <im.flosoft.biz> The user '[EMAIL PROTECTED]' was > just >> created on node [EMAIL PROTECTED] >> >> Has anyone seen similar? Any idea what the source of it is? Another hack >> attack (spam bots)? > > Mmm, re-posting to the right list... :) > > I've had a couple of registrations on my (private) server also. > Private in so much as, it's not listed on any list of public servers. > They must be harvesting from somewhere. > > The registrations on my server matched the same pattern, and when I > checked (unlike last time) they have a random password also. I > disabled IBR last night. > > I believe I still have the IPs, I'll dig them up. > > Matthew -- Flosoft.biz / CEK Media Service CEK Media Service Seestr. 8 73773 Aichwald Germany
