Caught a known spammer using stolen accounts for 3 months

Last month I started noticing weird posts from long time members who usually just lurk. Nothing obvious at first, just links to sketchy download sites. I ran the IPs through our backend tool and every single one traced back to the same VPN exit node in Poland. Dug into the join dates and realized this guy had been quietly stealing inactive accounts since December. He grabbed about 15 accounts that had no posts in over 2 years. I spent a weekend cross checking login timestamps and IP histories. Finally banned all his stolen accounts and locked down password resets with email verification. Has anyone else dealt with account theft like this and found a good way to catch it early?

2 comments

Log in to join the discussion

Log In

2 Comments

quinn5823mo ago

Known spammer" sounds like you just don't like someone who posts different stuff than you.

6

miab163mo ago

Wait, wait wait, are you saying @quinn582 that this person just "posts different stuff"? Because stealing inactive accounts and using them to push malware links is a whole different level of thing. I've been on forums for over a decade and when you see a lurker account suddenly start spamming download links, that's a massive red flag, not a difference in opinion. The fact that he spent months grabbing accounts with zero activity is super calculated, that's not just someone who likes different content. Your mileage may vary but I'd be shocked if anyone who's been around forum drama for a while would mistake that for normal behavior.

2