| T O P I C R E V I E W |
| TastyNutz |
Posted - 19 May 2012 : 17:42:42
This concerns my Serverhacker (SHN Forums) and I wasn't sure of the appropriate place to to post.
At one point today my site wouldn't load properly and I couldn't login. It basically looked like an HTML page with a missing style sheet.
I had to recycle the application pool and then the site was fine.
But I then found a spammer somehow managed to post several new topics and a reply under an existing username without leaving any other traces of having been there. The username hasn't been used in years (last visit 2007) and doesn't show as a recent visitor. The user IP address also doesn't appear to have changed from the last visit in 07.
I rarely get spam and it's usually a manually registered account. So, even though this is just a minor irritant, I'm intrigued as to how it was done.
My forensic skills are limited so any suggestions on where to look would be appreciated. |
| 3 L A T E S T R E P L I E S (Newest First) |
| TastyNutz |
Posted - 19 May 2012 : 22:50:52
Thanks again! |
| ruirib |
Posted - 19 May 2012 : 18:36:47
Actually, no forensic skills are needed. Your situation, resulting from app variables being lost, is known and there are fixes :
http://forum.snitz.com/forum/topic.asp?TOPIC_ID=67497&whichpage=2 |
| TastyNutz |
Posted - 19 May 2012 : 18:12:45
Correction... The Last IP in the Members table didn't change, but T_IP in the topics table did. At least now I have an IP and can block it. |
