Hacked forum accounts and spammers editing posts to add spam links

[Yatsushiro]

I loved your video! Thanks for sharing a piece of your city with us. I have a travel vlog, too, and I know just how much effort there is behind a video like this.

Moderator note - split off from viewtopic.php?t=142044 and moved to Using the Forum. As detailed in the posts below, this particular post was made by a spammer who had hacked a dormant account and planned later to edit the post and add a spam link.

[DevonDamo]

I loved your video! Thanks for sharing a piece of your city with us. I have a travel vlog, too, and I know just how much effort there is behind a video like this.

[Edit: my post from yesterday below now makes no sense because, since I posted it, a moderator has quietly deleted all the posts made by the 'Yatsushiro' account over the past year. All of these posts had been edited 3 days after posting to include spam links, which may well have been malicious. Oddly, the moderator has deemed the post above to be worthy of preserving, despite it obviously not being a genuine comment - just any old banal text which the hacker can later edit to include a spam/malicious link.

If you see any odd posts, e.g. replies to long-dead threads which basically add nothing, then check that poster's history before jumping back into the debate. Continuing the original discussion will just help the hacker out, i.e. if the long dead thread comes back to life, their dodgy post will no longer stick out like a sore thumb. If it looks suspicious, flag it up whichever way you think is best.]

If you take a look at Yatsuhiro's post history, you'll notice something odd.

The account was obviously hacked around September last year, from which time onwards the account has been making vanilla posts, like the above, on dormant threads. There is then a 3 day pause, before the hacker tiptoes back and adds a spam link to the post.

[mattheus]

I think you're right, Damo.

I've reported the post.

[Vorpal]

[Edit: my post from yesterday below now makes no sense because, since I posted it, a moderator has quietly deleted all the posts made by the 'Yatsushiro' account over the past year. All of these posts had been edited 3 days after posting to include spam links, which may well have been malicious. Oddly, the moderator has deemed the post above to be worthy of preserving, despite it obviously not being a genuine comment - just any old banal text which the hacker can later edit to include a spam/malicious link.

...

If you take a look at Yatsuhiro's post history, you'll notice something odd.

The account was obviously hacked around September last year, from which time onwards the account has been making vanilla posts, like the above, on dormant threads. There is then a 3 day pause, before the hacker tiptoes back and adds a spam link to the post.

The post under discussion was not considered 'worthy of preserving', other than for the sake of this discussion.

What has happened is that
1) Yatsushiro's posts with spammy links have been moved to a moderator area
2) the user account was deactivated, along with another that the same hacker/spammer was likely using
3) I posted viewtopic.php?t=160154

slowster did 1 & 2 a few days ago.

If you see any odd posts, e.g. replies to long-dead threads which basically add nothing, then check that poster's history before jumping back into the debate. Continuing the original discussion will just help the hacker out, i.e. if the long dead thread comes back to life, their dodgy post will no longer stick out like a sore thumb. If it looks suspicious, flag it up whichever way you think is best.

Please report them using the '!' button.