Need help from experienced hacker or webmaster

[Mystery_Jock]

OK guys, I need help from all you hackers and experienced pros out there. We manage several affilaite programs. Tonight, one of them is getting some kind of bot, signing up affiliates left right and center. In the past hour we had over 300 sign ups...all using different legit e-mail addresses of legit webmasters, and all going to various address on main street in New Jersey.

1) anyone know what is going on and how to stop it?

2) Other than malice, what could be the motive?
and experienced pros

[hojo]

Maybe put a check in the program to limit signups per IP address?

[JasonB]

I had the same problem once, but they were all for addresses in Brooklyn & NY. The accounts just sat there...never used.
Eventaully they just stopped.

[echo465]

Maybe they're legit.

Why don't you contact some of the affiliates and ask them?

[Mutt]

what affiliate programs do u manage? what is the URL to your mail list hosting service? what is co-reg?

URL's?

[WiredGuy]

So this may be a malicious attempt to take down your system but some of those users may be real webmasters. So why not just let the system register them, and you delete inactive webmasters after something like 3 months?

An alternative would be that a webmaster has to confirm via email their entry into your affiliate program. That would eliminate a lot of the problems.

WG

[ZoiNk]

My guess on this is the person is setting up accounts to prepare for spamming. Use different affiliate IDs ever X number of emails so if someone gets 20 accounts deleted at the sponsor, they still have 280 paying them.
ZoiNk

[fnet]

Originally posted by ZoiNk
My guess on this is the person is setting up accounts to prepare for spamming. Use different affiliate IDs ever X number of emails so if someone gets 20 accounts deleted at the sponsor, they still have 280 paying them.
ZoiNk

That's probably it. There's an outside chance that there is another reason for mass account creation.

The addresses may imply some kind of drop setup, but there may be a different explanation. It's doubtful, but with the information given this could something like a host setting up a per space advertising option.

Have you looked up any of the addresses?

[aflex]

what town in jersey?

[kevinale]

Why don't you implement something to make the person signing up enter a 5 digit random number displayed on an image.. Many of the mainstream sites (like Yahoo) now have this feature to prevent bots from creating a thousand email addys at any one time. They can't seem to read images.

I could implement something similar on your site if you want.. And could have it up in a day or two..

best,
kevin

kevinale )at( prontomail )dot( com

[Mystery_Jock]

Thanks for all the incredible info posted here. It really helps.

I think we will immediately implement some of the suggestions right away.


kevinale, I will speak to the owner of the company and have him contact you about setting that up if his webmaster is not up on that

The cities in Jersey looked like they were all made up Airedale, Burman, Juno and all the addresses had "Main" in them...Main Street, Main Road, Main Village. The only thing that was legit, were the e- mail addresses...all from legit websites, but I am sure none of them are related.

My guess after analyzing them is that it was malicious, but I am still not sure

The whole thing has now stopped, but it was horrible last night. LOL, I wish I could get 300 affiliates in a few hours.

Mutt, I will pm you the answers to your Q's. I do not want it to look like I posted this to promote anything at all..

[Mystery_Jock]

Mutt, Oops, looks like I can't PM you.

Feel free to e-mail me at ian @ list-city.com

[fnet]

Originally posted by Mystery_Jock
Thanks for all the incredible info posted here. It really helps.
The cities in Jersey looked like they were all made up Airedale, Burman, Juno and all the addresses had "Main" in them...Main Street, Main Road, Main Village. The only thing that was legit, were the e- mail addresses...all from legit websites, but I am sure none of them are related.

My guess after analyzing them is that it was malicious, but I am still not sure

The whole thing has now stopped, but it was horrible last night. LOL, I wish I could get 300 affiliates in a few hours.

do you have a paypal option? have you written to the webmasters of any of these sites?

[kevinale]

Originally posted by Mystery_Jock
kevinale, I will speak to the owner of the company and have him contact you about setting that up if his webmaster is not up on that

Well I'm here to help. Just shoot me an email if he wants it done.

best,
kevin

[Mystery_Jock]

Hey Kevin,

The e-mail and PM feature doesn;t seem to work. Please e-mail me at ian @ list-city.com

I would like to discuss that with you

fnet. No we do not have a paypal feature set up yet. So far it seems to be a challenge integrating it with our affilaite program. We intend on contacting all the e-mail addresses that were signed up.

I am amazed though that none of them complained to me this morning that they were signed up for an affiliate program against their knowledge and will. They all get confirmation letters, and usually if one webmaster is signed up by someone (trying to get a 2nd tier) by someone else, i would get an immediate e-mail. here we get over 300, and not one e-mail?

Makes me wonder if there is something more nefarious going on.