So here is a weird one ... the LWN site has been seeing a steady stream of login attempts, all using weird yahoo addresses as the username. By "weird" I mean things like lllbnwidgqeerdyi@yahoo.com and other equally unlikely strings.
These do not correspond to LWN accounts, but somebody has looked at our login form for long enough to post the login attempts directly, without loading the form first. The attempts come from all over the Internet, suggesting that some sort of botnet is doing this.
I don't suppose anybody else has seen this sort of pattern, or has any idea what it is that they may be trying to accomplish?
Jonathan Corbet
npub1gu…kcl6w
2024-12-04 18:28:32 UTC
Author Public Key
npub1guyhrdgjzw3fl4esdazyzf8dg0h2dg7hp043wqpw9egl0ds5ydnsckcl6wSeen on
wss://relay.momostr.pinkPublished at
2024-12-04 18:28:32 UTCEvent JSON
{
"id": "1658d11f372aa11f75e58bb7010397771bcc4b4f4adfefe84fa0b2dd21305bed",
"pubkey": "470971b51213a29fd7306f444124ed43eea6a3d70beb17002e2e51f7b6142367",
"created_at": 1733336912,
"kind": 1,
"tags": [
[
"proxy",
"https://social.kernel.org/objects/6bdea779-0908-46b3-a742-9b860192b687",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://social.kernel.org/objects/6bdea779-0908-46b3-a742-9b860192b687",
"pink.momostr"
],
[
"-"
]
],
"content": "So here is a weird one ... the LWN site has been seeing a steady stream of login attempts, all using weird yahoo addresses as the username. By \"weird\" I mean things like lllbnwidgqeerdyi@yahoo.com and other equally unlikely strings. \r\n\r\nThese do not correspond to LWN accounts, but somebody has looked at our login form for long enough to post the login attempts directly, without loading the form first. The attempts come from all over the Internet, suggesting that some sort of botnet is doing this.\r\n\r\nI don't suppose anybody else has seen this sort of pattern, or has any idea what it is that they may be trying to accomplish?",
"sig": "4242e99605423fc084da3fc2b1a34ce7d8c75279fadca896d2ab53010424d5c8a5839b8279e324d6df877712658dbaa50c0eac69e62cf1524f113ae10bc67252"
}