Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am running a number of web sites. They are all Drupal based, if that is relevant. Recently I have noticed something odd. All my sites have a user registered with the name "zctonglin". I presume that user is a spammer because of some initial behavior typical of a spammer. Based on that, this user has been blocked on all my sites for a few weeks. The odd thing is that multiple times every day I still get some attempts to log in as "zctonglin". These attempts originate from a variety of different ip's, making them unlikely to originate from a single computer or network. They could originate from controlled machines, of course.

The email addresses (required for a two-step registration on my sites) used for registration are obviously disposable ones.

Doing a bit of research on the net. I noticed a lot of spam by zctonglin on many, many, sites. Google returns over 300,000 hits for zctonglin, but as most of these are users on a variety of web sites, it is not a very useful search, although within those results there may be something more relevant to my investigation. I have not found it yet. "zctonglin" being an unusual name I think it is more than mere coincidence. I am wondering if there is an automated exploit software that has zctonglin set as a default user. That would explain things to my satisfaction. If not, then the very large number of zctonglin traces on the internet make me wonder whether there is something more sinister at play here.

I could setup a dummy site, wait for zctonglin to register (which I guess s/he will, specially if I link from an existing site), or allow him/her to re register on a current target site (I am very reluctant to do this for the obvious security implication) and see what exactly s/he is doing but I doubt I would learn more that the Google search on zctonglin gives me. So, II would rather get an explanation from a security ace! :)

Has anyone got any clue about this phenomenon, anything to add, or a suggestion about what to do next? None of the sites I manage have been compromised in anyway yet, afaik. At least I cannot find any evidence of it, but I am not happy to let things rest when I don't understand them.

Thanks for any help

Edit for additional info:

One of the site is a site has very little traffic except for spammers (which get moderated out and are not an issue except for the bandwidth and CPU). It is very new (10 weeks live) and has very little substantial content. It literally only gets none, one or two legit visits a day, yet zctonglin attempts his/her login about 10 times per day on that site and has done so for about 6 weeks (from very different ip's each time).

So, if it is a single individual, he probably uses compromised machines all over the place.

My concern would be more a scenario where the user zctonglin acts as a backdoor for many hackers.

I guess, if I really want to get to the bottom of this, I will have to setup a honeypot which is something I wanted to avoid on account of the work involved.

share|improve this question
1  
If it helps, my (very brief) research shows that it's related to pharma spam, mainly for cheap Chinese antibiotics. A few of his links point to ibuyamoxil.com. –  Polynomial Apr 26 '13 at 13:25
    
you should really redact that username, like the answer says... –  Joseph Szymborski Jun 19 '13 at 18:51
add comment

1 Answer

up vote 2 down vote accepted

There are are two possible explanations that are very likely:

  1. It might just be a very simple botnet client that uses a hardcoded string as username. There is a number of press reports saying that botnets owner offer there services to third parties. So while creating a botnet requires a lot of knowledge, the person using the botnet might not have much experience.

  2. Someone might try to discredit a person with that name.

PS: Please do not post personal details about people using that username as nickname as it is quite unlikely, that they are responsible.

share|improve this answer
    
Thanks for your reply. I had not thought about the renting of botnets. I am still a bit concerned about the constancy of the use of zctonglin. A reseller of botnet would have a bit more experience I thought, although renters may be inexperienced enough and use the default (set as zctonglin by the owner). Regarding users using that name. I think the name is unusual enough that it is unlikely to be used by many, if any, others. Thanks again. –  MidGe Apr 28 '13 at 9:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.