I am running a number of web sites. They are all Drupal based, if that is relevant. Recently I have noticed something odd. All my sites have a user registered with the name "zctonglin". I presume that user is a spammer because of some initial behavior typical of a spammer. Based on that, this user has been blocked on all my sites for a few weeks. The odd thing is that multiple times every day I still get some attempts to log in as "zctonglin". These attempts originate from a variety of different ip's, making them unlikely to originate from a single computer or network. They could originate from controlled machines, of course.
The email addresses (required for a two-step registration on my sites) used for registration are obviously disposable ones.
Doing a bit of research on the net. I noticed a lot of spam by zctonglin on many, many, sites. Google returns over 300,000 hits for zctonglin, but as most of these are users on a variety of web sites, it is not a very useful search, although within those results there may be something more relevant to my investigation. I have not found it yet. "zctonglin" being an unusual name I think it is more than mere coincidence. I am wondering if there is an automated exploit software that has zctonglin set as a default user. That would explain things to my satisfaction. If not, then the very large number of zctonglin traces on the internet make me wonder whether there is something more sinister at play here.
I could setup a dummy site, wait for zctonglin to register (which I guess s/he will, specially if I link from an existing site), or allow him/her to re register on a current target site (I am very reluctant to do this for the obvious security implication) and see what exactly s/he is doing but I doubt I would learn more that the Google search on zctonglin gives me. So, II would rather get an explanation from a security ace! :)
Has anyone got any clue about this phenomenon, anything to add, or a suggestion about what to do next? None of the sites I manage have been compromised in anyway yet, afaik. At least I cannot find any evidence of it, but I am not happy to let things rest when I don't understand them.
Thanks for any help
Edit for additional info:
One of the site is a site has very little traffic except for spammers (which get moderated out and are not an issue except for the bandwidth and CPU). It is very new (10 weeks live) and has very little substantial content. It literally only gets none, one or two legit visits a day, yet zctonglin attempts his/her login about 10 times per day on that site and has done so for about 6 weeks (from very different ip's each time).
So, if it is a single individual, he probably uses compromised machines all over the place.
My concern would be more a scenario where the user zctonglin acts as a backdoor for many hackers.
I guess, if I really want to get to the bottom of this, I will have to setup a honeypot which is something I wanted to avoid on account of the work involved.