[wp-forums] multiple account spammer

[Otto]

On Fri, Jul 19, 2013 at 7:25 AM, esmi at quirm dot net <esmi at quirm.net> wrote:
> on 19/07/2013 12:25 alchymyth said the following:
>
>> a user with the same IP 122.162.160.103 seems to be trying to spam the
>> forum;
>> http://wordpress.org/support/profile/anthonyamy
>> http://wordpress.org/support/profile/carterthomas
>> http://wordpress.org/support/profile/chrislarkin
>> I set the latter two to 'inactive' - and am going to keep an open eye on
>> what is happening with the user.
>
>
> I think I spotted posts from 1 or more these earlier. There could be a
> couple of other accounts from a different IP address too. They're all
> posting links to sites selling facebook likes and instagram stuff disguised
> within spoof support posts from what I could see.

It is definitely an automated spambot. All posts from there should be
deleted, all accounts found set to blocked.

Basically, it's taking posts from the forum, modifying them slightly,
and reposting them with links to other sites included. Examine this
one:

http://wordpress.org/support/topic/special-characters-appearing-in-admin-panel-and-on-website?replies=2&view=all

Note how the post by "Janebewes" is an exact copy of the one above it,
but with some of the wording changed in a worthless and automated
manner. "Sounds like" became "resembles". "language" became "dialect".
And so on. Language fuzzing, basically.

-Otto