Registered users appearing out of nowhere

[michvhf]

In the last week we've had a number of users suddenly appear.  We've never gotten a registration nor have they ever been approved.  Just by looking at the usernames, NOONE would have ever approved them.  Yet they appear and start spamming.

The UIDs are all the latest, so they're not users that registered a long time ago, these are new but do not appear in the moderator logs.


The MyBB version is 1.8.14.  I looked over the release notes for 1.8.15 and saw nothing in there that would address this issue so I haven't upgraded. 

How is this happening?

Thanks!
Vince.

[effone]

You said much, but still not enough info, and what you have described is just scary.

- Have you checked admin and mod logs in ACP?
- For some times set your registration method to Admin Approve only and see if you can trap anything.
- There also was a plugin, probably 'Admin Email' or something that used to send an email to admin in a pre-defined address, no matter a user actually registers or an admin creates the account, if you can find you can try that.
- Temporarily disable other admins to access User & Groups section.
- Last, but not least, I STRONGLY suggest you to change your hosting panel's login credential as well as database username password and reconfigure MyBB config accordingly. I had experience about intruders hack in to cP and gained access to DB, done enough damage without even using MyBB interface ...

[michvhf]

Sorry for the delay in responding, holiday weekend has had me pretty busy.

I checked the logs, none of these users appear in any of the logs, including the server's logs, neither do their UIDs.

We have no moderators, only two admins. The other admin is the only one that approves users and he didn't approve them.

Not sure I understand where you're going with the Admin Email thing.

Passwords have been changed, there is no control panel. I run the servers, so anything that needs to be done I do manually.

[Bhikkhu Pesala]

I have had users appearing without activation since I started my forums.

My Admin password is long.

I don't get flooded with spam, but I do find that 99% of new members are spammers. When new users register I check the ISP and ban them at once if they look at all dodgy. However, about half of the spammers managed to bypass the registration system.

I only have 19 members, and several of those have never posted.