What is this character doing? Building up a database on Drupal sites and/or forums that don't require CAPTCHAs in order to create accounts?

Looks like the person has some kind of script that just creates user account on websites, probably just automatically filling out registration forms. ASP based forums, PHP-based forums (such as phpBB), Drupal Blogs, they've all been targetted. Therefore I would assume that the bot is not very selective, but is very persistent, and quite possibly automagically answers confirmation emails.

I could only wonder what their future intentions may be.

Looks like the Google Result for SeLvesTr (as of first posting) leads to about 13000 results, with them being almost entirely user accounts without a single post made, leading to further suspicion. I could only imagine how much this count will increase as more sites get indexed over the next few days. Of note, I did get my first attempt at comment spam around the same time as this user created an account (though that comment spam was made through a user without an account).

A non-related malicious user could even just search for "SeLvesTr" on their favourite search engine to find vulnerable sites.

Also interesting is how the user SeLvesTr has only been creating these accounts within the past few days (ie: May 9th and 10th, 2007). Just appending "May 2007" , "Yesterday" or "Today" to a search yields hundreds of results.

Another interesting fact is that the user appears to try to fill out some elements of forms, such as "interests" with gibberish (or so it seems).

Other times, the user has added a link to what appears to be their own linkfarm, but I've only found a few that had this.

The user used the email account [email protected] in my case.

The link that often appears, http://tendos.info/brazzers_map.html, leads to malware, and should NOT be visited. I have no idea at the moment what kind of malware is installed at the moment. I recall that the first time that I visited the site (being very careful while doing so, using knoppix and such), it pointed to a link farm, but later to the aforementioned malware .

To be completely honest, I thought this would all happen sooner after being first indexed by Google several weeks ago.