SeLvesTr - One popular nickname! But Who or What is SeLvesTr?



What is this character doing? Building up a database on Drupal sites and/or forums that don't require CAPTCHAs in order to create accounts?

Looks like the person has some kind of script that just creates user account on websites, probably just automatically filling out registration forms. ASP based forums, PHP-based forums (such as phpBB), Drupal Blogs, they've all been targetted. Therefore I would assume that the bot is not very selective, but is very persistent, and quite possibly automagically answers confirmation emails.

I could only wonder what their future intentions may be.

Looks like the Google Result for SeLvesTr (as of first posting) leads to about 13000 results, with them being almost entirely user accounts without a single post made, leading to further suspicion. I could only imagine how much this count will increase as more sites get indexed over the next few days. Of note, I did get my first attempt at comment spam around the same time as this user created an account (though that comment spam was made through a user without an account).

A non-related malicious user could even just search for "SeLvesTr" on their favourite search engine to find vulnerable sites.

Also interesting is how the user SeLvesTr has only been creating these accounts within the past few days (ie: May 9th and 10th, 2007). Just appending "May 2007" , "Yesterday" or "Today" to a search yields hundreds of results.

Another interesting fact is that the user appears to try to fill out some elements of forms, such as "interests" with gibberish (or so it seems).

Other times, the user has added a link to what appears to be their own linkfarm, but I've only found a few that had this.

The user used the email account rokki@tendos.info in my case.

The link that often appears, http://tendos.info/brazzers_map.html, leads to malware, and should NOT be visited. I have no idea at the moment what kind of malware is installed at the moment. I recall that the first time that I visited the site (being very careful while doing so, using knoppix and such), it pointed to a link farm, but later to the aforementioned malware .

To be completely honest, I thought this would all happen sooner after being first indexed by Google several weeks ago.

Who or What am I?

Who or What am I? Well, stay tuned for updates at http://selvestr.com for updates.

Thanks for the great review,

>^..^<

Well, I for one didn't see

Well, I for one didn't see this one coming :)

The Google cache of Selvestr.com is a bit more interesting at the moment than the current version.

Interestingly, Selvestr has been dropping on Google, now with just 123 000 hits . Not sure if it is due to paring of Google's index, or paring of the accounts. 

 But uhhhh, ya, keep us posted. 

Interesting Google statistics

Well, various Google Page Rank sites still list dan.matan.ca as being 0/10 (meaning they haven't calculated one for me yet, or they just plain don't like me), but interestingly, a search for "Selvestr" returns this very page as the first result. Kinda interesting, since there are now 373000 results for "Selvestr". I guess we can subtract one from that for this site to get 372999 bot results :)

One would imagine that at least some popular web forum's profile would outrank my (unknown) blog posting on the bot. Perhaps the inward links generated from such user profiles aren't particularly valuable afterall, and the backer of this bot should rework their strategy. Paid Blog reviews seem to be rather successful for some (though it seems this user isn't really trying to get page rank, but rather leading people to their malware ).

It tried to register on my

It tried to register on my forum with FRanKisHteiN as username and gaint@tendos.info.

NS servers (ns1.sega-server.info) registred with the tendos.info domain are full of fake informations like Jack Sparoy, Mark Everick, Marta Kington, Brad Hilton from Calvados, France, Paris for example...

The SeLvesTr Google Dance, now with Franchid and TedLauzon!

SeLvesTr is now up to 332 000.

Recently (as my site has become more indexed by google) I've made a few new friends, Franchid and TedLauzon. Both of whom have decided to not drop by again after making their accounts.

Franchid appears to have very few other indexed accounts, but TedLauzon returns neary 200 000 results.

I wonder, is this a bot war, or more of the same?

And the bot SeLvesTr now

And the bot SeLvesTr now returns 221000 results on google. Wowie. I could only imagine how much a bot like this could influence pagerank just by changing the user's web page on their profile.

I think most of the additional SeLvesTr results are from more and more sites getting indexed, rather than more accounts being made as the days go by. 

Throw some more chlorine in the pool, The SeLvesTr is growing

Well, "Selvestr" now returns nearly 40 000 results on Google, only about 19 hours after my last search. Pretty good, a tripling less than a day...

And still no return of Selvestr to my site according to user management.  

Post new comment

The content of this field is kept private and will not be shown publicly.
  • Allowed HTML tags: <a> <em> <strong> <cite> <p> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

More information about formatting options