nobodyXXX@domainname users are created

  • Hi all,

    Wordpress + woocommerce (both regularly updated at last version) was running since months without issues.
    Yesterday, I change the domain name and updated all the necessary datas everywhere, based on different tutorials.
    Everything was ok.
    But maybe the issue is not related to the domain change, I don’t know.

    Today, I see 5 new users, all with the same name structure
    username : userxxx
    user email : nobodyxxx@mynewdomainname

    I found this topic, it looks that this is the same issue. But I don’t user
    https://www.ads-software.com/support/topic/email-nobodydomain-com-registering/

    In my case, the answer to the question if the register form is activated is NO

    Any idea ? thanks in advance

Viewing 4 replies - 1 through 4 (of 4 total)
  • Moderator James Huff

    (@macmanx)

    If you’re not currently allowing registrations, but new users are being created anyway, carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures and start backing up your site.

    Thread Starter therealyoda

    (@therealyoda)

    Registrations are open (but with a “shadowed link” using Rename wp-login.php plugin)
    so peolple needs to have this link to register. There is no visible link on the website to register.
    The register form is also specific and needs to fill additional information field. Content of these fields are tested and they cannot be filled by a random value.
    The new registered users needs to be manually validated and assign to a group.
    These users are automatically created in the right group.

    The website is available since a log time without issues. The suprise is that these users starts to appear just after the migration of the new domain name. and mass email address change (users mostly uses the same domain in their email address)

    That’s why I’m asking if these users could not be generated by maybe an automated process (in wordpress or woocommerce) requiring a user email. Based on the fact that the user email changed, the process creates a “user” to perform his process.

    iTheme security is running and well configurated (every day, people/IP are blocked)
    IP Blocker is running too
    The website backup runs on a daily basis.

    Thread Starter therealyoda

    (@therealyoda)

    I tried to compare the time stamp of the user creation and the server logs.

    Each time a user is created, the server ran a cron.
    Example

    XXX.XXX.XXX.XXX – – [26/Jan/2021:07:30:03 +0100] “POST /wp-cron.php?doing_wp_cron=1611642603.5580399036407470703125 HTTP/1.1” 200 – “https://www.mydomain/wp-cron.php?doing_wp_cron=1611642603.5580399036407470703125” “WordPress/5.6; https://www.mydomain”

    XXX.XXX.XXX.XXX – – [26/Jan/2021:22:20:27 +0100] “POST /wp-cron.php?doing_wp_cron=1611696027.0622069835662841796875 HTTP/1.1” 200 – “https://www.mydomain/wp-cron.php?doing_wp_cron=1611696027.0622069835662841796875” “WordPress/5.6; https://www.mydomain”

    where XXX.XXX.XXX.XXX is the server IP address

    Thread Starter therealyoda

    (@therealyoda)

    I found the origin of the problem : the Ultimate member plugin

    Probably after last update, my registration page was “removed” and now, when I tried to register, As soon as I clic on the registration button, I’m automatically registered with as User XXX with a “nobodyxxx@mydomain” email

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘nobodyXXX@domainname users are created’ is closed to new replies.