Skip to content

Hmmm. Here’s more about my odd spike in user registrations.

I have more data! Here are the top-level email domains used by people (?) registering on my blog recently:

Before December 28, everything was normal. It was mostly .com addresses with a smattering of oddball TLDs.

Starting at precisely 11:30 am on December 28, that changed. Normal sites now make up only a quarter of registrations. The rest are .top, .site, and a few other oddballs.

According to Wikipedia, .top domains "are often used for malware and phishing, and is included in the list of banned TLDs for some antimalware venders (i.e. Malwarebytes)."

Wikipedia doesn't mention anything noteworthy about the current reputation of .site other than the fact that it's owned by a company that's owned by a serial entrepreneur billionaire. However, every single .site address is of the form

name12345@lhfye.site

The numbers are random and there are five domains being used: lhfye, injis, nniks, scekd, and wgwpyi.

So this is obviously being done by bots or something similar. But why? And is there anything I can do about it?

21 thoughts on “Hmmm. Here’s more about my odd spike in user registrations.

  1. Blaine Osepchuk

    Have the suspicious accounts commented on of your posts?

    My guess is that the registrations are illegitimate (not humans who want to reply to your posts). Ban and/or block similar registrations in the future if you can.

  2. rick_jones

    And is there anything I can [do] about it?

    Ostensibly, WordPress support should have guidelines and procedures/options available to you. Recaptcha perhaps?

  3. Citizen Lehew

    Yep, the vultures have found you. Time to upgrade your comment system or be ready for a second full time job.

  4. D_Ohrk_E1

    Check your old posts for comments. W/O some sort of mitigation, your old posts will be easily targeted w/ comments including spammy links.

  5. Jimm

    Just hit up WordPress for a filter to disallow comments from any such strange domain (regular folks don't register with those), they may or may not have it and I'd wait and see if any comments come through from them anyway (so would be cool to be able to query comments by domain registration), but this could definitely be used as a denial-of-service attack on your comments whenever they like.

  6. pjcamp1905

    You're probably safe disallowing registrations from all but the original 5 TLDs. How you'd do that, I don't know. I only have a WordPress registration for purposes of this site.

  7. Vog46

    Let me be the first Kevin!!!!

    "Working just a few hours on the computer I intaked $7,980 my first week. With this opportunity I bought a Bughatti Veyron. For just a few hours work you can too. Just go to this website and sit back and watch the money roll in.
    ******* JbgYut.com and make account
    (don't type the *******)

    ***************************************************************************************

    How'd I do?

  8. Larry Jones

    Presumably these new registered "users" can begin at any time flooding your blog with comments. There are various reasons to do this, from malicious to commercial. But the registrations are certainly bots, and as such can be easily defeated. Here's a link to a guide on how to stop spam registrations.
    Before the junk comments begin, you might want to install Akismet, a very effective detector and blocker of spam comments.

Comments are closed.