Is this site in danager?

I have notice accounts being ban for being hacked? some of them are old.

Some loser was logging into accounts with credentials he claims were in a dark web breach, but the damage has been reverted by now. Change your password if it's shared with something else, just in case.

To clarify, the site itself wasn't compromised, just some user accounts who re-used passwords.

My account was one of those that were banned, but I guess it was the hacker, right? My password is exclusive to Danbooru.

EDIT: Ok, thank you.

Sessyoin_Kiara said:

My account was one of those that were banned, but I guess it was the hacker, right? My password is exclusive to Danbooru.

Yeah, a mod got compromised and the person banned a bunch of approvers. Some other mods cleaned up and unbanned and deleted the feedbacks on those to whom it applied.

Some schizo got banned and had a meltdown over it and in retaliation is trying to hijack accounts. There is no indication that Danbooru itself was hacked, only that they're using leaked username/password lists from other sites.

If you're concerned about your account security, I recommend that you:

• Change your password to a unique password not used on any other sites.
• Use a password manager such as Last Pass or Bitwarden to remember your passwords.
• Add an email address to your account so you can recover it if you forget your password.
• Check https://haveibeenpwned.com to see if you have been in any data breaches.

I'll update more when I have time.

evazion said:

Some schizo got banned and had a meltdown over it and in retaliation is trying to hijack accounts. There is no indication that Danbooru itself was hacked, only that they're using leaked username/password lists from other sites.

If you're concerned about your account security, I recommend that you:

• Change your password to a unique password not used on any other sites.
• Use a password manager such as Last Pass or Bitwarden to remember your passwords.
• Add an email address to your account so you can recover it if you forget your password.
• Check https://haveibeenpwned.com to see if you have been in any data breaches.

I'll update more when I have time.

Well that's good

The compromised mod's account also unbanned some (if not many) banned users, including user #810100's numerous sockpuppets, and that user returned to post from those accounts. (Some of which is still not banned as of this writing)

VR-Man said:

The compromised mod's account also unbanned some (if not many) banned users, including user #810100's numerous sockpuppets, and that user returned to post from those accounts. (Some of which is still not banned as of this writing)

Thanks for bringing this to our attention. The remaining illegitimately unbanned accounts should now once again be re-banned. Let me know if you notice anything else that should be reverted.

Looks like Saladofstones's (the mod's) account is back to normal. I hope the other active users with compromised accounts can get theirs back, too.

Is there anything important hijacker could've seen about the user profiles as a mod, other than e-mail addresses?

pronebone said:

Is there anything important hijacker could've seen about the user profiles as a mod, other than e-mail addresses?

IP addresses.

Mods can see the IP addresses and email addresses of other users. He did apparently collect a list of mod and admin IPs. I don't know if he collected more IPs than this. It's possible, but I suspect he didn't given that he was busy vandalizing the site from the time he gained access to a mod account up until he was banned.

Anju_the_Elegant_Kitsune said:

IP addresses.

Ah, that was Mod+ too, right, glad I'm using a VPN for a while now then.
Also they didn't bother to ban me so I'm probably safe anyway :p

No indication of malicious activity with my account but I changed my password just in case. I'm not a tech knowledgeable person, can he do anything with any IP addresses he may have collected?

Monki said:

No indication of malicious activity with my account but I changed my password just in case. I'm not a tech knowledgeable person, can he do anything with any IP addresses he may have collected?

Not a tech expert but they can trace your online activities and possibly change your router settings.

Mod-edit: Strike-through for false information.

darkimp72 said:

Not a tech expert but they can trace your online activities and possibly change your router settings.

If you don't know what you're talking about please do not respond. You will just cause confusion and fear. Every website you visit has your IP address, it would be an absolute nightmare if that were the case. Worst case they can find out the approximate area you live and potentially try to DoS you, but it's unlikely.