Originally Posted by gleem

NATS & non nats sponsors are getting their members stolen this time. From my tests they are just cracking SQL DB's logins. Definitely not just a NATS issue, although I'm not saying it's not part of it.

My theory based on tests and collecting info on this problem is there is a group that is cracking program owners DB's by any means, including php exploits, apache/sql/smarty exploits, and then straight up brute force cracking DB's and affiliate software admins if that fails. This has been going on for over a year. Once they gain access they are selling the lists to the same group of affiliates, one gets it exclusively for about a week or two, then it's sold to another affiliate who gets semi-exclusive spam access, then it's sold to several other spammers.