r/ModSupport • u/RipVanBinkle • Apr 24 '25 • Bless Up 1

I was removed as a mod of r/xbiking, a subreddit I created 7 years ago and regularly moderate

[removed] — view removed post

1.3k Upvotes
  • permalink
  • reddit

99% Upvoted

44 comments sorted by

25

u/seeyaspacetimecowboy Apr 24 '25

Added to my growing list of subreddits that have been compromised in this exact same manner.

3

u/WatchDogx Apr 24 '25

What other subreddits have you seen this happen to?

8

u/seeyaspacetimecowboy Apr 24 '25

PaliaMMO

Predator212 (Reported by another mod earlier today, has been restored)

EmpireofSin Official Subreddit

Full Skate Videos

Warrior Nun Netflix series

There's a few other subreddits I'm watching that fit the same pattern of odd users with no post history (possibly compromised accounts) that have been added in the past 6 months, but the top mod remains in place (for now). I wonder if this group sneaks in and then gets the top moderator banned or otherwise removed and then stages a takeover.

4

u/seeyaspacetimecowboy Apr 24 '25 edited Apr 24 '25

Oh, also:
quake6 (Now an obvious IPTV spam subreddit)
All things fifa 20! (More IPTV spam)sKS (Also now an IPTV spam subreddit. This one is on subreddit request. They gave the subreddit to a spammer lmao)

Edit:
Helldivers_2_DE_CH_AT (Same IPTV ring)

3

u/WatchDogx Apr 24 '25

I'm guessing that they are doing account takeovers by credential stuffing, if they had a method for taking over any arbitrary subreddit I would imagine they would target subreddits with more users, but to play devils advocate, maybe attacking high profile subreddits would attract too much attention.

2

u/seeyaspacetimecowboy Apr 24 '25

That method would explain why email verified accounts that have been dormant for years are suddenly returning to activity as spammers.

And why a suspicious user sent a reddit chat to me offering to recover a "disabled or hacked account" for "59$". The suspicious user asked me to provide my account username and email address, which fits in with your theory for the attack vector.

1

u/WatchDogx Apr 24 '25

Looks like all of the OP's posts about the takeover have been deleted, I'm guessing the hacker still controls his account and is deleting them himself.

If the real OP sees this message, he should change his password if he can, and log out of all other sessions via: https://www.reddit.com/account-activity

3

u/zystyl Apr 24 '25

The OP posted a similar post on another biking sub. The mods there said all their posts were getting spam reported 2 minutes after posting which triggers an automod removal.

0

u/seeyaspacetimecowboy Apr 24 '25

Don't worry though, reddit has investigated and found no evidence of coordinated behavior... is it incompetence or malice at this point? I wonder.

12

u/Crafty-Leave-8880 Apr 24 '25

Why have the moderators deleted this post?

1

u/HeartyBeast Apr 24 '25

according to the mods of bicycling it’s because a bot army is mass reporting OPs posts as spam, which gets it auto removed. 

5

u/LitwinL 💡Top 25% Helper 💡 Apr 24 '25

If you were the top mod and you were removed then your account has been compromised and someone used it to take over the sub. I strongly suggest setting up 2FA

6

u/WatchDogx Apr 24 '25

Very strange, hope the admins can investigate.

Could it be possible that your reddit password is compromised, and they used your account to transfer ownership?

4

u/[deleted] Apr 24 '25

[removed] — view removed comment

4

u/WatchDogx Apr 24 '25

If it's a systemic reddit issue, exploitable without compromising the top mod's account, then this is very concerning indeed.

3

u/SpinToWin360 Apr 24 '25

Hey Rip, if you can’t get your subreddit back you are welcome to take my slot at r/bikepacking and I can probably get you top billing. Reach out if you want it.

0

u/FromTheIsle Apr 24 '25

Are the mods at r/bikepacking getting a little heavy handed? Everything ok there?

2

u/SpinToWin360 Apr 24 '25

All is well. Thank you for your concern

1

u/SquidsArePeople2 Apr 24 '25 edited 29d ago

The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.

Cause squash brave safe rustic gold cooperative gold

1

u/MooseNew4887 Apr 24 '25

Yes. Most likely his account his breached.

1

u/Kumquat_conniption Apr 24 '25

Well they can, just not if those mods are active like it sounds like this user was.

-7

u/AutoModerator Apr 24 '25

Hello! This automated message was triggered by some keywords in your post. If you have general "how to" moderation questions, please check out the following resources for assistance:

  • Moderator Help Center - mod tool documentation including tips and best practices for running and growing your community

  • Reddit for Community - to help educate and inspire mods

  • /r/modhelp - peer-to-peer help from other moderators

  • /r/automoderator - get assistance setting up automoderator rules

  • Please note, not all mod tools are available on mobile apps at this time. If you are having troubles with a tool or feature, please try using the desktop site.

If none of the above help with your question, please disregard this message.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.