2017-03-27 - Mystery ‘Administrative User’?

Header Data

From: Glyn <bo***1@gmail.com>
Message Hash: 73cb4242f1db8d0b395a12dcf5656167f4fc3ced604fb1946416dbbf4e928f08
Message ID: <070853fa-8cac-4589-be61-671d5d9ff686@grasehotspot.org>
Reply To: N/A
UTC Datetime: 2017-03-27 02:18:13 UTC
Raw Date: Mon, 27 Mar 2017 02:18:13 -0700

Raw message 



<https://lh3.googleusercontent.com/-hRNAsNQZEHA/WNjYwFjrXgI/AAAAAAAAAAM/bg0ihBAZtTIaMqeIF0xJk2cdT_bb0XgUwCLcB/s1600/rb-au1.jpg>

<https://lh3.googleusercontent.com/-hRNAsNQZEHA/WNjYwFjrXgI/AAAAAAAAAAM/bg0ihBAZtTIaMqeIF0xJk2cdT_bb0XgUwCLcB/s1600/rb-au1.jpg>
Hi all
My hotspot has been running well for about 4 months now. It is confiugred 
for Free Access only with a daily limit of 500Mb and 4 hours per day. There 
is also one computer account for my phone.
Over the last couple of days there is a mysterious 'Administrative-User' 
account showing up in monitor sessions. It is using huge amounts of data 
and is remaining logged in for days. When I first spotted it I was able to 
track down the MAC address and then in the user list block and disable, but 
it seems to have come back now with a MAC address of all zeros. In the 
attached image is the current monitor sessions screenshot - the business 
has only just opened, but you can see the od account has been on since last 
night after i did a reboot to kick them off. When I was at the bar last 
evening the wifi was very slow and even my unlimited phone access could 
barely use the system.

any ideas??

Thread