|
Title: User creating massive amounts of referral spam - Marcy Post by: Quickseller on June 06, 2015, 07:33:53 PM Spammers Profile Link: https://bitcointalk.org/index.php?action=profile;u=350925
This person has made 30 posts (including some new threads) with his referral link today Upon closer inspection of the referral links he is posting the domain of the referral link matches his handle which makes be believe that he owns the site. A quick glance of the site he is advertising, makes me believe this is some kind of cloud mining ponzi scam site. edit: it appears he was trying to spread malware, and there have been other cases of this happening. The most recent example is Magic Of Nigeria edit: it appears the most recent example is now Marcy https://bitcointalk.org/index.php?action=profile;u=405552 Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: XinXan on June 06, 2015, 07:37:21 PM Yep its probably some cloud mining ponzi but he actually posted 2 different websites, its kind of weird that he decided to do this now, maybe his account was sold or hacked?
Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: hilariousandco on June 06, 2015, 07:57:07 PM His name is EmpoEX but the ref links he's spamming are for a cloud mining company. Likely a hacked account I think. Someone was doing the exact same earlier but for different site I think. Handled what ones I could anyway.
Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: DiamondCardz on June 06, 2015, 07:58:27 PM His name is EmpoEX bit the ref links he's spamming are for a cloud mining. Likely a hacked account I think. Someone was doing the exact same earlier but for different site I think. Handled what ones I could anyway. Yeah. I reported all the posts of the previous guy who seemed to be hacked, and this one (this one about an hour ago I think). There's a looot, I think I've reported at least 50 of these hacked account spambot posts in total now. It's crazy. Edit: Oh my God I love your personal text hilariousandco :D Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Quickseller on June 06, 2015, 08:00:46 PM His name is EmpoEX bit the ref links he's spamming are for a cloud mining. Likely a hacked account I think. Someone was doing the exact same earlier but for different site I think. Handled what ones I could anyway. Thanks. I swear I thought that I saw one of the domains he was advertising to match his forum handle. It looks like the referral number is always the same across different sites, so I think the various sites are all the same. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: DiamondCardz on June 06, 2015, 08:02:30 PM It looks like the referral number is always the same across different sites, so I think the various sites are all the same. Perhaps. Considering that I couldn't find any references on Google to the site this hacked account and the last one were advertising - though I did find one with the same domain but an .eu TLD, so perhaps this site tries to rip-off the trustworthiness of that - I have a feeling that there is no actual referring going on at all, and that this is indeed simply an attempt to scam people. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: TheButterZone on June 06, 2015, 08:03:38 PM Nuke from orbit just to be sure.
Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: hilariousandco on June 06, 2015, 09:26:11 PM Seems he's regained control of his account as he's edited all the posts:
Quote Apologies for anyone who clicked the link here. Please delete this thread. Nuke from orbit just to be sure. Only newbies can be nuked. Think this is why we need more active Globals though as well. Edit: Oh my God I love your personal text hilariousandco :D I laughed when I first saw it. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Quickseller on June 06, 2015, 09:28:20 PM Seems he's regained control of his account as he's edited all the posts: He probably saw the negative trust he got as well as this thread. It seems that his password was only changed once recently which would really not explain very much. Quote Apologies for anyone who clicked the link here. Please delete this thread. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: unamis76 on June 06, 2015, 10:01:35 PM It seems we have been having a big surge of spammers in the last few hours. I hope the mods have the time to take care of all that, it's big work sometimes... I'm helping anytime I can by reporting, keep it up, mods :)
Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Cyrus on June 06, 2015, 11:31:04 PM I hope the mods have the time to take care of all that, it's big work sometimes... I'm helping anytime I can by reporting, keep it up, mods :) We're on it. And appreciate the help. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Grand_Voyageur on June 07, 2015, 12:57:56 PM I hope the mods have the time to take care of all that, it's big work sometimes... I'm helping anytime I can by reporting, keep it up, mods :) We're on it. And appreciate the help. Just reported another possible alt - YourNewGod, uid: 412771 (https://bitcointalk.org/index.php?action=profile;u=412771) - of the said spammer. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: hilariousandco on June 07, 2015, 01:01:26 PM Yeah, handled the ones of his that I could. Just keep reporting them.
Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: shorena on June 07, 2015, 01:21:54 PM Aaand another one: https://bitcointalk.org/index.php?action=profile;u=412771
Probably hacked as well. I guess the weak passwords from the leak are broken now. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Twipple on June 07, 2015, 02:20:48 PM Aaand another one: https://bitcointalk.org/index.php?action=profile;u=412771 Probably hacked as well. I guess the weak passwords from the leak are broken now. I don't think its accounts hacked from the hack. It would be stupid to use the accounts for posting spam to a referral link as that would generate a much smaller profit than using it for other purposes. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: hilariousandco on June 07, 2015, 02:24:36 PM Yeah, probably the users just clicked a phishing link themselves or got a virus from somewhere else.
Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: EcuaMobi on June 07, 2015, 02:28:47 PM Yeah, probably the users just clicked a phishing link themselves or got a virus from somewhere else. I got this PM from EmpoEX: Hello, We have noticed that you have left us a negative trust rating for spamming referral links. Our account was hacked by a trojan horse virus that was spread around the last couple of days, resulting in spam being sent out. If you did not notice, we edited all posts to apologise for the inconveniences. They have now since been deleted. We're asking kindly if you can remove the negative trust from our account. Thank you very much #EmpoEX Team I linked him to this thread and asked him to provide more details. If what he says is true he should give as much information as possible to prevent this in the future. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Grand_Voyageur on June 07, 2015, 02:34:13 PM Yeah, probably the users just clicked a phishing link themselves or got a virus from somewhere else. I guess it was linked to the phishing attempts reported today by QS (https://bitcointalk.org/index.php?topic=1083278.0) & AT101ET (https://bitcointalk.org/index.php?topic=1083313.0). Maybe, You & other Staff have more solid proofs about the issues. Yeah, probably the users just clicked a phishing link themselves or got a virus from somewhere else. I got this PM from EmpoEX: Hello, We have noticed that you have left us a negative trust rating for spamming referral links. Our account was hacked by a trojan horse virus that was spread around the last couple of days, resulting in spam being sent out. If you did not notice, we edited all posts to apologise for the inconveniences. They have now since been deleted. We're asking kindly if you can remove the negative trust from our account. Thank you very much #EmpoEX Team I linked him to this thread and asked him to provide more details. If what he says is true he should give as much information as possible to prevent this in the future. +1. It would be great to learn some lessons from it & maybe we can also turn it in a distributed digital forensics effort. ;D Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: EmpoEX on June 07, 2015, 03:41:09 PM The link that was spammed by this account was spammed by others in the Altcoin ANN section. The thread which I saw was yesterday at about 2-3 PM here: https://bitcointalk.org/index.php?topic=1082561.msg11550385#msg11550385 (since deleted).
Here is a backup of the thread: https://i.imgur.com/DAL6Rpv.png Link was clicked and visited showing a site which downloads a miner exe. Upon double clicking it, nothing appeared to have happened. A few hours later, our accounts started getting logged into such as here, twitter and other sites. Security emails were received, and we tracked it to this IP: 37.123.112.27. After this, posts were made throughout every section on the forum with a referral link + a locked thread. We promptly went through and edited all posts to request them to be deleted. Not entirely sure how the passwords were leaked but it seems the trojan gained access to stored passwords in Google Chrome, as all passwords in use were 30+ chars long and not guessable or weak by any means. Upon closer inspection of the referral links he is posting the domain of the referral link matches his handle The link that was spammed contained an ID on the end of the URL specifically "?ref=271292" for a hashminer.net site, which does not in any way match our handle. https://i.imgur.com/WEMOjep.png Here is a backup of the thread which was posted by us into the Altcoin ANN section yesterday showing a totally different ref number, for cloudminer.biz domain: https://i.imgur.com/08Yuj5n.png Please refrain from unnecessary accusations. I would like to clarify that we do not own and are not associated with the site that was linked. You can check the history of our account, we are running a professional exchange. It would be greatly appreciated that anyone who has placed negative trust to edit their trust to restore our account to good standing. Hopefully this helps clear up the situation. #EmpoEX Team Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Muhammed Zakir on June 07, 2015, 04:10:10 PM Code: The link that was spammed by this account was spammed by others in the Altcoin ANN section. The thread which I saw was yesterday at about 2-3 PM here: https://bitcointalk.org/index.php?topic=1082561.msg11550385#msg11550385 (since deleted). Cloudminer.biz referral ID will be different from Bitcointalk UID. Edit: I think we need more Global Mods. YourNewGod (https://bitcointalk.org/index.php?action=profile;u=412771) excessively spamming. Hope these accounts will be banned soon. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Quickseller on June 07, 2015, 05:13:04 PM Upon closer inspection of the referral links he is posting the domain of the referral link matches his handle The link that was spammed contained an ID on the end of the URL specifically "?ref=271292" for a hashminer.net site, which does not in any way match our handle. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: DiamondCardz on June 07, 2015, 06:31:57 PM Can we just blacklist the hashminer (dot) net domain? It seems like that'd kill the spammers pretty quickly...well, at least until they create a new website. But otherwise it doesn't seem like this hacking is going to stop, as it seems like it'll exponentially grow (I am willing to bet >1 person gets hacked clicking the links each time a hacked account spams the board up).
Upon closer inspection of the referral links he is posting the domain of the referral link matches his handle The link that was spammed contained an ID on the end of the URL specifically "?ref=271292" for a hashminer.net site, which does not in any way match our handle. You are mistaken. I reported every single hacked post made by EmpoEX (and probably other people did too), and I never saw a domain for EmpoEX. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: dothebeats on June 07, 2015, 06:58:22 PM Hmm I've noticed some of the posts with that cloud mining referrals but I just ignored them (I'm not helping the mods in doing their job :(). I thought referral links aren't allowed for posting? Just a suggestion, I think auto-removing referral links should be implemented in this forum. Just a thought that popped out of my head.
Edit: I think we need more Global Mods. YourNewGod (https://bitcointalk.org/index.php?action=profile;u=412771) excessively spamming. Hope these accounts will be banned soon. Not necessarily needed for the mean time I think, as long as there are also other members of this forum helping the mods in their job by reporting posts like this. :) Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Muhammed Zakir on June 08, 2015, 11:10:37 AM Hmm I've noticed some of the posts with that cloud mining referrals but I just ignored them (I'm not helping the mods in doing their job :(). I thought referral links aren't allowed for posting? Just a suggestion, I think auto-removing referral links should be implemented in this forum. Just a thought that popped out of my head. Links for newbies are auto-removed but not for higher ranks. There are legit reasons for posting referral links but spams are way higher. So I guess this would work but I don't think forum will disable this. Users can also use shortened URL for posting referral link to bypass auto-remove. Edit: I think we need more Global Mods. YourNewGod (https://bitcointalk.org/index.php?action=profile;u=412771) excessively spamming. Hope these accounts will be banned soon. Not necessarily needed for the mean time I think, as long as there are also other members of this forum helping the mods in their job by reporting posts like this. :) Only 2 Global Moderators are active now. We definitely need a few more active Global Moderators. https://bitcointalk.org/index.php?action=mlist;sa=search P.S. Also see https://bitcointalk.org/index.php?topic=1071319.0;all. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Quickseller on June 09, 2015, 08:58:49 PM https://bitcointalk.org/index.php?action=profile;u=409703
It looks like someone else is making similarly spammy posts. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: master-P on June 09, 2015, 09:13:11 PM Another one just started: https://bitcointalk.org/index.php?action=profile;u=508320
Left negative trust for both of these users as the site looks extremely dodgy, even for a cloud mining site/ponzi. These accounts are likely to be compromised if not owned by the owner of the site who's trying to promote this scam. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: alani123 on June 09, 2015, 09:36:52 PM Quite apparently, this is done extensively recently. Higher ranked accounts have low limits for posting, easy to abuse them while it's not that hard to acquire an account with a high rank. I'm not sure if this is proving worthy for whatever they're trying to achieve. The forum could probably use some defense against accounts that are bought with the sole purpose of spamming.
Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Quickseller on June 19, 2015, 05:57:25 PM There is another one that is apparently just getting started (less then 20 so far).
--> https://bitcointalk.org/index.php?action=profile;u=220238 Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: hilariousandco on June 19, 2015, 06:11:48 PM Just report them and they'll get handled asap. I handled the ones I could.
Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: EcuaMobi on June 23, 2015, 07:00:53 PM There's a new one promoting a slightly different domain (ghsminer[dot]com/?ref=xxxx), obviously by the same owner/hacker:
dazza12 (https://bitcointalk.org/index.php?action=profile;u=217100) | Last posts (https://bitcointalk.org/index.php?action=profile;u=217100;sa=showPosts) Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: hilariousandco on June 23, 2015, 07:16:44 PM Just report them and they'll get handled asap. I handled the ones I could. Ditto. Don't know why the hacker bothers wasting the accounts like this though. They get noticed immediately and it's blatantly obvious ref spam so next to no one will click on it anyway. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Quickseller on June 23, 2015, 07:23:26 PM Just report them and they'll get handled asap. I handled the ones I could. Ditto. Don't know why the hacker bothers wasting the accounts like this though. They get noticed immediately and it's blatantly obvious ref spam so next to no one will click on it anyway. I also don't think it is an actual referral link. I think he probably controls the website. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Omikifuse on June 23, 2015, 07:24:50 PM Just report them and they'll get handled asap. I handled the ones I could. Ditto. Don't know why the hacker bothers wasting the accounts like this though. They get noticed immediately and it's blatantly obvious ref spam so next to no one will click on it anyway. They can't sell the accounts because no one will buy an account without signed message and the owner can retake his account signing a message and pming theymos. Most hacked accounts are not even worth for signature campaigns unless the ones with daily payment, like yobit. Since they don't see a good use for them they just use it for referral spam Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: shorena on June 23, 2015, 07:47:51 PM Just report them and they'll get handled asap. I handled the ones I could. Ditto. Don't know why the hacker bothers wasting the accounts like this though. They get noticed immediately and it's blatantly obvious ref spam so next to no one will click on it anyway. They can't sell the accounts because no one will buy an account without signed message and the owner can retake his account signing a message and pming theymos. Most hacked accounts are not even worth for signature campaigns unless the ones with daily payment, like yobit. Since they don't see a good use for them they just use it for referral spam My guess is that these accounts are indeed bought for the sole purpose of spamming. Probably for a very cheap price and at bulk. The most recent account dazza12[1], last active in 2014, was probably protected by a weak password that was brute forced after the database leak. A Jr. account isnt high enough to join a campaign anyway and it cant be easily handled with nukes. Thus in order to get the posts removed you will need a mod for that board or a global mod to take action, which (since they are less) takes longer. Edit: Just for comparisson sake to show how efficient moderation against newbies is. A spam post[2] was posted 21:47:40[3], I saw and reported it ~21:48:40. At 21:50:20 it was still there, but gone at 21:51:10. That post was visible for somewhere between 160 and 210 seconds. [1] https://bitcointalk.org/index.php?action=profile;u=217100;sa=showPosts [2] https://bitcointalk.org/index.php?topic=1097642.0 [3] all times local time (CEST), format hh:mm:ss Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: hilariousandco on June 23, 2015, 08:16:29 PM Just report them and they'll get handled asap. I handled the ones I could. Ditto. Don't know why the hacker bothers wasting the accounts like this though. They get noticed immediately and it's blatantly obvious ref spam so next to no one will click on it anyway. They can't sell the accounts because no one will buy an account without signed message and the owner can retake his account signing a message and pming theymos. Of course they can. Do you think most newbs know anything about signed messages or that people care if they get a cheap account? Granted most knowledgable members will want some proof from an old address but there's plenty of others who don't know about that or don't care. And if you can provide a signed message to prove the account is yours then they could just as easily do that to get it back from theymos after they've sold it. Edit: Just for comparisson sake to show how efficient moderation against newbies is. A spam post[2] was posted 21:47:40[3], I saw and reported it ~21:48:40. At 21:50:20 it was still there, but gone at 21:51:10. That post was visible for somewhere between 160 and 210 seconds. Yeah, plenty of patrollers so newbs get dealt with very fast but we need more mods for the boards that have none or some more very active Globals to take care of the rest. Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: shorena on June 23, 2015, 08:22:16 PM -snip- Yeah, plenty of patrollers so newbs get dealt with very fast but we need more mods for the boards that have none or some more very active Globals to take care of the rest. Yes, why are you no global mod yet? Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Mt. Gox on June 27, 2015, 01:24:13 AM Well it looks like all three sites mentioned (Cloudminer.biz, Ghsminer.com, and Hashminer.net) have been shut down. They all probably belonged to the same person. Either someone from here reported them or their owner(s) ran off with the money:
http://s8.postimg.org/7spybdp39/mus_Small.png Title: Re: User creating massive amounts of referral spam - EmpoEX Post by: Quickseller on August 07, 2015, 03:55:57 PM There is another one --> https://bitcointalk.org/index.php?action=profile;u=344822 (Magic Of Nigeria)..... it looks like Candy got hacked :D
Title: Re: User creating massive amounts of referral spam - Magic Of Nigeria Post by: Muhammed Zakir on August 07, 2015, 04:22:17 PM There is another one --> https://bitcointalk.org/index.php?action=profile;u=344822 (Magic Of Nigeria)..... it looks like Candy got hacked :D + https://bitcointalk.org/index.php?action=profile;u=354665 (theerachate). Title: Re: User creating massive amounts of referral spam - Magic Of Nigeria Post by: Quickseller on August 07, 2015, 04:37:47 PM There is another one --> https://bitcointalk.org/index.php?action=profile;u=344822 (Magic Of Nigeria)..... it looks like Candy got hacked :D + https://bitcointalk.org/index.php?action=profile;u=354665 (theerachate). Title: Re: User creating massive amounts of referral spam - Magic Of Nigeria Post by: Muhammed Zakir on August 07, 2015, 04:50:24 PM There is another one --> https://bitcointalk.org/index.php?action=profile;u=344822 (Magic Of Nigeria)..... it looks like Candy got hacked :D + https://bitcointalk.org/index.php?action=profile;u=354665 (theerachate). Yes, I saw! I reported him to BadBear yesterday. He is probably banned. Title: Re: User creating massive amounts of referral spam - Magic Of Nigeria Post by: unamis76 on August 07, 2015, 05:18:58 PM More and more users with referral spam ::) already reported some posts from Magic of Nigeria. Let's see who comes up next...
Title: Re: User creating massive amounts of referral spam - Magic Of Nigeria Post by: camelson on August 08, 2015, 02:23:15 PM Here a new scammer : https://bitcointalk.org/index.php?topic=1147331.0
Scammr profile; https://bitcointalk.org/index.php?action=profile;u=405552 He is promoting the same site, i think he alt of those account . Title: Re: User creating massive amounts of referral spam - Magic Of Nigeria Post by: Muhammed Zakir on August 08, 2015, 02:44:03 PM How is these accounts getting hacked and no reports are made by users? I don't think someone would buy those to spam a referral link but I am stuck when joining dots!
Title: Re: User creating massive amounts of referral spam - Magic Of Nigeria Post by: Quickseller on August 08, 2015, 03:05:00 PM How is these accounts getting hacked and no reports are made by users? I don't think someone would buy those to spam a referral link but I am stuck when joining dots! Easy, someone joins fastminer.net, uses the same password as is used on bitcointalk.org then whoever is behind these hacks simply logs into the hacked accounts. Not everyone is going to try to post on the forum everyday and if your account is hacked, you technically don't need to post in meta, you are suppose to send theymos a PM with a signed message asking him to reset your email address. So there could be reports but they are just not public Title: Re: User creating massive amounts of referral spam - Magic Of Nigeria Post by: 1Referee on August 08, 2015, 03:16:28 PM Who is this marcy clown spamming the entire forum with links that are probably virusses. Can some one ban this idiot?
Title: Re: User creating massive amounts of referral spam - Marcy Post by: Muhammed Zakir on August 08, 2015, 03:30:18 PM How is these accounts getting hacked and no reports are made by users? I don't think someone would buy those to spam a referral link but I am stuck when joining dots! Easy, someone joins fastminer.net, uses the same password as is used on bitcointalk.org then whoever is behind these hacks simply logs into the hacked accounts. Not everyone is going to try to post on the forum everyday and if your account is hacked, you technically don't need to post in meta, you are suppose to send theymos a PM with a signed message asking him to reset your email address. So there could be reports but they are just not public Hmm... Who is this marcy clown spamming the entire forum with links that are probably virusses. Can some one ban this idiot? It will take sometime to delete all of those spam and more time to ban a user! Title: Re: User creating massive amounts of referral spam - Marcy Post by: Gio344 on August 08, 2015, 05:32:39 PM heres an idea, cant they just ban the word fastminer on here?
Title: Re: User creating massive amounts of referral spam - Marcy Post by: hilariousandco on August 08, 2015, 05:43:46 PM Handled the ones I could. Nearly 200 reports I think. Wish there was a way to just checkbox all the posts and delete them all at once.
heres an idea, cant they just ban the word fastminer on here? It can be added to a blacklist, though once they find out they'll likely change it or cloak it to get around the block. Title: Re: User creating massive amounts of referral spam - Marcy Post by: guitarplinker on August 08, 2015, 06:16:16 PM Handled the ones I could. Nearly 200 reports I think. Wish there was a way to just checkbox all the posts and delete them all at once. What about adding Fastminer.net or whatever it is to the list of blocked urls? I know they could bypass that as well, but it would be a decent start. If Bitcointalk could implement a URL unshortner, then blocking all destination URLs including fastminer.net would be a really good start.heres an idea, cant they just ban the word fastminer on here? It can be added to a blacklist, though once they find out they'll likely change it or cloak it to get around the block. Title: Re: User creating massive amounts of referral spam - Marcy Post by: grue on August 08, 2015, 08:50:49 PM handled
|
