Bitcoin Forum

Other => Meta => Topic started by: TheBeardedBaby on December 10, 2020, 12:20:21 AM



Title: Beware of the new type of spam, hidden in the bounty proof of registration.
Post by: TheBeardedBaby on December 10, 2020, 12:20:21 AM
In the patrol found this guy > comdihydsimp (https://bitcointalk.org/index.php?action=profile;u=2899617)

Posting just a random bounty proof post.
But I noticed that the link to the twitter account lead to the same post and when I moved my mouse over the Twitter PostID found that every digit has a different link hidden behind it. See the underlined 0 on the retweet link in the picture below.

Pay attention to the bounty reports. I hope the account will be banned, I've tagged it, I know it's not worthy but, nothing else can be done.
https://i.imgur.com/c5x7Md5.png

Archive of the post on TryNinja's website : https://ninjastic.space/post/55792026

Edit>
He's been doing this for a while (the past 120 days):

https://i.imgur.com/AUzP0L1.png


Title: Re: Beware of the new type of spam, hidden in the bounty proof of registration.
Post by: hosseinimr93 on December 10, 2020, 02:01:08 AM
I could find some more accounts.
You can click on links below to see their post history on loyce.club.

rillgosinmo (https://loyce.club/archive/members/289/2899648.html)
isrecdine (https://loyce.club/archive/members/289/2899596.html)
blabtasenen (https://loyce.club/archive/members/289/2899575.html)
ativorpun (https://loyce.club/archive/members/289/2899659.html)
licherpiebur (https://loyce.club/archive/members/289/2899647.html)
hundrivibel (https://loyce.club/archive/members/289/2899638.html)
kompcrosmisti (https://loyce.club/archive/members/289/2899642.html)
matchtercglocnai (https://loyce.club/archive/members/289/2899517.html)
sparsuareho (https://loyce.club/archive/members/289/2899656.html)

Although each of these accounts has more than 30 deleted posts, none of them have been banned and they are still active.


Title: Re: Beware of the new type of spam, hidden in the bounty proof of registration.
Post by: TheBeardedBaby on December 10, 2020, 06:55:13 AM
Good find.

The weird thing is that they post the links and afterwards they remove the posts in just a matter of 2,3 minutes. I don't think the mods are deleting the post otherwise the accounts should have been banned long ago.


Title: Re: Beware of the new type of spam, hidden in the bounty proof of registration.
Post by: hosseinimr93 on December 10, 2020, 07:20:24 AM
The weird thing is that they post the links and afterwards they remove the posts in just a matter of 2,3 minutes. I don't think the mods are deleting the post otherwise the accounts should have been banned long ago.
There's a high probability that these posts are deleted by Mitchell (https://bitcointalk.org/index.php?action=profile;u=113670)'s bot, MindlessElectron (https://bitcointalk.org/index.php?action=profile;u=1136003).
If you search for the user ID of any of these accounts in modlog (https://bitcointalk.org/modlog.php), you will find deleted posts.

I just searched for the user ID of the account you referred to in OP (using CTRL+F) in modlog (https://bitcointalk.org/modlog.php) and found 55 posts.
loyce.club (https://loyce.club/archive/members/289/2899617.html) shows only 28 posts. (All these accounts have been created recently and loyce.club should have all of their posts)
Some posts are deleted so fast that even loyce.club cannot scrap them.

Also, if I'm not wrong, users cannot delete posts made in bounties before 24 hours.


Title: Re: Beware of the new type of spam, hidden in the bounty proof of registration.
Post by: Mitchell on December 10, 2020, 09:29:54 AM
The weird thing is that they post the links and afterwards they remove the posts in just a matter of 2,3 minutes. I don't think the mods are deleting the post otherwise the accounts should have been banned long ago.
There's a high probability that these posts are deleted by Mitchell (https://bitcointalk.org/index.php?action=profile;u=113670)'s bot, MindlessElectron (https://bitcointalk.org/index.php?action=profile;u=1136003).
If you search for the user ID of any of these accounts in modlog (https://bitcointalk.org/modlog.php), you will find deleted posts.

I just searched for the user ID of the account you referred to in OP (using CTRL+F) in modlog (https://bitcointalk.org/modlog.php) and found 55 posts.
loyce.club (https://loyce.club/archive/members/289/2899617.html) shows only 28 posts. (All these accounts have been created recently and loyce.club should have all of their posts)
Some posts are deleted so fast that even loyce.club cannot scrap them.

Also, if I'm not wrong, users cannot delete posts made in bounties before 24 hours.
That sounds like my bot, yes. It scrapes the Patrol page every minute or two (IIRC), so most of these spam posts are removed pretty quickly, as long as the bot knows what to look out for.
However, the bot does not nuke the accounts, just in case it was an innocent newbie. Most of the time the spam accounts are used between 1 and 3 times, so it's not too bad.



EDIT 06-01-2021: The bot now does nuke accounts for certain triggers. :)


Title: Re: Beware of the new type of spam, hidden in the bounty proof of registration.
Post by: LoyceV on December 10, 2020, 11:10:45 AM
rillgosinmo (https://loyce.club/archive/members/289/2899648.html)
isrecdine (https://loyce.club/archive/members/289/2899596.html)
blabtasenen (https://loyce.club/archive/members/289/2899575.html)
ativorpun (https://loyce.club/archive/members/289/2899659.html)
licherpiebur (https://loyce.club/archive/members/289/2899647.html)
hundrivibel (https://loyce.club/archive/members/289/2899638.html)
kompcrosmisti (https://loyce.club/archive/members/289/2899642.html)
matchtercglocnai (https://loyce.club/archive/members/289/2899517.html)
sparsuareho (https://loyce.club/archive/members/289/2899656.html)
There's an easy way to find those: 10 Brand new users on top of Active users and top posters in the past 24 hours (https://loyce.club/active/) stand out:
https://loyce.club/other/spam.png

However, the bot does not nuke the accounts, just in case it was an innocent newbie. Most of the time the spam accounts are used between 1 and 3 times, so it's not too bad.
I'd still prefer to see the spammers Nuked, so at least they can't do it again later. Creating new accounts is for sure more of a hassle than using existing ones.