User creating massive amounts of referral spam - Marcy

[Quickseller]

Upon closer inspection of the referral links he is posting the domain of the referral link matches his handle

The link that was spammed contained an ID on the end of the URL specifically "?ref=271292" for a hashminer.net site, which does not in any way match our handle.

Like I said above, I thought that I saw some of the referral links with the domain of EmpoEX, although I might be mistaken.

[DiamondCardz]

Can we just blacklist the hashminer (dot) net domain? It seems like that'd kill the spammers pretty quickly...well, at least until they create a new website. But otherwise it doesn't seem like this hacking is going to stop, as it seems like it'll exponentially grow (I am willing to bet >1 person gets hacked clicking the links each time a hacked account spams the board up).

Upon closer inspection of the referral links he is posting the domain of the referral link matches his handle

The link that was spammed contained an ID on the end of the URL specifically "?ref=271292" for a hashminer.net site, which does not in any way match our handle.

Like I said above, I thought that I saw some of the referral links with the domain of EmpoEX, although I might be mistaken.

You are mistaken. I reported every single hacked post made by EmpoEX (and probably other people did too), and I never saw a domain for EmpoEX.

[dothebeats]

Hmm I've noticed some of the posts with that cloud mining referrals but I just ignored them (I'm not helping the mods in doing their job ). I thought referral links aren't allowed for posting? Just a suggestion, I think auto-removing referral links should be implemented in this forum. Just a thought that popped out of my head.

Edit: I think we need more Global Mods. YourNewGod excessively spamming. Hope these accounts will be banned soon.

Not necessarily needed for the mean time I think, as long as there are also other members of this forum helping the mods in their job by reporting posts like this.

[Muhammed Zakir]

Hmm I've noticed some of the posts with that cloud mining referrals but I just ignored them (I'm not helping the mods in doing their job ). I thought referral links aren't allowed for posting? Just a suggestion, I think auto-removing referral links should be implemented in this forum. Just a thought that popped out of my head.

Links for newbies are auto-removed but not for higher ranks. There are legit reasons for posting referral links but spams are way higher. So I guess this would work but I don't think forum will disable this. Users can also use shortened URL for posting referral link to bypass auto-remove.

Edit: I think we need more Global Mods. YourNewGod excessively spamming. Hope these accounts will be banned soon.

Not necessarily needed for the mean time I think, as long as there are also other members of this forum helping the mods in their job by reporting posts like this.

Only 2 Global Moderators are active now. We definitely need a few more active Global Moderators. https://bitcointalk.org/index.php?action=mlist;sa=search

P.S. Also see https://bitcointalk.org/index.php?topic=1071319.0;all.

[Quickseller]

https://bitcointalk.org/index.php?action=profile;u=409703

It looks like someone else is making similarly spammy posts.

[master-P]

Another one just started: https://bitcointalk.org/index.php?action=profile;u=508320

Left negative trust for both of these users as the site looks extremely dodgy, even for a cloud mining site/ponzi.

These accounts are likely to be compromised if not owned by the owner of the site who's trying to promote this scam.

[alani123]

Quite apparently, this is done extensively recently. Higher ranked accounts have low limits for posting, easy to abuse them while it's not that hard to acquire an account with a high rank. I'm not sure if this is proving worthy for whatever they're trying to achieve. The forum could probably use some defense against accounts that are bought with the sole purpose of spamming.

[Quickseller]

There is another one that is apparently just getting started (less then 20 so far).

--> https://bitcointalk.org/index.php?action=profile;u=220238

[hilariousandco]

Just report them and they'll get handled asap. I handled the ones I could.

[EcuaMobi]

There's a new one promoting a slightly different domain (ghsminer[dot]com/?ref=xxxx), obviously by the same owner/hacker:
dazza12 | Last posts

[hilariousandco]

Just report them and they'll get handled asap. I handled the ones I could.

Ditto. Don't know why the hacker bothers wasting the accounts like this though. They get noticed immediately and it's blatantly obvious ref spam so next to no one will click on it anyway.

[Quickseller]

Just report them and they'll get handled asap. I handled the ones I could.

Ditto. Don't know why the hacker bothers wasting the accounts like this though. They get noticed immediately and it's blatantly obvious ref spam so next to no one will click on it anyway.

I imagine that some people click on the links. It would probably only take one or two sales to outweigh the value of the hacked account, plus it is difficult to sell hacked accounts now a days because people have become conscious about the necessity of getting signed messages.

I also don't think it is an actual referral link. I think he probably controls the website.

[Omikifuse]

Just report them and they'll get handled asap. I handled the ones I could.

Ditto. Don't know why the hacker bothers wasting the accounts like this though. They get noticed immediately and it's blatantly obvious ref spam so next to no one will click on it anyway.

They can't sell the accounts because no one will buy an account without signed message and the owner can retake his account signing a message and pming theymos. Most hacked accounts are not even worth for signature campaigns unless the ones with daily payment, like yobit.

Since they don't see a good use for them they just use it for referral spam

[shorena]

Just report them and they'll get handled asap. I handled the ones I could.

Ditto. Don't know why the hacker bothers wasting the accounts like this though. They get noticed immediately and it's blatantly obvious ref spam so next to no one will click on it anyway.

They can't sell the accounts because no one will buy an account without signed message and the owner can retake his account signing a message and pming theymos. Most hacked accounts are not even worth for signature campaigns unless the ones with daily payment, like yobit.

Since they don't see a good use for them they just use it for referral spam

My guess is that these accounts are indeed bought for the sole purpose of spamming. Probably for a very cheap price and at bulk. The most recent account dazza12[1], last active in 2014, was probably protected by a weak password that was brute forced after the database leak. A Jr. account isnt high enough to join a campaign anyway and it cant be easily handled with nukes. Thus in order to get the posts removed you will need a mod for that board or a global mod to take action, which (since they are less) takes longer.

Edit: Just for comparisson sake to show how efficient moderation against newbies is.

A spam post[2] was posted 21:47:40[3], I saw and reported it ~21:48:40. At 21:50:20 it was still there, but gone at 21:51:10. That post was visible for somewhere between 160 and 210 seconds.


[1] https://bitcointalk.org/index.php?action=profile;u=217100;sa=showPosts
[2] https://bitcointalk.org/index.php?topic=1097642.0
[3] all times local time (CEST), format hh:mm:ss

[hilariousandco]

Just report them and they'll get handled asap. I handled the ones I could.

Ditto. Don't know why the hacker bothers wasting the accounts like this though. They get noticed immediately and it's blatantly obvious ref spam so next to no one will click on it anyway.

They can't sell the accounts because no one will buy an account without signed message and the owner can retake his account signing a message and pming theymos.

Of course they can. Do you think most newbs know anything about signed messages or that people care if they get a cheap account? Granted most knowledgable members will want some proof from an old address but there's plenty of others who don't know about that or don't care. And if you can provide a signed message to prove the account is yours then they could just as easily do that to get it back from theymos after they've sold it.

Edit: Just for comparisson sake to show how efficient moderation against newbies is.

A spam post[2] was posted 21:47:40[3], I saw and reported it ~21:48:40. At 21:50:20 it was still there, but gone at 21:51:10. That post was visible for somewhere between 160 and 210 seconds.

Yeah, plenty of patrollers so newbs get dealt with very fast but we need more mods for the boards that have none or some more very active Globals to take care of the rest.

[shorena]

-snip-
Yeah, plenty of patrollers so newbs get dealt with very fast but we need more mods for the boards that have none or some more very active Globals to take care of the rest.

Yes, why are you no global mod yet?

[Mt. Gox]

Well it looks like all three sites mentioned (Cloudminer.biz, Ghsminer.com, and Hashminer.net) have been shut down. They all probably belonged to the same person. Either someone from here reported them or their owner(s) ran off with the money:

[Quickseller]

There is another one --> https://bitcointalk.org/index.php?action=profile;u=344822 (Magic Of Nigeria)..... it looks like Candy got hacked

[Muhammed Zakir]

There is another one --> https://bitcointalk.org/index.php?action=profile;u=344822 (Magic Of Nigeria)..... it looks like Candy got hacked

+ https://bitcointalk.org/index.php?action=profile;u=354665 (theerachate).

[Quickseller]

There is another one --> https://bitcointalk.org/index.php?action=profile;u=344822 (Magic Of Nigeria)..... it looks like Candy got hacked

+ https://bitcointalk.org/index.php?action=profile;u=354665 (theerachate).

It looks like that guy's posts have been deleted already, I am showing his last post being last month