LoyceV (OP)
Legendary
Offline
Activity: 3416
Merit: 17295
Thick-Skinned Gang Leader and Golden Feather 2021
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 13, 2018, 03:25:24 PM Last edit: January 21, 2018, 10:26:40 AM by LoyceV |
|
I've seen many posts like this in the past days: We offer promotion and traffic from the forum bitcointalk and social networks. ROI for our services is 600-2000%. We offer: - Send private messages to Bitcointalk users (Only to users who visited ANN thread last month) - Twitter promotion (We will do a tweet with a description of your project and will mark one user on each tweet) - Telegram real chat users - Private messages to telegram users (A+ target audience)
This is automatic message. For all terms x conditions write to telegram - @AlexPromotion
Would it be possible to ban based on keywords? A telegram-nickname seems to be quite unique, any Newbie posting it should get an instant-ban. Once such a blacklist is in place, it can easily be extended with new keywords.
|
|
|
|
aTriz
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 14, 2018, 01:34:13 AM |
|
This is a good idea, since there's a guy pming me and all of my project owners offering bumping services and leaving their Telegram (@hypebtc). I would like that anyone who says that gets banned.
|
|
|
|
hilariousetc
Legendary
Offline
Activity: 2884
Merit: 3043
Join the world-leading crypto sportsbook NOW!
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 14, 2018, 07:01:13 AM |
|
I've seen many posts like this in the past days: We offer promotion and traffic from the forum bitcointalk and social networks. ROI for our services is 600-2000%. We offer: - Send private messages to Bitcointalk users (Only to users who visited ANN thread last month) - Twitter promotion (We will do a tweet with a description of your project and will mark one user on each tweet) - Telegram real chat users - Private messages to telegram users (A+ target audience)
This is automatic message. For all terms x conditions write to telegram - @AlexPromotion
Would it be possible to ban based on keywords? A telegram-nickname seems to be quite unique, any Newbie posting it should get an instant-ban. Once such a blacklist is in place, it can easily be extended with new keywords. We had a bot to crawl and nuke these users but it hasn't been working since we changed to cloudflare. Just report them manually for now and they'll be quickly dealt with. This is a good idea, since there's a guy pming me and all of my project owners offering bumping services and leaving their Telegram (@hypebtc). I would like that anyone who says that gets banned.
Report them and they will.
|
|
|
|
LoyceV (OP)
Legendary
Offline
Activity: 3416
Merit: 17295
Thick-Skinned Gang Leader and Golden Feather 2021
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 14, 2018, 10:13:34 AM |
|
We had a bot to crawl and nuke these users but it hasn't been working since we changed to cloudflare. Just report them manually for now and they'll be quickly dealt with. I have reported a lot of them yesterday, the problem is that @AlexPromotion uses many different accounts. When I search on Google for "@AlexPromotion site:bitcointalk.org", it gives me many new accounts. I've just reported about 100 more. At least this is fast again, the forum performs very well at the moment. Is there any chance the bot-banning-bot will be working with Cloudflare in the future?
|
|
|
|
hilariousetc
Legendary
Offline
Activity: 2884
Merit: 3043
Join the world-leading crypto sportsbook NOW!
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 14, 2018, 10:18:53 AM |
|
I know it's annoying and frustrating but all you can do at the moment is keep reporting them and staff will keep on nuking them. I hope the bot will be back soon and an update has been requested as it's badly needed, especially as these bots are now going to be spamming the forum instead of just PMs, but I don't know what the error is exactly and if it was simple then it probably would have been fixed by now.
|
|
|
|
pugman
Legendary
Offline
Activity: 2383
Merit: 1551
dogs are cute.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 14, 2018, 10:53:08 AM |
|
I know it's annoying and frustrating but all you can do at the moment is keep reporting them and staff will keep on nuking them. I hope the bot will be back soon and an update has been requested as it's badly needed, especially as these bots are now going to be spamming the forum instead of just PMs, but I don't know what the error is exactly and if it was simple then it probably would have been fixed by now.
@hilariousetc,can you please request theymos to implement or at least consider this :- There is this thing which detects your original IP even if you use VPN or anything, so if you're banned, you cannot access your account/s even if you use VPN. Simple as that. If this feature gets implemented, then people won't have to fuss about shit posters.
I had mentioned this in another thread couple of days ago, if cloudfare is going to block bots, alternatives must be taken into consideration at the very least. If this is implemented, users won't have to spend so much time on reporting users who copy paste, shitpost, create alt accounts to irritate users via pm, create Ann threads every day with their legion of accounts, and the list goes on and on. So if they are banned once, they are banned forever. Workload on staff would considerably reduce. But I don't know how hard this will be to implement.
|
|
|
|
LoyceV (OP)
Legendary
Offline
Activity: 3416
Merit: 17295
Thick-Skinned Gang Leader and Golden Feather 2021
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 14, 2018, 11:47:52 AM |
|
@hilariousetc,can you please request theymos to implement or at least consider this :- There is this thing which detects your original IP even if you use VPN or anything, so if you're banned, you cannot access your account/s even if you use VPN. Simple as that. If this feature gets implemented, then people won't have to fuss about shit posters.
I had mentioned this in another thread couple of days ago I don't know what "this thing" is, but a good VPN won't allow any scripts to detect your real IP address, and neither does Tor. Bitcointalk has units of evil based on IP addresses, it's not perfect but it's something. I know it's annoying and frustrating but all you can do at the moment is keep reporting them and staff will keep on nuking them. Don't worry there, I'll keep reporting them ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif)
|
|
|
|
hilariousetc
Legendary
Offline
Activity: 2884
Merit: 3043
Join the world-leading crypto sportsbook NOW!
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 14, 2018, 11:57:27 AM |
|
@hilariousetc,can you please request theymos to implement or at least consider this :- There is this thing which detects your original IP even if you use VPN or anything, so if you're banned, you cannot access your account/s even if you use VPN. Simple as that. If this feature gets implemented, then people won't have to fuss about shit posters.
I had mentioned this in another thread couple of days ago I don't know what "this thing" is, but a good VPN won't allow any scripts to detect your real IP address, and neither does Tor. Bitcointalk has units of evil based on IP addresses, it's not perfect but it's something. I know it's annoying and frustrating but all you can do at the moment is keep reporting them and staff will keep on nuking them. Don't worry there, I'll keep reporting them ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) I've never heard of this either. Tor and VPNs are meant to protect you against this sort of stuff and I doubt even the CIA can find this info if you're smart enough (though I believe VPNs can accidentally leak your IP in some ways). What you might be thinking of is browser fingerprinting though which can be very useful to catch alts and just using a proxy won't help you (and I think this should be on the new forum). You might use a different IP for your accounts but you almost certainly won't be using a unique PC or browser for each of your alts and accounts could be collated and searched by them and cross referenced with other data etc.
|
|
|
|
pugman
Legendary
Offline
Activity: 2383
Merit: 1551
dogs are cute.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 14, 2018, 12:36:35 PM |
|
I've never heard of this either. Tor and VPNs are meant to protect you against this sort of stuff and I doubt even the CIA can find this info if you're smart enough (though I believe VPNs can accidentally leak your IP in some ways). What you might be thinking of is browser fingerprinting though which can be very useful to catch alts and just using a proxy won't help you (and I think this should be on the new forum). You might use a different IP for your accounts but you almost certainly won't be using a unique PC or browser for each of your alts and accounts could be collated and searched by them and cross referenced with other data etc.
I'm quoting the admin of whatismyip.com,he had stated this in quora : The WebRTC vulnerability could give away your real IP address. Even if there were no vulnerability, it could come down to how the VPN is set up. Are they using tunneling? If not, then everywhere you surf could see your real IP along with the IP of the VPN. Is the VPN including your IP in their header? Even if the VPN were locked down and no trace of your IP were leaking, this doesn't mean you can commit nefarious acts online without getting found out. There are log files on every server. The amount of time logs are kept varies. With enough resources and legal action, log files from VPNs could be turned over to authorities. Once they see your real IP, they simply subpoena your ISP and will find out who you are. Realize that it can be more complicated than the scenario I use above, but my example is to simply help you understand that you're not truly hidden online. Obviously not everyone on this forum is a tech savvy bad ass to be as careful and take all measures for revealing your real IP, but I just realized that it just cannot be implemented on this forum, as I began reading more on it, seems to be really hard to implement and theymos alone will almost find it impossible to do such. I reckon even a group of highly qualified front and back end programmers would be able to implement such on this forum. However, a few websites have cracked down this problem but it's not revealed exactly on how they did such a thing.
|
|
|
|
LoyceV (OP)
Legendary
Offline
Activity: 3416
Merit: 17295
Thick-Skinned Gang Leader and Golden Feather 2021
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 14, 2018, 01:02:49 PM |
|
I'm quoting the admin of whatismyip.com,he had stated this in quora : The WebRTC vulnerability could give away your real IP address. Even if there were no vulnerability, it could come down to how the VPN is set up. Are they using tunneling? If not, then everywhere you surf could see your real IP along with the IP of the VPN. Is the VPN including your IP in their header? You can of course disable WebRTC. Even if the VPN were locked down and no trace of your IP were leaking, this doesn't mean you can commit nefarious acts online without getting found out. There are log files on every server. The amount of time logs are kept varies. With enough resources and legal action, log files from VPNs could be turned over to authorities. Once they see your real IP, they simply subpoena your ISP and will find out who you are. Realize that it can be more complicated than the scenario I use above, but my example is to simply help you understand that you're not truly hidden online. A good VPN doesn't keep logfiles, so there's nothing to subpoena. Obviously not everyone on this forum is a tech savvy bad ass to be as careful and take all measures for revealing your real IP, but I just realized that it just cannot be implemented on this forum, as I began reading more on it, seems to be really hard to implement and theymos alone will almost find it impossible to do such. Aside from technical possibilities, theymos values user's privacy. That alone is a reason not to do this. And in the end I don't expect it'll stop spam anyway, it's the core business for spammers.
|
|
|
|
sapta
aka BitRentX
Staff
Legendary
Offline
Activity: 1718
Merit: 1206
Yield.App
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 15, 2018, 05:30:51 AM Last edit: January 15, 2018, 06:45:33 AM by BitRentX |
|
Followed this guy because I thought that I found a pattern (like they signed up 1 account/hour) but it turns out that there is no pattern. Nuked more than 2 dozen of them already.
|
|
|
|
pugman
Legendary
Offline
Activity: 2383
Merit: 1551
dogs are cute.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 15, 2018, 06:46:46 AM |
|
Even if the VPN were locked down and no trace of your IP were leaking, this doesn't mean you can commit nefarious acts online without getting found out. There are log files on every server. The amount of time logs are kept varies. With enough resources and legal action, log files from VPNs could be turned over to authorities. Once they see your real IP, they simply subpoena your ISP and will find out who you are. Realize that it can be more complicated than the scenario I use above, but my example is to simply help you understand that you're not truly hidden online. A good VPN doesn't keep logfiles, so there's nothing to subpoena. Actually, as a matter of fact they do, most of them at the least, they just don't reveal such information to their users. Aside from technical possibilities, theymos values user's privacy. That alone is a reason not to do this. And in the end I don't expect it'll stop spam anyway, it's the core business for spammers.
I meant that to be done only so that banned users cannot come back but theymos would not want to do such, so what else can one do? Followed this guy because I thought that I found a pattern (like they signed up 1 account/hour) but it turns out that there is no pattern. Nuked more than 2 dozen of them already.
Sadly this guy's legion of accounts doesn't end up here, LoyceV mentioned that he had reported around 100 users related to Alex promotion , but there is a possibility of Alex promotions and hypebtc to be interconnected, as they both follow some what the same pattern.
|
|
|
|
sapta
aka BitRentX
Staff
Legendary
Offline
Activity: 1718
Merit: 1206
Yield.App
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 15, 2018, 06:54:01 AM |
|
Sadly this guy's legion of accounts doesn't end up here, LoyceV mentioned that he had reported around 100 users related to Alex promotion , but there is a possibility of Alex promotions and hypebtc to be interconnected, as they both follow some what the same pattern.
I spent my session today nuking more than 50 of them and I know there are many more accounts to be nuked. I will probably look into this matter again tonight.
|
|
|
|
LoyceV (OP)
Legendary
Offline
Activity: 3416
Merit: 17295
Thick-Skinned Gang Leader and Golden Feather 2021
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 15, 2018, 10:01:21 AM |
|
I spent my session today nuking more than 50 of them and I know there are many more accounts to be nuked. I will probably look into this matter again tonight.
Last time I searched on Google, there were 200+ hits, now it's 600+. Humans can't win a fight against a spambot. I'll test something: every 5 minutes I download patrol, if AlexPromo is still posting I'll script all usernames out of there and give you a nice list to nuke. I'll let this run for a couple of days.
|
|
|
|
theymos
Administrator
Legendary
Offline
Activity: 5306
Merit: 13222
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 15, 2018, 08:24:05 PM |
|
I've never heard of this either. Tor and VPNs are meant to protect you against this sort of stuff and I doubt even the CIA can find this info if you're smart enough (though I believe VPNs can accidentally leak your IP in some ways). What you might be thinking of is browser fingerprinting though which can be very useful to catch alts and just using a proxy won't help you (and I think this should be on the new forum). You might use a different IP for your accounts but you almost certainly won't be using a unique PC or browser for each of your alts and accounts could be collated and searched by them and cross referenced with other data etc.
A year or two ago I was researching fingerprinting techniques that'd work against pretty much anyone with JavaScript enabled, and I found several promising leads on that front. But then it occurred to me that I don't really want bitcointalk.org to be known as the #1 forum on the leading edge of de-anonymization technology, so I stopped pursuing it seriously... IMO The most interesting idea I had was that you could probably fingerprint based on latency even via Tor using long-term data collection. A Tor connection looks like: User --- ISP --- Guard --- Mid --- Exit --- Server A B C D E
The latencies of connections A, B, and A+B are good fingerprint values; ISPs should have statistically-significant differences in latency to the server if the latency can be determined with enough accuracy. Latency will also uniquely vary over time; ie. latency will go up slightly when your ISP is busy, the schedule of which will be distinguishing. Additionally, Tor selects a handful of guards when it starts and then uses only those, so if you can figure out the complete list of guards, this fingerprints a long-term Tor session across sites and logins. Connection E can be directly measured, as can A+B+C+D+E if JS is enabled. That alone may be enough for fingerprinting A+B if you collect data over a long period of time. You'd roughly model the random latency distribution of C+D across the entire Tor network (which is not that large and is predictable in several non-obvious ways); then since you have a whole bunch of A+B+C+D+E and E measurements, you can get a good idea of A+B. You might be able to do even better by taking into account these facts: Tor changes to a new random Mid and Exit every 10 minutes, but it only affects new TCP connections. So you can usually control the timing exactly by opening TCP connections via JS. And it chooses a random Guard only from a small set, with that set being chosen only at the start of the long-term Tor session. So you might be able to get the guard identities (or a fingerprint of the guard identities) and info about the latencies by collecting latency data every 10 minutes via JS and looking at the clusters formed by the handful of different guards. On a MITM attack, you can do even better. If you control both Mid and the server, then you know C, D, E, and the Guard identity. A+B is then trivial to calculate. There are only about 6000 Tor nodes, so if you only run one Tor non-exit node, you have something like a 1/6000 chance every 10 minutes to fingerprint the user this way. (That's a really rough estimate; the odds are better because you can exploit Tor behaviors like its IP-space diversity requirements, but worse because selection is not random, and is also based on things like seniority and bandwidth.) Additionally, if a user happens to choose your node as a guard when he starts his Tor session (so a smallish chance ~ per day rather than per 10 minutes), then you can completely deanonymize him (ie. get his IP address) when he visits the site; this is a well-known attack which the NSA & friends are probably doing all the time on a very large scale.
|
1NXYoJ5xU91Jp83XfVMHwwTUyZFK64BoAD
|
|
|
poptok1
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 15, 2018, 08:54:51 PM Last edit: January 15, 2018, 09:28:00 PM by poptok1 |
|
On a MITM attack, you can do even better. If you control both Mid and the server, then you know C, D, E, and the Guard identity. A+B is then trivial to calculate. There are only about 6000 Tor nodes, so if you only run one Tor non-exit node, you have something like a 1/6000 chance every 10 minutes to fingerprint the user this way. (That's a really rough estimate; the odds are better because you can exploit Tor behaviors like its IP-space diversity requirements, but worse because selection is not random, and is also based on things like seniority and bandwidth.) Additionally, if a user happens to choose your node as a guard when he starts his Tor session (so a smallish chance ~per day rather than per 10 minutes), then you can completely deanonymize him (ie. get his IP address) when he visits the site; this is a well-known attack which the NSA & friends are probably doing all the time on a very large scale.
But all this is still assuming that JS is enabled right? Even on the main torproject website some huge headline warns people about JS. Who in their right mind uses TOR with this enabled? I guess its even off by default now (but I might be wrong). Yet thanks for this short guide, a little off topic though ![Tongue](https://bitcointalk.org/Smileys/default/tongue.gif)
Also reported few accounts with this massage. Guess its gone... for now. How about experimental shutdown for new accounts? No more newbies? (account dealing inducing) edit: O. and BTW staff member is wearing scam(ish) signature @ #11 100% proven, at least for me.
|
|
|
|
theymos
Administrator
Legendary
Offline
Activity: 5306
Merit: 13222
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 15, 2018, 09:41:02 PM |
|
But all this is still assuming that JS is enabled right?
The well-known timing attack which allows you to completely deanonymize the user if you control the guard and the server (or server's ISP) does not require JS. For example, if the NSA wanted to know everyone who visits antiwar.com regularly, they'd observe antiwar.com's ISP and set up Tor non-exit relays such that you have a 5-10% chance of choosing one of the NSA's relays as a guard every time you start Tor. Over time they'd build a complete list of all IPs for Tor users who visit antiwar.com. It's almost trivial. I'd be surprised if the NSA is not doing this already, possibly for large sections of the entire Internet (especially centralized things like Cloudflare). VPN/HTTP proxy: a little lock on a diary Tor: A Master lock. (Note: look up lockpicking videos for Master locks.) There is currently no anonymity technology which is secure in the way that Bitcoin is secure (against different attacks). Anonymity research is weak, and implementation is even worse. For example, there's something from academia called Riffle which fixes some of Tor's many problems, but nobody's bothered implementing it in a usable form even years after it was published.
|
1NXYoJ5xU91Jp83XfVMHwwTUyZFK64BoAD
|
|
|
LoyceV (OP)
Legendary
Offline
Activity: 3416
Merit: 17295
Thick-Skinned Gang Leader and Golden Feather 2021
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 19, 2018, 09:11:43 PM Last edit: January 19, 2018, 09:23:24 PM by LoyceV |
|
|
|
|
|
LoyceV (OP)
Legendary
Offline
Activity: 3416
Merit: 17295
Thick-Skinned Gang Leader and Golden Feather 2021
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 19, 2018, 09:46:24 PM |
|
Checking some of the accounts on my list in modlog, I noticed many of them have posts deleted (by Mods). As far as I know, all Mods can nuke Newbies, so why aren't they nuked on sight instead of deleting their posts? The spambot just continues posting the same posts again, until the account gets banned.
|
|
|
|
Mr. Big
Member
Global Moderator
Legendary
Offline
Activity: 2380
Merit: 1179
While my guitar gently weeps!!!
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 19, 2018, 09:52:16 PM |
|
Yep.. Nuked and still nuking... Thanks LoyceV...
|
|
|
|
|