A Network of fake accounts bumping threads, attempting to spread malware.

Look at this thread:
https://bitcointalk.org/index.php?topic=3301773.0

EVERY single response to it comes from a Newbie. Doesn't that look suspicious? Most of those accounts seem to have responses to just that thread along with another one promoting a trading bot.

This thread has been kept to the top position of the trading discussion board all day, but they way this was achieved doesn't appear to be organic.

It surely isn't organic but what kind of bot is this now posting with new accounts every single time it's weird there has already been 9 pages of reply but no moderators has taken any action against it

Also here's a link to one of the newbie profile : https://bitcointalk.org/index.php?action=profile;u=368869;sa=showPosts
This clearly proofs they were only created to bump the thread

I have archived the whole post for future reference : https://web.archive.org/web/20180412232507/https://bitcointalk.org/index.php?topic=3301773.0;all

Quote from: max2607 on April 12, 2018, 11:25:32 PM

The posts feel like they have a human touch to them. Perhaps this is some sort of paid promotion where users are incentivized to make those posts for some sort of a reward. Either way, it is very much against the rules so I hope mods will take action promptly.

They're probably hacked accounts as well. Look at the registered dates of them:

https://bitcointalk.org/index.php?action=profile;u=398174    alex1736 November 26, 2014
https://bitcointalk.org/index.php?action=profile;u=368869    DARKCAPITAN August 20, 2014,
https://bitcointalk.org/index.php?action=profile;u=879567    bobsat July 19, 2016
https://bitcointalk.org/index.php?action=profile;u=391361    mantavy4 November 01, 2014
https://bitcointalk.org/index.php?action=profile;u=765018    konishua February 11, 2016

All of the above ones except two have zero posts until recently. The other two have one post back in 2016 then nothing until they start bumping that thread.

Quote from: hilariousetc on April 13, 2018, 09:27:00 AM

They're probably hacked accounts as well. Look at the registered dates of them:

https://bitcointalk.org/index.php?action=profile;u=398174     alex1736 November 26, 2014
https://bitcointalk.org/index.php?action=profile;u=368869     DARKCAPITAN August 20, 2014,
https://bitcointalk.org/index.php?action=profile;u=879567     bobsat July 19, 2016
https://bitcointalk.org/index.php?action=profile;u=391361     mantavy4 November 01, 2014
https://bitcointalk.org/index.php?action=profile;u=765018     konishua February 11, 2016

All of the above ones except two have zero posts until recently. The other two have one post back in 2016 then nothing until they start bumping that thread.

The Japanese are something bad conceived. It is necessary to observe the activity of the local topic https://bitcointalk.org/index.php?topic=3163031.msg32706386#msg32706386 There's probably all bots

This is now carried over to local boards:

https://bitcointalk.org/index.php?topic=3346156.0
https://bitcointalk.org/index.php?topic=3346174.0
https://bitcointalk.org/index.php?topic=3346137.0

Responses are of the same low quality as before and all in English in spite of the OPs being posted in local boards. Mods should take the time to ban the bot/hacked accounts. This is very frustrating.

This seems to be the account of the perpetrating OP:
https://bitcointalk.org/index.php?action=profile;u=867859

I'm starting to believe that this might be an attempt to spread malicious software. The domain linked does not seem to be connected to the original service in any way. It's registered on 2018-04-05.

I got a response from the official team behind the actual service:

Quote from: leonArdo@margin on April 19, 2018, 03:43:34 PM

Quote from: alani123 on April 19, 2018, 03:00:02 PM

Are you aware of the spamming related to a supposed promotion posing as "margin bot"?

The spammers are using your intellectual property, including your name and logo as well as a 1 to 1 copy of margin.de in a different domain. I don't know if those operations are linked to the original service (the one here) but they're using a domain registered on 2018-04-05 which I couldn't find to have any connection to the legitimate service here. Could probably be an attempt to get users to download malicious software.

Here's my documentation of this:
https://bitcointalk.org/index.php?topic=3311619

If this is a scam you should take appropriate action as the original holders of the intellectual property.

Thanks for reporting this! We reported them to the moderators. We would appreciate if other would, too!

All the best,

Rene

I think we can say with certainty that this is an attempt to spread malware!

I've PMed Theymos so hopefully we'll see this addressed soon.

What kind of malware? Any idea? I guess we really need that new bitcointalk sooner, with some updated security and other things that can prevent this kind of botting and spamming.

Quote from: athanz88 on April 19, 2018, 06:34:29 PM

What kind of malware? Any idea? I guess we really need that new bitcointalk sooner, with some updated security and other things that can prevent this kind of botting and spamming.

https://www.virustotal.com/en/file/d801f25c3901950b5b62615c3d95b44ce9bb044315e40cf738620f46d5d8c54e/analysis/1524159308/

This is the file that the website prompts to download.

Quote from: alani123 on April 19, 2018, 06:54:44 PM

Quote from: athanz88 on April 19, 2018, 06:34:29 PM

snip

https://www.virustotal.com/en/file/d801f25c3901950b5b62615c3d95b44ce9bb044315e40cf738620f46d5d8c54e/analysis/1524159308/

This is the file that the website prompts to download.

Well it has some severe virus in there, what ever the malware is, i guess it can do some serious things like stealing information or making your computer as a miner like some malware back then. Damn there are so many crimes everywhere.

Phishing has begun again:

https://bitcointalk.org/index.php?topic=4476829.0
https://bitcointalk.org/index.php?topic=4476823.0
https://bitcointalk.org/index.php?topic=4052923.0
https://bitcointalk.org/index.php?topic=4052988.0

Mods should nuke all those accounts that post in those threads. They seem hacked.

Edit:
To clarify, the official domain is margin.de as seen in their official thread:
https://bitcointalk.org/index.php?topic=1467939.0

See real vs. fake whois here:
https://imgur.com/a/lk0pvvx

Quote from: alani123 on June 15, 2018, 09:48:06 PM

Mods should purge those threads/accounts pls. I've already reported them and some responses were deleted but the OPs and accounts were left untouched.