New spam bot? [how do they do it?]

[mdayonliner]

So the easier way for me to report the posts which I will do after posting this however I wanted to bring it in your attention.

I have my email notification ON for several boards which I watch of-course. This is something I noticed when I checked my email...

In 20 minutes same topic were posted (Looking a the topic title). I thought this is usual spambot and same user was posting it. When I was checking the topics to report then I realized that contents are same but the accounts are not!!! Have a look (I archived all for reference)

nencipitua1982 ==> http://archive.is/2EveB

pogenpuvir1983 ==> http://archive.is/e1Xzi

arpsicsubscons1977 ==> http://archive.is/TR0g4

tiasicafou1974 ==> http://archive.is/qveGV

spamretlialter1976 ==> http://archive.is/kfgCL

seytendxihu1989 ==> http://archive.is/Yr5IJ

6 different users but the contents are the same!

After looking at their registration time I noticed 3 of them were created yesterday (arpsicsubscons1977, pogenpuvir1983 and seytendxihu1989 on July 06, 2018, 11:53:10 AM - July 06, 2018, 11:55:02 AM and July 06, 2018, 12:06:01 PM respectively) and other 3 were created today (tiasicafou1974, spamretlialter1976, nencipitua1982 on Today at 01:20:43 PM - Today at 01:24:19 PM - Today at 01:38:59 PM respectively).

So, looks like each day this person or company is creating 3 accounts to spam the same contents in different boards. May be they are using a new type of spambot to spam the forum with new strategy.  My question is/are...

How do they do it - Don't they get caught with evil IP score?
Aren't they breaking any rule to get banned? If we don't have any rule against them then Isn't it right thing to ban them?


This is really a big issue for the forum and we need to stop it.

[1714855003]

1714855003

[1714855003]

1714855003

[1714855003]

1714855003

[Lafu]

Already reported !

[mdayonliner]

Already reported !

Thanks mate. I reported two and rest of then were taken care of already. They were deleted.

[iwasneverhere]

After looking at their registration time I noticed 3 of them were created yesterday (arpsicsubscons1977, pogenpuvir1983 and seytendxihu1989 on July 06, 2018, 11:53:10 AM - July 06, 2018, 11:55:02 AM and July 06, 2018, 12:06:01 PM respectively) and other 3 were created today (tiasicafou1974, spamretlialter1976, nencipitua1982 on Today at 01:20:43 PM - Today at 01:24:19 PM - Today at 01:38:59 PM respectively).

So, looks like each day this person or company is creating 3 accounts to spam the same contents in different boards. May be they are using a new type of spambot to spam the forum with new strategy.  My question is/are...

How do they do it - Don't they get caught with evil IP score?
Aren't they breaking any rule to be banned? If we don't have any rule against them then Isn't it right thing to ban them?

As per my experiment, I've tried to make a new account and only able to create 4 accounts in total on 1 IP, then the next created account was caught by devil IP. I would be thinking if they renewed their IP to a new fresh one, so that's why they don't get caught with the devil IP. For the spam on different boards, they might be using a script which is prepared for these accounts and use it in bulk at the current time. It could be an iMacros script on Mozilla, but they are no longer supported in the current version.

This is really a big issue for the forum and we need to stop it.

[Insanerman]

I reported 3 of them earlier in this board.

I see many of them scattered in every part of the forum, and it's getting to be a serious problem. I can't find post where I can learn something else.

[mdayonliner]

As per my experiment, I've tried to make a new account and only have 4 accounts in total on 1 IP, then the next account was caught by devil IP.

I created one ALT account and it's caught by evil IP and was asking for 0.005BTC. I had/have a big cause to create that account which I do not want to disclose in public however since it's asking me for 0.005BTC I thought let's have a break LOL. So since then I am not using it.

Anyway, we really - really need to find a way to get rid of these spammers.

I can't find post where I can learn something else.

I partially disagree. There are a lot of stuffs in the forum which are useful to gain exclusive knowledge. At-least for me - so far I have all these (Personal Gains) personal development from the forum which I doubt I would ever had if I was not a member here.

@iwasneverhere I like this wwf gif LOL

[Thirio]

How do they do it - Don't they get caught with evil IP score?

They're probably using VPN when creating these accounts. What VPN do is it masks your IP address making you anonymous while browsing the net. Well not entirely masks your address, rather be assigned to a new address within the same location.

[LoyceV]

6 different users but the contents are the same!

Just 6? I've seen like 600 accounts involved in spamming similar to this (last January).

I think it's a bot that spams the same message on many accounts, to make it harder to nuke them all. And if the account survives, it just continues spamming the next day.

I've reported 2 of them already today. I'll now start downloading patrol again to catch them all.
The only reason I stopped doing this, is a lack of disk space. It fills one GB per week. If someone has a VPS on standby, it's easy to create full patrol-records to search through (it adds about 50 GB per year).
Having a patrol-archive makes it very easy to search for certain strings (like great project), and create a list of accounts to ban.

I think the spambot takes random titles from other threads, like Bitcoin SCAM!. They use different titles too.
Mods, these Newbies have posted "FREE Pump-Signals +200% profits", please nuke them:
    1. ylalamof1983
     2. guthedera1988
     3. wardwindworkta1971
     4. berkthirsmesni1970
     5. sicoguato1985
     6. melsmotisi1989
     7. camilropoun1973
     8. laucrusoptu1973
     9. prolinalac1971
    10. schoolacammer1985
    11. lfootnososo1973
All banned!

I expect to post a much longer list tomorrow.

Disclaimer:
It is possible a Newbie was dumb enough to quote the spam, in that case it's a false positive. But considering their join date, that's very unlikely.

[Quickseller]

I would speculate whoever is ultimately behind this spambot is using something similar to mTurk to have people create accounts from a diverse IP address, and solve the recaptcha from the same.

[sapta]

I've nuked more than 30 of them. They're still going.

And this one is not a newb:

🚀 FREE Pump-Signals +200% profits  ✅ We all Buy the same Coin to Pump it !  ❌ NO VIP   🗣 Over 4.000 members  👉👉👉     Click here to Join us

[LoyceV]

And this one is not a newb:

Unfortunately, patrol doesn't show those.

[sapta]

And this one is not a newb:

Unfortunately, patrol doesn't show those.

I'm watching the page carefully and that one seems to be the only one that came from a non-newbie account.

[pugman]

I have 2 questions:

1. How do they bypass cloudfare? And

2. What do they get from this? Got my answer:

Last think my "informant" told me was bumping rates are around $1000 per week. Spam is big business, and most ICOs are shady money grabbers anyway, so they don't care.

[Welsh]

I'm watching the page carefully and that one seems to be the only one that came from a non-newbie account.

Yeah, this isn't something that is exclusive to new accounts. It's been happening a while with higher ranked accounts too. I've personally seen several full members, and reported them in the past.

[sapta]

I have 2 questions:

1. How do they bypass cloudfare? And

2. What do they get from this? Got my answer:

Last think my "informant" told me was bumping rates are around $1000 per week. Spam is big business, and most ICOs are shady money grabbers anyway, so they don't care.

1. It's tricky but what QS said above might be possible.

2. Heard something from the street it's around 2 ETH for 20 pages of shitty discussion.

Yeah, this isn't something that is exclusive to new accounts. It's been happening a while with higher ranked accounts too. I've personally seen several full members, and reported them in the past.

It seems like they're pausing at the moment.

[mdayonliner]

Just 6? I've seen like 600 accounts involved in spamming similar to this (last January).

Yes those popped up on my email. I am not a data center like you 

I think it's a bot that spams the same message on many accounts, to make it harder to nuke them all. And if the account survives, it just continues spamming the next day.

Yes, that's the whole concept behind creating multiple accounts and they are doing it well I guess.

Anyway I have seen the patrol page but never used it so I don't think I got rest lot that you and BitRentX was having. But I did understand that BitRentX banned some accounts which is good.

These spammers need to know that things are being monitored and they can not escape anymore.

1. How do they bypass cloudfare?

"We also block threats and limit abusive bots and crawlers from wasting your bandwidth and server resources.

Looking at this image and the quoted contents - I do not think cloudfare do much against bots. They only put some limits. May be these bots are designed having these limits in mind.

[Thirdspace]

Looking at this image and the quoted contents - I do not think cloudfare do much against bots. They only put some limits. May be these bots are designed having these limits in mind.

I think posting bots are not deemed abusive by cloudflare, unless it's posting every second
and posting every second won't be possible because of the forum's limit on posting
so all cloudflare can do is protecting forum from DDoS and limiting user connected from blacklisted IP

the possible way to fight against bots, dislikes by most users, is by adding captcha for posting
but bots would also implement captcha decoder bots
I'm afraid there's no silver bullet in the fight against bots and spammers

[cuong1610]

So the easier way for me to report the posts which I will do after posting this however I wanted to bring it in your attention.

I have my email notification ON for several boards which I watch of-course. This is something I noticed when I checked my email...

In 20 minutes same topic were posted (Looking a the topic title). I thought this is usual spambot and same user was posting it. When I was checking the topics to report then I realized that contents are same but the accounts are not!!! Have a look (I archived all for reference)

nencipitua1982 ==> http://archive.is/2EveB

pogenpuvir1983 ==> http://archive.is/e1Xzi

arpsicsubscons1977 ==> http://archive.is/TR0g4

tiasicafou1974 ==> http://archive.is/qveGV

spamretlialter1976 ==> http://archive.is/kfgCL

seytendxihu1989 ==> http://archive.is/Yr5IJ

6 different users but the contents are the same!

After looking at their registration time I noticed 3 of them were created yesterday (arpsicsubscons1977, pogenpuvir1983 and seytendxihu1989 on July 06, 2018, 11:53:10 AM - July 06, 2018, 11:55:02 AM and July 06, 2018, 12:06:01 PM respectively) and other 3 were created today (tiasicafou1974, spamretlialter1976, nencipitua1982 on Today at 01:20:43 PM - Today at 01:24:19 PM - Today at 01:38:59 PM respectively).

So, looks like each day this person or company is creating 3 accounts to spam the same contents in different boards. May be they are using a new type of spambot to spam the forum with new strategy.  My question is/are...

How do they do it - Don't they get caught with evil IP score?
Aren't they breaking any rule to get banned? If we don't have any rule against them then Isn't it right thing to ban them?


This is really a big issue for the forum and we need to stop it.

This is the first time I have seen such things. It is unbelievable that this can happen on the forum. And how do they do it?
Report all of them

[TheQuin]

Looking at this image and the quoted contents - I do not think cloudfare do much against bots. They only put some limits. May be these bots are designed having these limits in mind.

As someone who works for a gambling site with a faucet, I can tell you that Cloudflare provides no protection against botnets whatsoever. The evil IP system and captcha won't help either as these guys have access to massive pools of IP addresses and captcha solvers.

[bitart]

...
Report all of them

As long as they use bots (programmed computers) to spam continously, reporting is like fighting a forest fire with a child's water gun...

I'm wondering if it's possible to check automatically if a post was posted already? In this case spammers couldn't post the same post in every topic, at least they would need to modify it a bit... so it's still not the perfect solution...