Account farming. Allowed? - page 14.

Lauda

legendary

Activity: 2674

Merit: 3000

Terminated.

Quote from: rizzlarolla on October 24, 2016, 05:55:23 AM

So am I assured "they are all banned"? No, they clearly weren't/aren't.

The bot is based on account creation patterns and posting patterns. Obviously there are going to be patterns that haven't been discovered/added to the bot.

Quote from: rizzlarolla on October 24, 2016, 05:55:23 AM

Can we have a serious explanation on "nuking" being different to banning?

Again, nuking (only applies to newbies or brand new): Permanent ban + IP ban + deletion of all posts + clearing of profile. Ban: Permanent ban + clearing of profile.

Quote from: rizzlarolla on October 24, 2016, 05:55:23 AM

We (researchers) really need to be able to see who is/is not banned.

You'd have to take that up to Cyrus and Theymos.

Quote from: rizzlarolla on October 24, 2016, 05:55:23 AM

Heavy account farmers are by default sig spammers. I am not interested in non farmed sig spammers - different issue.

Which is a bigger issue IMO and that's why the other reports should be moved onto another thread, as they tackle a different issue. Dormant backlink bots aren't causing any *real harm*.

rizzlarolla

hero member

Activity: 812

Merit: 1001

Quote from: Lauda on October 24, 2016, 05:22:10 AM

Quote from: Timelord2067 on October 24, 2016, 12:45:50 AM

down to

Code:

fiza

Code:

Tampa

Handled both of these. I think that you should create your own thread as this is different than the intended accounts being reported. These are usually spambots (backlink spam and whatnot), while OP started reporting sig. spammers and heavy account farmers.

This does look like 2 different issuues. We are on a learning curve here.

From bbb.reporter thread,

Quote from: Lauda on August 23, 2016, 01:12:59 PM

Quote from: rizzlarolla on August 23, 2016, 12:52:32 PM

In Oct 2015 (rough figures as guide, impossible for me to study properly) created accounts consist mainly of (or i was just very lucky to "hit" target)
Accounts between 572000 and 575000 are "btcRDkill_"
Accounts between575000 and 600200 are "MrFudged1_"
Accounts between 600200 and 625000 are "KNC_areThief"

That was a wave of spam accounts by the same person. We have been manually banning them back then (I remember having a 5 second refresh timer on the member page) and then the situation started to calm down as we've started using a bot to do it for us. They are a thing of the past (for now).

Quote from: Mitchell on August 23, 2016, 02:10:28 PM

I can assure you that those accounts have been banned. Only the staff can see if a user is banned or not.

Anyway, moderators cannot ban members (because of how SMF ACL's system is build), only global moderators can, so we, as normal staff, really can't do anything. There is just one exception: Newbies. Those members can be nuked (but not banned) by Patrollers, which we have done with those MMMGlobal and KNC accounts (and of course the bot helped a great deal).

So am I assured "they are all banned"? No, they clearly weren't/aren't.
Can we have a serious explanation on "nuking" being different to banning?

We (researchers) really need to be able to see who is/is not banned.

Quote from: Lauda on October 24, 2016, 05:22:10 AM

... while OP started reporting sig. spammers and heavy account farmers.

Nearly correct. OP does not report sig spammers here, only heavy account farmers.
Heavy account farmers by default turn into sig spammers. I am not interested in non farmed sig spammers - different issue.

Lauda

legendary

Activity: 2674

Merit: 3000

Terminated.

Quote from: Timelord2067 on October 24, 2016, 12:45:50 AM

down to

Code:

fiza

Code:

Tampa

Handled both of these. I think that you should create your own thread as this is different than the intended accounts being reported. These are usually spambots (backlink spam and whatnot), while OP started reporting sig. spammers and heavy account farmers.

This thread is too big as it is.

Timelord2067

legendary

Activity: 3696

Merit: 2219

💲🏎️💨🚓

*edit* Post moved to Spambots thread - will remove this post in a couple of days .

Timelord2067

legendary

Activity: 3696

Merit: 2219

💲🏎️💨🚓

Quote from: Lauda on October 24, 2016, 04:16:57 AM

Quote from: Timelord2067 on October 24, 2016, 04:13:15 AM

Almost all have email details in the MSN section that fit into the same pattern as above, so they haven't been "Nuked" - I'd prefer it if they were all deleted which is an option in "Simple Machines Forum"

This option is not available to any kind of moderator I believe. The administrators are likely the only one with access to it (if it exists). The best that moderators can do is 'nuke' and that seems pretty adequate.

I don't feel killing a cancer one cell at a time is going to fix the solution, but I'll continue my efforts to find the other 95% of Alts, I think the 9,000 to 10,000 ( 1% of the 900,000 + registered users ) UID's in my last post plus the other 3.9% of all UID's in the previous posts is not a bad effort for one afternoon.

*edit* ported info to Spambots thread)

Lauda

legendary

Activity: 2674

Merit: 3000

Terminated.

Quote from: Timelord2067 on October 24, 2016, 04:13:15 AM

Almost all have email details in the MSN section that fit into the same pattern as above, so they haven't been "Nuked" - I'd prefer it if they were all deleted which is an option in "Simple Machines Forum"

This option is not available to any kind of moderator I believe. The administrators are likely the only one with access to it (if it exists). The best that moderators can do is 'nuke' and that seems pretty adequate.

Timelord2067

legendary

Activity: 3696

Merit: 2219

💲🏎️💨🚓

OK, so thinking caps on...

I searched the "Website" of users with

Code:

html

and got 300 pages (say nine thousand UID's)

Just the first page I spotted a repeating pattern "444" and found the html

Quote

http://www.r4card.org/r4-card-ds.html

so I stripped it down to

Code:

r4card.org

and searched "websites" and got

Code:

Offline 	nancygree444 				nancygree444 	nancygree444 	[email protected] 	Brand new 	2011-02-24 	0 	
Offline 	hildaflan333 				hildaflan333 	hildaflan333 	[email protected] 	Brand new 	2011-02-24 	0 	
Offline 	renekerber444 				renekerber444 	renekerber444 	[email protected] 	Brand new 	2011-02-27 	0 	
Offline 	carmwells333 				carmwells333 	carmwells333 	[email protected] 	Brand new 	2011-02-27 	0 	
Offline 	CandyGhoul 				CandyGhoul 	CandyGhoul 	[email protected] 	Brand new 	2011-03-30 	0 	
Offline 	Roder347 				Roder347 	Roder347 	[email protected] 	Brand new 	2011-05-17 	0 	
Offline 	Alice346 				Alice346 	Alice346 	[email protected] 	Brand new 	2011-05-17 	0 	
Offline 	Brant133 				Brant133 	Brant133 	[email protected] 	Brand new 	2011-06-12 	0

Four of the eight have

Code:

ConcettaRaferty

in their MSN section...

searching with all options we find a total of eight UID's that have concettaraferty in their MSN

Code:

Offline 	renekerber444 				renekerber444 	renekerber444 	[email protected] 	Brand new 	2011-02-27 	0 	
Offline 	CandyGhoul 				CandyGhoul 	CandyGhoul 	[email protected] 	Brand new 	2011-03-30 	0 	
Offline 	Roder347 				Roder347 	Roder347 	[email protected] 	Brand new 	2011-05-17 	0 	
Offline 	Souza357 				Souza357 	Souza357 	[email protected] 	Brand new 	2011-05-21 	0 	
Offline 	Willoughby367 				Willoughby367 	Willoughby367 	[email protected] 	Brand new 	2011-05-25 	0 	
Offline 	Steven903 				Steven903 	Steven903 	[email protected] 	Brand new 	2011-05-30 	0 	
Offline 	Brant133 				Brant133 	Brant133 	[email protected] 	Brand new 	2011-06-12 	0 	
Offline 	Heather155 				Heather155 	Heather155 	[email protected] 	Brand new 	2011-06-15 	0

Searching the other four emails we find

Code:

GladysCaulton

Offline 	nancygree444 				nancygree444 	nancygree444 	[email protected] 	Brand new 	2011-02-24 	0 	
Offline 	Tube123 				Tube123 	Tube123 	[email protected] 	Brand new 	2011-04-16 	0 	
Offline 	nancygree117 				nancygree117 	nancygree117 	[email protected] 	Brand new 	2011-04-18 	0

Code:

WendieMackey

Offline 	hildaflan333 				hildaflan333 	hildaflan333 	[email protected] 	Brand new 	2011-02-24 	0

Code:

MauricePutno

Offline 	carmwells333 				carmwells333 	carmwells333 	[email protected] 	Brand new 	2011-02-27 	0 	
Offline 	carmwells117 				carmwells117 	carmwells117 	[email protected] 	Brand new 	2011-04-19 	0

Code:

LashellTenny

Offline 	earllmoran999 				earllmoran999 	earllmoran999 	[email protected] 	Brand new 	2011-04-11 	0 	
Offline 	Alice346 				Alice346 	Alice346 	[email protected] 	Brand new 	2011-05-17 	0 	
Offline 	Scott356 				Scott356 	Scott356 	[email protected] 	Brand new 	2011-05-20 	0 	
Offline 	Stephen333 				Stephen333 	Stephen333 	[email protected] 	Brand new 	2011-05-23 	0 	
Offline 	Hoffman366 				Hoffman366 	Hoffman366 	[email protected] 	Brand new 	2011-05-25 	0 	
Offline 	Bishop901 				Bishop901 	Bishop901 	[email protected] 	Brand new 	2011-05-29 	0 	
Offline 	Erin456 				Erin456 	Erin456 	[email protected] 	Brand new 	2011-05-30 	0 	
Offline 	Chad912 				Chad912 	Chad912 	[email protected] 	Brand new 	2011-06-02 	0 	
Offline 	Nicholas932 				Nicholas932 	Nicholas932 	[email protected] 	Brand new 	2011-06-06 	0 	
Offline 	Daniels689 				Daniels689 	Daniels689 	[email protected] 	Brand new 	2011-06-09 	0 	
Offline 	Harms567 				Harms567 	Harms567 	[email protected] 	Brand new 	2011-06-09 	0 	
Offline 	Coppola132 				Coppola132 	Coppola132 	[email protected] 	Brand new 	2011-06-12 	0

Searching

Code:

Nets 18 pages ( ~ 540 UID's ) nearly 2/3 on the first page are "brand new" going back to 2010

Code:

Nets 33 pages ( ~ 1,000 UID's ) same again nearly 2/3 on the first page are "brand new" going back to 2010

Almost all have email details in the MSN section that fit into the same pattern as above, so they haven't been "Nuked" - I'd prefer it if they were all deleted which is an option in "Simple Machines Forum"

LoyceV

legendary

Activity: 3290

Merit: 16489

Thick-Skinned Gang Leader and Golden Feather 2021

Quote from: Lauda on October 24, 2016, 12:05:33 AM

Quote from: Timelord2067 on October 24, 2016, 12:03:28 AM

There are one thousand, one hundred and seventy-three pages of members with the "website"

Code:

MMM Global

in their profile...

((1,172 X 30) + 22 = 35,182 )

Those were (or are) spam and were usually nuked on sight (after they posted). After realizing that, some probably kept registering without posting. If you can compile a list of links, we could nuke them ~~relatively easy~~[1] (even though they aren't/won't cause harm).

Update: [1] Re-read the post and realized it's 35 thousand.

I can do this, if you can nuke that many accounts at once. Do you have cluster-nukes to nuke'm all, or would you have to do them one by one?

Quote from: Lauda on October 24, 2016, 01:18:17 AM

but 30k accounts is overkill for a single patroller.

So no cluster nukes Sad

A!

full member

Activity: 155

Merit: 100

This accounts are created by a bot called xrumer. This software has capacity to create up to 10,000 accounts in one hour. This software can solve captha, it has built in captcha solver. It can solve 500 different kinds of captcha even recaptcha. It can also answer textual captha, the program has 170,000 answers. Their goal is only to get backlinks to their website/clients.

Lauda

legendary

Activity: 2674

Merit: 3000

Terminated.

Quote from: Timelord2067 on October 24, 2016, 01:15:47 AM

Ah ok, so they just show up as "brand new", so now we can find them and someone may have already done something?

This is usually used just to combat spam that does get reported. Obviously moderators don't have time to keep track of each and every registered member. If the profile page is not clean, that still may not mean that they are not banned (this change happened sometime in 2016 IIRC). I'd tackle that MMM spam, but 30k accounts is overkill for a single patroller. I've looked into this a bit, there are some people with higher ranks still posting with that.

If you find some other patterns with reasonable quantities (maybe under 1k accounts) you can PM me directly.

Timelord2067

legendary

Activity: 3696

Merit: 2219

💲🏎️💨🚓

Quote from: Lauda on October 24, 2016, 01:12:35 AM

Quote from: Timelord2067 on October 24, 2016, 01:11:32 AM

What exactly does Nuked mean?

Permanent ban + IP ban + removal of all profile information. Patrollers are able to nuke newbies, administrators and some global moderators are able to apply temporary and permanent bans to all members.

Ah ok, so they just show up as "brand new", so now we can find them and someone may have already done something?

Quote from: TwitchySeal on October 24, 2016, 01:13:38 AM

Quote from: Timelord2067 on October 24, 2016, 01:11:32 AM

What exactly does Nuked mean?

She killed them with nuclear weapons. (or warmed them up in the microwave)

We can only hope... Roll Eyes

TwitchySeal

legendary

Activity: 2716

Merit: 2093

Join the world-leading crypto sportsbook NOW!

Quote from: Timelord2067 on October 24, 2016, 01:11:32 AM

What exactly does Nuked mean?

She killed them with nuclear weapons. (or warmed them up in the microwave)

Lauda

legendary

Activity: 2674

Merit: 3000

Terminated.

Quote from: Timelord2067 on October 24, 2016, 01:11:32 AM

What exactly does Nuked mean?

Permanent ban + IP ban + removal of all profile information. Patrollers are able to nuke newbies, administrators and some global moderators are able to apply temporary and permanent bans to all members.

Quote from: TwitchySeal on October 24, 2016, 01:13:38 AM

She killed them with nuclear weapons. (or warmed them up in the microwave)

Or it could mean this. I may be a cat wielding nuclear weapons.

Timelord2067

legendary

Activity: 3696

Merit: 2219

💲🏎️💨🚓

What exactly does Nuked mean?

https://bitcointalksearch.org/user/elissawint-429047

Code:

Name: 	ElissaWint
Posts: 	0
Activity: 	0
Position: 	Brand new
Date Registered: 	01 February 2015, 19:51:17
Last Active: 	01 February 2015, 19:51:18

Is still there... with out the "Website" %title%, but still there...

Lauda

legendary

Activity: 2674

Merit: 3000

Terminated.

Quote from: Timelord2067 on October 24, 2016, 12:45:50 AM

Code:

%title%

in the "website" nets us three pages of Zombie Alts ^TM

I've just nuked all of them. They seem to be linking to weird websites, although I've found no malware on them (Example - click on your own risk). A fair number of them were proxybanned as well. A few were banned, but bans didn't remove profile information in the past.

Quote from: Timelord2067 on October 24, 2016, 12:45:50 AM

Not one of the sixty five %title% UID's has been active since registering...

That's usually how standard bots operate on this forum, the difference is that these do not post but spam via profile information.

Timelord2067

legendary

Activity: 3696

Merit: 2219

💲🏎️💨🚓

As you can see from above, as far back as mid 2011 there has been a concerted effort to farm accounts on an industrial scale here at BCT.

Having set up a couple of Forums (with Simple Machine Forum's protocol ) as well as being a global moderator of the SexCoin forum over yonder at https://sexcoinforum.com/index.php the management here could do a couple of things:

Disable registration of new accounts for a period of one week to one month *minimum* (be honest, how many new users are out there at the moment?
Log every person out
Every person has to change their password
Every person re-logging in must provide a valid email address which is verified before they continue
All accounts auto logged out after one week continuous log in.
New users must register with a valid email address
Word captures - they're built into "Simple Machine Forum" - prove they're human
IP matching - duh can't be done! duh!
IP's and email's at a domain level can be banned. Go ahead and use them.
Haven't logged in for one month / six months what ever, UID is flagged
Be open to listening to suggestions from multiple sources...

to name but a few.

Timelord2067

legendary

Activity: 3696

Merit: 2219

💲🏎️💨🚓

Quote from: Arrakeen on October 24, 2016, 12:14:46 AM

rizzlarolla, Timelord2067 -

Seriously, are you guys wizards or what?! How do you so easily spot fake accounts & what is this talk about 'alphabet lists'? Genuinely curious here. By alphabet lists, do you mean the farmer(s) create new accounts based on the next available free letter in the (farmed) handle?

And speaking of MMM - I can't believe that shit is still around. But then again, I just found their youtube channel and can't look away - I guess Nigerians prey upon themselves as much as they do the rest of the world, eh?

Keep up the good work

I'll show you how easy it is to find these Zombie Accounts ^TM...

Above we have

Code:

Offline 	wania149 		Set up a company in Australia 					Brand new 	2013-06-13 	0

which we trim down to

Code:

company in Australia

Nets us:

Code:

Offline 	fiza9829 		Set up a company in Australia 					Brand new 	2013-03-22 	0 	
Offline 	wania149 		Set up a company in Australia 					Brand new 	2013-06-13 	0

The dates and name styles are very similar, so we trim

Code:

fiza9829

down to

Code:

fiza

and we net the following:

*edit* samples removed

As I've said before, there's Australian place names, there's also Florida place names ie

Code:

Tampa Party Rentals

which we trim down to

Code:

Tampa

, we get four pages (I stress not all of these are Zombie Alts ^TM )

*edit* samples removed

So, then we find a clear pattern with

Code:

%title%

in the "website" nets us three pages of Zombie Alts ^TM

*edit* samples removed

Not one of the sixty five %title% UID's has been active since registering...

So, that's nearly 4% of all BCT UID's I've just identified in one post as being Zombie Alts ^TM, time to get back to work...

Timelord2067

legendary

Activity: 3696

Merit: 2219

💲🏎️💨🚓

Quote from: Lauda on October 24, 2016, 12:05:33 AM

Quote from: Timelord2067 on October 24, 2016, 12:03:28 AM

There are one thousand, one hundred and seventy-three pages of members with the "website"

Code:

MMM Global

in their profile...

((1,172 X 30) + 22 = 35,182 )

Those were (or are) spam and were usually nuked on sight (after they posted). After realizing that, some probably kept registering without posting. If you can compile a list of links, we could nuke them ~~relatively easy~~[1] (even though they aren't/won't cause harm).

Update: [1] Re-read the post and realized it's 35 thousand.

That's why I spelt it out... Wink

Arrakeen

hero member

Activity: 532

Merit: 500

Offer escrow, receive negative trust

rizzlarolla, Timelord2067 -

Seriously, are you guys wizards or what?! How do you so easily spot fake accounts & what is this talk about 'alphabet lists'? Genuinely curious here. By alphabet lists, do you mean the farmer(s) create new accounts based on the next available free letter in the (farmed) handle?

And speaking of MMM - I can't believe that shit is still around. But then again, I just found their youtube channel and can't look away - I guess Nigerians prey upon themselves as much as they do the rest of the world, eh?

Keep up the good work

Timelord2067

legendary

Activity: 3696

Merit: 2219

💲🏎️💨🚓

Quote from: Timelord2067 on October 24, 2016, 12:03:28 AM

There are one thousand, one hundred and seventy-three pages of members with the "website"

Code:

MMM Global

in their profile...

((1,172 X 30) + 22 = 35,182 ) Thirty-Two thousand, one hundred and eighty-two members all with the same "Web Site" in their profile page's listing.

We have just ticked over profile number https://bitcointalksearch.org/user/nensalmendela-912093

Code:

Name: 	nensalmendela
Posts: 	0
Activity: 	0
Position: 	Newbie
Date Registered: 	Today at 15:09:30
Last Active: 	Today at 15:09:30

That's 3.85% of *all* users of BitCoin Talk have MMM Global in their profile.

Topic: Account farming. Allowed? - page 14. (Read 51937 times)