Pages:
Author

Topic: Account farming. Allowed? - page 14. (Read 51912 times)

legendary
Activity: 2674
Merit: 2965
Terminated.
October 24, 2016, 06:00:05 AM
So am I assured "they are all banned"? No, they clearly weren't/aren't.
The bot is based on account creation patterns and posting patterns. Obviously there are going to be patterns that haven't been discovered/added to the bot.

Can we have a serious explanation on "nuking" being different to banning?
Again, nuking (only applies to newbies or brand new): Permanent ban + IP ban + deletion of all posts + clearing of profile. Ban: Permanent ban + clearing of profile.

We (researchers) really need to be able to see who is/is not banned.
You'd have to take that up to Cyrus and Theymos.

Heavy account farmers are by default sig spammers. I am not interested in non farmed sig spammers - different issue.
Which is a bigger issue IMO and that's why the other reports should be moved onto another thread, as they tackle a different issue. Dormant backlink bots aren't causing any *real harm*.
hero member
Activity: 812
Merit: 1001
October 24, 2016, 05:55:23 AM
down to
Code:
fiza


Code:
Tampa
Handled both of these. I think that you should create your own thread as this is different than the intended accounts being reported. These are usually spambots (backlink spam and whatnot), while OP started reporting sig. spammers and heavy account farmers.

This does look like 2 different issuues. We are on a learning curve here.

From bbb.reporter thread,

In Oct 2015 (rough figures as guide, impossible for me to study properly) created accounts consist mainly of (or i was just very lucky to "hit" target)
Accounts between 572000 and 575000 are "btcRDkill_"
Accounts between575000 and 600200 are "MrFudged1_"
Accounts between 600200 and 625000 are "KNC_areThief"
That was a wave of spam accounts by the same person. We have been manually banning them back then (I remember having a 5 second refresh timer on the member page) and then the situation started to calm down as we've started using a bot to do it for us. They are a thing of the past (for now).

I can assure you that those accounts have been banned. Only the staff can see if a user is banned or not.

Anyway, moderators cannot ban members (because of how SMF ACL's system is build), only global moderators can, so we, as normal staff, really can't do anything. There is just one exception: Newbies. Those members can be nuked (but not banned) by Patrollers, which we have done with those MMMGlobal and KNC accounts (and of course the bot helped a great deal).

So am I assured "they are all banned"? No, they clearly weren't/aren't.
Can we have a serious explanation on "nuking" being different to banning?

We (researchers) really need to be able to see who is/is not banned.

... while OP started reporting sig. spammers and heavy account farmers.


Nearly correct. OP does not report sig spammers here, only heavy account farmers.
Heavy account farmers by default turn into sig spammers. I am not interested in non farmed sig spammers - different issue.
legendary
Activity: 2674
Merit: 2965
Terminated.
October 24, 2016, 05:22:10 AM
down to
Code:
fiza


Code:
Tampa
Handled both of these. I think that you should create your own thread as this is different than the intended accounts being reported. These are usually spambots (backlink spam and whatnot), while OP started reporting sig. spammers and heavy account farmers.

This thread is too big as it is.
legendary
Activity: 3696
Merit: 2219
💲🏎️💨🚓
October 24, 2016, 04:48:10 AM
*edit* Post moved to Spambots thread - will remove this post in a couple of days .
legendary
Activity: 3696
Merit: 2219
💲🏎️💨🚓
October 24, 2016, 04:32:00 AM
Almost all have email details in the MSN section that fit into the same pattern as above, so they haven't been "Nuked" - I'd prefer it if they were all deleted which is an option in "Simple Machines Forum"
This option is not available to any kind of moderator I believe. The administrators are likely the only one with access to it (if it exists). The best that moderators can do is 'nuke' and that seems pretty adequate.

I don't feel killing a cancer one cell at a time is going to fix the solution, but I'll continue my efforts to find the other 95% of Alts, I think the 9,000 to 10,000 ( 1% of the 900,000 + registered users ) UID's in my last post plus the other 3.9% of all UID's in the previous posts is not a bad effort for one afternoon.

*edit* ported info to Spambots thread)
legendary
Activity: 2674
Merit: 2965
Terminated.
October 24, 2016, 04:16:57 AM
Almost all have email details in the MSN section that fit into the same pattern as above, so they haven't been "Nuked" - I'd prefer it if they were all deleted which is an option in "Simple Machines Forum"
This option is not available to any kind of moderator I believe. The administrators are likely the only one with access to it (if it exists). The best that moderators can do is 'nuke' and that seems pretty adequate.
legendary
Activity: 3696
Merit: 2219
💲🏎️💨🚓
October 24, 2016, 04:13:15 AM
OK, so thinking caps on...

I searched the "Website" of users with

Code:
html

and got 300 pages (say nine thousand UID's)

Just the first page I spotted a repeating pattern "444" and found the html

Quote

so I stripped it down to

Code:
r4card.org

and searched "websites" and got

Code:
Offline 	nancygree444 				nancygree444 	nancygree444 	[email protected] 	Brand new 	2011-02-24 	0 	
Offline hildaflan333 hildaflan333 hildaflan333 [email protected] Brand new 2011-02-24 0
Offline renekerber444 renekerber444 renekerber444 [email protected] Brand new 2011-02-27 0
Offline carmwells333 carmwells333 carmwells333 [email protected] Brand new 2011-02-27 0
Offline CandyGhoul CandyGhoul CandyGhoul [email protected] Brand new 2011-03-30 0
Offline Roder347 Roder347 Roder347 [email protected] Brand new 2011-05-17 0
Offline Alice346 Alice346 Alice346 [email protected] Brand new 2011-05-17 0
Offline Brant133 Brant133 Brant133 [email protected] Brand new 2011-06-12 0

Four of the eight have

Code:
ConcettaRaferty

in their MSN section...

searching with all options we find a total of eight UID's that have concettaraferty in their MSN

Code:
Offline 	renekerber444 				renekerber444 	renekerber444 	[email protected] 	Brand new 	2011-02-27 	0 	
Offline CandyGhoul CandyGhoul CandyGhoul [email protected] Brand new 2011-03-30 0
Offline Roder347 Roder347 Roder347 [email protected] Brand new 2011-05-17 0
Offline Souza357 Souza357 Souza357 [email protected] Brand new 2011-05-21 0
Offline Willoughby367 Willoughby367 Willoughby367 [email protected] Brand new 2011-05-25 0
Offline Steven903 Steven903 Steven903 [email protected] Brand new 2011-05-30 0
Offline Brant133 Brant133 Brant133 [email protected] Brand new 2011-06-12 0
Offline Heather155 Heather155 Heather155 [email protected] Brand new 2011-06-15 0

Searching the other four emails we find

Code:
GladysCaulton

Offline nancygree444 nancygree444 nancygree444 [email protected] Brand new 2011-02-24 0
Offline Tube123 Tube123 Tube123 [email protected] Brand new 2011-04-16 0
Offline nancygree117 nancygree117 nancygree117 [email protected] Brand new 2011-04-18 0

Code:
WendieMackey

Offline hildaflan333 hildaflan333 hildaflan333 [email protected] Brand new 2011-02-24 0

Code:
MauricePutno

Offline carmwells333 carmwells333 carmwells333 [email protected] Brand new 2011-02-27 0
Offline carmwells117 carmwells117 carmwells117 [email protected] Brand new 2011-04-19 0

Code:
LashellTenny

Offline earllmoran999 earllmoran999 earllmoran999 [email protected] Brand new 2011-04-11 0
Offline Alice346 Alice346 Alice346 [email protected] Brand new 2011-05-17 0
Offline Scott356 Scott356 Scott356 [email protected] Brand new 2011-05-20 0
Offline Stephen333 Stephen333 Stephen333 [email protected] Brand new 2011-05-23 0
Offline Hoffman366 Hoffman366 Hoffman366 [email protected] Brand new 2011-05-25 0
Offline Bishop901 Bishop901 Bishop901 [email protected] Brand new 2011-05-29 0
Offline Erin456 Erin456 Erin456 [email protected] Brand new 2011-05-30 0
Offline Chad912 Chad912 Chad912 [email protected] Brand new 2011-06-02 0
Offline Nicholas932 Nicholas932 Nicholas932 [email protected] Brand new 2011-06-06 0
Offline Daniels689 Daniels689 Daniels689 [email protected] Brand new 2011-06-09 0
Offline Harms567 Harms567 Harms567 [email protected] Brand new 2011-06-09 0
Offline Coppola132 Coppola132 Coppola132 [email protected] Brand new 2011-06-12 0

Searching

Code:
444

Nets 18 pages ( ~ 540 UID's ) nearly 2/3 on the first page are "brand new" going back to 2010

Code:
333

Nets 33 pages ( ~ 1,000 UID's ) same again nearly 2/3 on the first page are "brand new" going back to 2010

Almost all have email details in the MSN section that fit into the same pattern as above, so they haven't been "Nuked" - I'd prefer it if they were all deleted which is an option in "Simple Machines Forum"
legendary
Activity: 3290
Merit: 16489
Thick-Skinned Gang Leader and Golden Feather 2021
October 24, 2016, 03:21:33 AM
There are one thousand, one hundred and seventy-three pages of members with the "website"

Code:
MMM Global

in their profile...

((1,172 X 30) + 22 = 35,182 )
Those were (or are) spam and were usually nuked on sight (after they posted). After realizing that, some probably kept registering without posting. If you can compile a list of links, we could nuke them relatively easy[1] (even though they aren't/won't cause harm).

Update: [1] Re-read the post and realized it's 35 thousand.
I can do this, if you can nuke that many accounts at once. Do you have cluster-nukes to nuke'm all, or would you have to do them one by one?

but 30k accounts is overkill for a single patroller.
So no cluster nukes Sad
A!
full member
Activity: 155
Merit: 100
October 24, 2016, 01:45:43 AM
This accounts are created by a bot called xrumer. This software has capacity to create up to 10,000 accounts in one hour. This software can solve captha, it has built in captcha solver. It can solve 500 different kinds of captcha even recaptcha. It can also answer textual captha, the program has 170,000 answers. Their goal is only to get backlinks to their website/clients.
legendary
Activity: 2674
Merit: 2965
Terminated.
October 24, 2016, 01:18:17 AM
Ah ok, so they just show up as "brand new", so now we can find them and someone may have already done something?
This is usually used just to combat spam that does get reported. Obviously moderators don't have time to keep track of each and every registered member. If the profile page is not clean, that still may not mean that they are not banned (this change happened sometime in 2016 IIRC). I'd tackle that MMM spam, but 30k accounts is overkill for a single patroller. I've looked into this a bit, there are some people with higher ranks still posting with that.

If you find some other patterns with reasonable quantities (maybe under 1k accounts) you can PM me directly.
legendary
Activity: 3696
Merit: 2219
💲🏎️💨🚓
October 24, 2016, 01:15:47 AM
What exactly does Nuked mean?
Permanent ban + IP ban + removal of all profile information. Patrollers are able to nuke newbies, administrators and some global moderators are able to apply temporary and permanent bans to all members.

Ah ok, so they just show up as "brand new", so now we can find them and someone may have already done something?

What exactly does Nuked mean?
She killed them with nuclear weapons. (or warmed them up in the microwave)

We can only hope...  Roll Eyes
legendary
Activity: 2688
Merit: 2077
Join the world-leading crypto sportsbook NOW!
October 24, 2016, 01:13:38 AM
What exactly does Nuked mean?
She killed them with nuclear weapons. (or warmed them up in the microwave)
legendary
Activity: 2674
Merit: 2965
Terminated.
October 24, 2016, 01:12:35 AM
What exactly does Nuked mean?
Permanent ban + IP ban + removal of all profile information. Patrollers are able to nuke newbies, administrators and some global moderators are able to apply temporary and permanent bans to all members.

She killed them with nuclear weapons. (or warmed them up in the microwave)
Or it could mean this. I may be a cat wielding nuclear weapons.
legendary
Activity: 3696
Merit: 2219
💲🏎️💨🚓
October 24, 2016, 01:11:32 AM
What exactly does Nuked mean?

https://bitcointalksearch.org/user/elissawint-429047

Code:
Name: 	ElissaWint
Posts: 0
Activity: 0
Position: Brand new
Date Registered: 01 February 2015, 19:51:17
Last Active: 01 February 2015, 19:51:18

Is still there... with out the "Website" %title%, but still there...
legendary
Activity: 2674
Merit: 2965
Terminated.
October 24, 2016, 01:07:54 AM
Code:
%title%
in the "website" nets us three pages of Zombie Alts TM
I've just nuked all of them. They seem to be linking to weird websites, although I've found no malware on them (Example - click on your own risk). A fair number of them were proxybanned as well. A few were banned, but bans didn't remove profile information in the past.

Not one of the sixty five %title% UID's has been active since registering...
That's usually how standard bots operate on this forum, the difference is that these do not post but spam via profile information.
legendary
Activity: 3696
Merit: 2219
💲🏎️💨🚓
October 24, 2016, 01:05:48 AM
As you can see from above, as far back as mid 2011 there has been a concerted effort to farm accounts on an industrial scale here at BCT.

Having set up a couple of Forums (with Simple Machine Forum's protocol ) as well as being a global moderator of the SexCoin forum over yonder at https://sexcoinforum.com/index.php the management here could do a couple of things:

  • Disable registration of new accounts for a period of one week to one month *minimum* (be honest, how many new users are out there at the moment?
  • Log every person out
  • Every person has to change their password
  • Every person re-logging in must provide a valid email address which is verified before they continue
  • All accounts auto logged out after one week continuous log in.
  • New users must register with a valid email address
  • Word captures - they're built into "Simple Machine Forum" - prove they're human
  • IP matching - duh can't be done! duh!
  • IP's and email's at a domain level can be banned.  Go ahead and use them.
  • Haven't logged in for one month / six months what ever, UID is flagged
  • Be open to listening to suggestions from multiple sources...

to name but a few.
legendary
Activity: 3696
Merit: 2219
💲🏎️💨🚓
October 24, 2016, 12:45:50 AM
rizzlarolla, Timelord2067 -

Seriously, are you guys wizards or what?!  How do you so easily spot fake accounts & what is this talk about 'alphabet lists'?  Genuinely curious here.  By alphabet lists, do you mean the farmer(s) create new accounts based on the next available free letter in the (farmed) handle?

And speaking of MMM - I can't believe that shit is still around. But then again, I just found their youtube channel and can't look away - I guess Nigerians prey upon themselves as much as they do the rest of the world, eh?

Keep up the good work Smiley

I'll show you how easy it is to find these Zombie Accounts TM...

Above we have

Code:
Offline 	wania149 		Set up a company in Australia 					Brand new 	2013-06-13 	0 	

which we trim down to

Code:
company in Australia

Nets us:

Code:
Offline 	fiza9829 		Set up a company in Australia 					Brand new 	2013-03-22 	0 	
Offline wania149 Set up a company in Australia Brand new 2013-06-13 0

The dates and name styles are very similar, so we trim
Code:
fiza9829
down to
Code:
fiza
and we net the following:

*edit* samples removed

As I've said before, there's Australian place names, there's also Florida place names ie

Code:
Tampa Party Rentals

which we trim down to
Code:
Tampa
, we get four pages (I stress not all of these are Zombie Alts TM )

*edit* samples removed

So, then we find a clear pattern with

Code:
%title%

in the "website" nets us three pages of Zombie Alts TM

*edit* samples removed

Not one of the sixty five %title% UID's has been active since registering...

So, that's nearly 4% of all BCT UID's I've just identified in one post as being Zombie Alts TM, time to get back to work...
legendary
Activity: 3696
Merit: 2219
💲🏎️💨🚓
October 24, 2016, 12:15:05 AM
There are one thousand, one hundred and seventy-three pages of members with the "website"

Code:
MMM Global

in their profile...

((1,172 X 30) + 22 = 35,182 )
Those were (or are) spam and were usually nuked on sight (after they posted). After realizing that, some probably kept registering without posting. If you can compile a list of links, we could nuke them relatively easy[1] (even though they aren't/won't cause harm).

Update: [1] Re-read the post and realized it's 35 thousand.

That's why I spelt it out... Wink
hero member
Activity: 532
Merit: 500
Offer escrow, receive negative trust
October 24, 2016, 12:14:46 AM
rizzlarolla, Timelord2067 -

Seriously, are you guys wizards or what?!  How do you so easily spot fake accounts & what is this talk about 'alphabet lists'?  Genuinely curious here.  By alphabet lists, do you mean the farmer(s) create new accounts based on the next available free letter in the (farmed) handle?

And speaking of MMM - I can't believe that shit is still around. But then again, I just found their youtube channel and can't look away - I guess Nigerians prey upon themselves as much as they do the rest of the world, eh?

Keep up the good work Smiley
legendary
Activity: 3696
Merit: 2219
💲🏎️💨🚓
October 24, 2016, 12:14:14 AM
There are one thousand, one hundred and seventy-three pages of members with the "website"

Code:
MMM Global

in their profile...

((1,172 X 30) + 22 = 35,182 ) Thirty-Two thousand, one hundred and eighty-two members all with the same "Web Site" in their profile page's listing.


We have just ticked over profile number https://bitcointalksearch.org/user/nensalmendela-912093

Code:
Name: 	nensalmendela
Posts: 0
Activity: 0
Position: Newbie
Date Registered: Today at 15:09:30
Last Active: Today at 15:09:30

That's 3.85% of *all* users of BitCoin Talk have MMM Global in their profile.
Pages:
Jump to: