Topic: Mprep battling virus posts (Read 311 times)

Phoenix miner did not have a website until a few months ago, after their github account got closed. The official one is https://phoenixminer.info
The .com one is older but not official. I guess just a website some guy made so people can find it easier. At that time they mostly relied on the forum and mega.nz, github and were both closed at some point in time. As long as you always verify the hash you should be OK downloading the binaries from almost anywhere.


The devs most likely did not want to spend too much time on the frontend of the website. Just a place to find the binaries and the checksums. Yeah, looks ugly but gets the job done I guess

If you want to see how bad the spam is: loyce.club/badposts/spam.html lists spam based on certain keywords.

Based on the OP, the .info domain is the only legit site.

While the rest are impostors or simply hosting compromised clients. For instance, the .org one led to a link shortener and straight away downloaded an .exe file. No way to verify the hash out of the box.



Strangely, the original is pretty much barebones so naive users might fall for those bells and whistles.

Just a silly question,

Looking for PhoenixMiner in one of he most popular search engines,and there are two (tree) websites coming out as a result >
Are both sites legit?
One is leading to the thread with many merit, so I assume this one is legit for sure, but for the .org one, I have some doubts.

Then there's another one which comes at the bottom of page 1.

We fighting this kind of posts and threads already for nearly 3 years now !
Glad to can say we won the fight in the Altcoin board but on the mining board it looks like a never ending story.
You can take a look here in my thread : Report Malware and Suspicious Links here so Mods can take Action ! to see what i am talking about !

Well, it's been an interesting glimpse into the backroom workings of running a popular website.   (The battle still rages on the altcoin mining thread).

I can say that Mitchell and MindlessElectron are the most concrete example of what I would call a Bitcointalk Ninja that I have seen, and I will vote that way on the award thread.

They have started there posting around the  mid or end july 2020 !
As i catched them when they used to start posting the fake ethpill thing .
The following post was one of the first in the Phoenixminer thread.
Since this date i am fighting them.


Even it was only the EthPill post i am 100% that the fake Phoenixminer download links belongs to the same Hackers.

It was a battle back in the days when we got no bot , i guess it was some hours a day what i reported there.
The bot from Mitchell was an amazing and needed help for that , thanks again .

Just like antiviruses, the patterns are always a game of cat-and-mouse.

Another new one would show up. Once the mod adds it to the list, then we'll see those nukes working.

And the cycle repeats.

I have always wondered, you (the mods) know the thread(s). And after 1 or 2 posts, you know the new format of the malware posts.
There are tools for SMF that will block posting if certain criteria are in the post. Is there a reason that it has not been implemented?

I know this is not stock SMF but I would think that some of the standard tools that are out there would work.

-Dave

I've purged the bot database a few times, but the first one I can find was on January 4, 2021, which looked like this: https://ninjastic.space/post/56018609

When he handles consecutive posts and needs to merge them, I have noticed that the revised remaining posts always appear exactly the same (as a function of the posts being merged). I think it is probably safe to say that he uses automation for those reports.

Based on the amount of trash that has been in the altcoin sub over the years, I cant imagine it even being possible to be the mod over that sub without the help of automation.

I do believe I remember seeing them say they have a way of handling mass amount of reports, though don't quote me on that.

Yeah, if your a frequent patrol visitor you'll see them pop up every so often. They're mostly a non problem, since the bot handles them quickly. Though, there's a element of risk still for users visiting, and potentially downloading it, so I don't think it's too much of a problem reporting them. Like I said, I sometimes get rid of them before the bot does, though at Mitchell suggests they seem to come in fits, and starts so once they begin they'll continue for a while, and then die down.

Do you recall how long this has been going on for? I believe its been over a year since they started, but I think I might be grossly understating that too.

All the stats would be is the number of accounts that have posted spam links (aka how many spambots have tried to invade the forum). It would really not be a function of anything any forum member does, other than mitchell's specific configuration.

I reported a couple early in the day, then I noticed they were gone almost as fast as they appeared and I stopped, and just sat back and watched.. That is a very good bot.



You should post some stats once in a while, very interesting numbers.

MindlessElectron has nuked over 300 people today. The PhoenixMiner spammers have become very active all of a sudden. The last time my bot had to deal with them was Feburary 3 and that was like 130 of them (and the time before that was January 18).

I am fairly certain that mprep also uses some amount of automation in handling reports. It might not be to the extent that no human intervention is required for action to be taken, however, I strongly suspect that he uses tools to help him handle common report types quickly -- he certainly has the technical expertise (from what I have observed) to create said tools.

These sort of posts are usually handled by MindlessElectron, a bot created, and managed by Mitchell. Although, it only nukes certain posts that fit the criteria, and only from newbies. I assume your talking about the fake PhoenixMiner posts which have been going on for probably more than a year now. I usually leave those posts as the bot usually zaps them within a minute, as you said unless they just happen to pop up as I'm refreshing the patrol page since I can handle them before the bot does. Hopefully that doesn't cause any errors in MindlessElectron from time to time.

I did notice earlier there was a newbie account with over 200 posts than posted one, looks to be handled now. I'm not sure if these are compromised accounts or if they've just built up accounts over time, though most of the accounts are newbies who have either only posted a few lines here, and there or they are without any posts whats so ever.

There's no statistics which are released to the public, other than what can be found on the mod deletion page. You could theoretically monitor that, and get some ball park figures, though it doesn't always include every moderation action, i.e doesn't include moving threads.

There's quite a few users from around the 2018 mark registered in a certain time period that seem to be both distributing these fake PhoniexMiners, but also bump spamming. We must have nuked thousands of these types of accounts over the months, so it's likely that most of the accounts they made themselves, since they seem to always be within a certain time frame in terms of when they registered.

It would be interesting to see how many mod actions are taken each week or month, could probably shock a lot of people. Plenty of moderators here working around the clock, which sometimes feels like an impossible task. Thankfully, we've got a pretty dedicated community in terms of reporting, which I'm personally very grateful for. Seriously, I don't think I've ever seen such a dedicated community in terms of battling malicious users, and spam.

You can use Modlog to monitor deleted posts/threads, nuked users etc. It doesn't directly give info on the board posts was deleted, you would have to research on it, using the available information.

Accounts can be woken up for such activities. Could mean they were sold off or the user forgot about then and just put them to use.

I’ve been watching mprep (I think) battling spammers posting a virus in altcoin mining at the pace of 1 post or more per minute for the last few hours.

Looks like someone has access to a long list of new and old ID’s.

Amazing how fast mprep (?) is hammering these!

Is there a place to see how many posts have been deleted there in the last few hours?

Brings to mind, are there any stats for spam post deletions, frequency, etc?

Edit.
 
Some of the virus posts have accounts originating in 2017/2018, and I’ve seen at least one that had a lot of bounty history until the virus post.