Topic: User creating massive amounts of referral spam - Marcy - page 2. (Read 3662 times)

Ditto. Don't know why the hacker bothers wasting the accounts like this though. They get noticed immediately and it's blatantly obvious ref spam so next to no one will click on it anyway.

There's a new one promoting a slightly different domain (ghsminer[dot]com/?ref=xxxx), obviously by the same owner/hacker:
dazza12 | Last posts

Just report them and they'll get handled asap. I handled the ones I could.

There is another one that is apparently just getting started (less then 20 so far).

--> https://bitcointalksearch.org/user/dopehero-220238

Quite apparently, this is done extensively recently. Higher ranked accounts have low limits for posting, easy to abuse them while it's not that hard to acquire an account with a high rank. I'm not sure if this is proving worthy for whatever they're trying to achieve. The forum could probably use some defense against accounts that are bought with the sole purpose of spamming.

Another one just started: https://bitcointalksearch.org/user/bloedhond-508320

Left negative trust for both of these users as the site looks extremely dodgy, even for a cloud mining site/ponzi.

These accounts are likely to be compromised if not owned by the owner of the site who's trying to promote this scam.

https://bitcointalksearch.org/user/hunkey600-409703

It looks like someone else is making similarly spammy posts.

Links for newbies are auto-removed but not for higher ranks. There are legit reasons for posting referral links but spams are way higher. So I guess this would work but I don't think forum will disable this. Users can also use shortened URL for posting referral link to bypass auto-remove.


Only 2 Global Moderators are active now. We definitely need a few more active Global Moderators. https://bitcointalk.org/index.php?action=mlist;sa=search

P.S. Also see https://bitcointalk.org/index.php?topic=1071319.0;all.

Hmm I've noticed some of the posts with that cloud mining referrals but I just ignored them (I'm not helping the mods in doing their job ). I thought referral links aren't allowed for posting? Just a suggestion, I think auto-removing referral links should be implemented in this forum. Just a thought that popped out of my head.


Not necessarily needed for the mean time I think, as long as there are also other members of this forum helping the mods in their job by reporting posts like this.

Can we just blacklist the hashminer (dot) net domain? It seems like that'd kill the spammers pretty quickly...well, at least until they create a new website. But otherwise it doesn't seem like this hacking is going to stop, as it seems like it'll exponentially grow (I am willing to bet >1 person gets hacked clicking the links each time a hacked account spams the board up).


You are mistaken. I reported every single hacked post made by EmpoEX (and probably other people did too), and I never saw a domain for EmpoEX.

Like I said above, I thought that I saw some of the referral links with the domain of EmpoEX, although I might be mistaken.

The link that was spammed by this account was spammed by others in the Altcoin ANN section. The thread which I saw was yesterday at about 2-3 PM here: https://bitcointalksearch.org/topic/--1082561 (since deleted).

Here is a backup of the thread:



Link was clicked and visited showing a site which downloads a miner exe. Upon double clicking it, nothing appeared to have happened. A few hours later, our accounts started getting logged into such as here, twitter and other sites. Security emails were received, and we tracked it to this IP: 37.123.112.27. After this, posts were made throughout every section on the forum with a referral link + a locked thread. We promptly went through and edited all posts to request them to be deleted.

Not entirely sure how the passwords were leaked but it seems the trojan gained access to stored passwords in Google Chrome, as all passwords in use were 30+ chars long and not guessable or weak by any means.


The link that was spammed contained an ID on the end of the URL specifically "?ref=271292" for a hashminer.net site, which does not in any way match our handle.



Here is a backup of the thread which was posted by us into the Altcoin ANN section yesterday showing a totally different ref number, for cloudminer.biz domain:



Please refrain from unnecessary accusations.

I would like to clarify that we do not own and are not associated with the site that was linked. You can check the history of our account, we are running a professional exchange. It would be greatly appreciated that anyone who has placed negative trust to edit their trust to restore our account to good standing.

Hopefully this helps clear up the situation.
#EmpoEX Team

I guess it was linked to the phishing attempts reported today by QS & AT101ET. Maybe, You & other Staff have more solid proofs about the issues.


+1. It would be great to learn some lessons from it & maybe we can also turn it in a distributed digital forensics effort. 

I got this PM from EmpoEX:

I linked him to this thread and asked him to provide more details. If what he says is true he should give as much information as possible to prevent this in the future.

Yeah, probably the users just clicked a phishing link themselves or got a virus from somewhere else.

I don't think its accounts hacked from the hack. It would be stupid to use the accounts for posting spam to a referral link as that would generate a much smaller profit than using it for other purposes.

Aaand another one: https://bitcointalksearch.org/user/yournewgod-412771

Probably hacked as well. I guess the weak passwords from the leak are broken now.

Yeah, handled the ones of his that I could. Just keep reporting them.

Just reported another possible alt - YourNewGod, uid: 412771 - of the said spammer.