Jump to content

Suspicious Forum Profiles

Rate this topic


DJ Dangerous

Recommended Posts

I deal with some of this sort of thing on another forum. There is an interesting trick a few spammers have. They will make an innocuous post, then return a few days later and edit in a spam link. I have a daily ritual of going past the current suspects, to see if they have returned since their 'innocent' post. Usually, a return will be for an edit - then I kill them. It's nice to let them waste their time.

As you say, the names often have a 'style' to them. this helps, but it is not proof, until they reveal themselves. A lot of them are probably the same person.

Other suspicious moves are filling in the birthday as Jan 1st or today's date (although some people will do this genuinely for 'privacy' reasons - and choosing a slightly posh English name.

If they do post, English is not always their first language, so a tactic used is to copy an old post from earlier in a thread and repost those words, so it 'looks real'.

They will often post in a thread from the distant past, so that the edited in link will be relevant to the subject.

Another thing they do is to sign up twice, or more, and then 'respond' to themselves.

Probably 90% of the time, they sign up, don't post anything and never return.

There are also genuine people who sign up and read the forum, but never feel it necessary to make an input.

IP addresses can be a clue, but again, not conclusive.

My other forum currently has 192 'people' online - 10 are real individual members, the other 182 are bots, some of them identify themselves honestly, Bing, etc., they're just harvesting stuff for search purposes.

  • Informative 1
Link to comment
Share on other sites

Likewise with this forum, there may be ten or twenty members online, the rest guests.

That's not to suggest any malice, the forum is quite often featured in my search results online when not logged in, and I imagine the same for many others.

Interesting trick on the editing of the posts. Probably won't get away with it here because no matter what gets posted, no more how innocuous, it'll get spammed with off topic stuff on tin vans and chiropractors and "when I was young" posts...

I must wrack my brain for some more profiles like these. Usually no activity and too many consonants / double consonants in the name, and usually only one of them logged in at any one time.

  • Like 1
Link to comment
Share on other sites

Romance scams? Pick out the lonelist, most pathetic poster, then PM them. "Hi, I'm double-d Svetlana, blah blah blah" ...

Or use the PM facility for nefarious purposes, unrelated to the forum, like planning an assasination? Like the London rioters ten or fifteen years ago used BBM to avoid detection.

Or as @Broithe says, the plan is to post, then edit in a malicious link, but they see it's pointless with us off-topic-ers and don't bother.

Or just to see members forum signatures and harvest personal info?

I dunno, just looking for logic.

Link to comment
Share on other sites

I presume a lot of them are what I call 'pretend marketing' and want to show widespread penetration of the links. It's just a bit weak...

Some of it is clearly malicious, with intentions to harvest data once a link has been clicked.

My other forum is named after the town where it started as a local forum - most of what goes on is local, some is national, some is even international and there is an astronomy thread for the aliens to join in, although I have not seen an IP off the planet yet. Anyway, this does mean that we do get genuine mistakes, with the British habit of renaming places all round the world and lazily not picking a new name, so we get people innocently wanting you to use their motor repair services in Australia or hairdressers in Virginia, for example. And it is also the name of a breed of dog, so we get a few of them from all over the place (the owners, not the dogs, as far as I know), they could stay, as we also have 'real' owners, but they rarely do, if they're from 'outside'.

We do, as with this forum, have genuine members outside the obvious area and I can see the IP addresses used, so somebody new, posting from Vietnam or the Philippines, etc, would be looked at suspiciously, but they could just be on holiday. I like there to be a clear contravention before I kill them.

Spammers is just one problem - we have had some seriously weird real people - feuds have developed to the point of police intervention several times. Threats have included physical violence, bombings and arson.

We have had people whose 'sport' is to pick fights.

Some spammers will put their links in their profiles and signatures, too.

There is another 'clever' thing that I've seen a few times when an edit has occurred. I call them "white links". The poster will edit in the link at the end of the post, but change the text colour to white, so that it doesn't show in the post, but it will be found by the cursor, should that hover over it. Whether that is to maybe get an innocent person to click the hidden link out of vague interest, or to 'show' that it has been posted somewhere and survived, I don't know.

 

It all seems a bit quieter here, but that may be down to @BosKonay doing a sweep most mornings..?

Edited by Broithe
  • Like 4
Link to comment
Share on other sites

3 minutes ago, spudfan said:

You mean to say that you are not all young, single, good looking females here? I thought we were communicating in code. My day is ruined now. Whoever heard  of grown men talking about model trains on the internet?

 

That's motorboating that you're thinking of.

We don't go in for any backdoor shenanigans, here.

Link to comment
Share on other sites

Amusingly, and demonstrating how the web really is an actual web, the famed Andy York, who is, by geographical coincidence, a member of my other forum, tipped me off about a dodgy new member, who seemed to be very similar to someone who had caused issues over on RMweb.

His suspicions turned out to be correct and a death warrant was executed, before any harm could be done.

In a way, it's a bit reassuring, it was our first visitor of a risqué nature, all the others have been just inept 'marketing' for streaming sites and IT equipment purveyors in far-off lands. I had wondered if we just weren't attractive enough?.

 

Edited by Broithe
  • Funny 2
Link to comment
Share on other sites

  • 6 months later...
On 13/7/2023 at 2:47 PM, BosKonay said:

Not sure the agenda, other than bots, since every single member joining is manually moderated, so it's pretty pointless :)

Is that why I got a “1 month later” notification for one month since setting up my account, the same day my account was verified? Like, within 3 hours of each other. 🙂

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...

Important Information

Terms of Use