case studies

emily sparkle · Post by **emily sparkle** » Wed Feb 01, 2006 9:20 am

no problem. timing is everything.

Kinetic IV · Post by **Kinetic IV** » Thu Feb 02, 2006 3:39 pm

Commerce, about to be hidden behind the wormhole:
User: atours.ru

http://eplaya.burningman.org/viewtopic. ... 102#202102

emily sparkle · Post by **emily sparkle** » Thu Feb 02, 2006 5:22 pm

got it. thanks.

Guest · Post by **Guest** » Sun Feb 05, 2006 1:40 pm

really?

emily sparkle · Post by **emily sparkle** » Mon Feb 06, 2006 6:28 am

VioletMan wrote:really?

huh. that was wierd. should be gone now.

Kinetic IV · Post by **Kinetic IV** » Mon Feb 06, 2006 1:56 pm

Russian Spam in the Open Discussion section....

http://eplaya.burningman.org/viewtopic. ... 818#202818

joel the ornery · Post by **joel the ornery** » Mon Feb 06, 2006 2:19 pm

http://eplaya.burningman.org/viewtopic.php?t=12263

more former soviet union spam

oops, same as K4 posted.

emily sparkle · Post by **emily sparkle** » Mon Feb 06, 2006 5:12 pm

thanks guys. got it.

theCryptofishist · Post by **theCryptofishist** » Mon Feb 06, 2006 5:23 pm

Thank you, Emily for remove the unsightly.

emily sparkle · Post by **emily sparkle** » Tue Feb 07, 2006 3:22 am

you are most welcome ms. fish. i hope you are well.

Kinetic IV · Post by **Kinetic IV** » Thu Feb 09, 2006 3:13 pm

Pure Commerce from someone named Holidaymags:

http://eplaya.burningman.org/viewtopic. ... 08f#203709

theCryptofishist · Post by **theCryptofishist** » Fri Feb 10, 2006 2:37 pm

Joined: 10 Feb 2006
Total posts: 0
[0.00% of total / 0.00 posts per day]
Find all posts by aristotel
Location: New York
Website: http://www.555-casino.com
Occupation:
Interests: Games

What's even worse than the commerce is that if you do click on that link you not only get a pop-up, but your main window gets put onto that site.

Kill, kill, kill.

emily sparkle · Post by **emily sparkle** » Fri Feb 10, 2006 3:18 pm

Kinetic IV wrote:Pure Commerce from someone named Holidaymags:

http://eplaya.burningman.org/viewtopic. ... 08f#203709

removed. thanks.

emily sparkle · Post by **emily sparkle** » Fri Feb 10, 2006 3:21 pm

that user isn't active, so deactivating won't do any good. i deleted the links from his profile.

theCryptofishist wrote:
Joined: 10 Feb 2006
Total posts: 0
[0.00% of total / 0.00 posts per day]
Find all posts by aristotel
Location: New York
Website: http://www.555-casino.com
Occupation:
Interests: Games
What's even worse than the commerce is that if you do click on that link you not only get a pop-up, but your main window gets put onto that site.

Kill, kill, kill.

Kinetic IV · Post by **Kinetic IV** » Sun Feb 12, 2006 7:52 pm

More Russian spam....I waited to post about it until I could check out the link from a safe PC and make sure.

http://eplaya.burningman.org/viewtopic. ... 703#204703

The wormhole will cover it up but it's by a sock account called filippovpasha .

emily sparkle · Post by **emily sparkle** » Mon Feb 13, 2006 6:17 am

so... K4

why do you think this is a sock account? although it's a .ru account, there are no commercial urls in their profile, like so many of the others. plus, the IP it's posted from does not have any other registered users posting from it. what is YOUR criteria for calling a sock a sock?

i agree it's a commercial posting as the link in the text was for hotelservice.ru, so i've deleted it, but i've been wondering how you guys have defined sock puppets and masters in this process...

emily

Kinetic IV · Post by **Kinetic IV** » Mon Feb 13, 2006 7:49 am

emily sparkle wrote:so... K4

why do you think this is a sock account? although it's a .ru account, there are no commercial urls in their profile, like so many of the others. plus, the IP it's posted from does not have any other registered users posting from it. what is YOUR criteria for calling a sock a sock?

i agree it's a commercial posting as the link in the text was for hotelservice.ru, so i've deleted it, but i've been wondering how you guys have defined sock puppets and masters in this process...

:) emily

Dang, I almost had another one to give as an example but EvilDustBooger flushed it into the wormhole before I could post the link.

What I look for is patterns. I'm suspicious of any account with Russian characters en-masse in the post, the post is in the same area as similar posts in the past and the account's posting history. But that alone doesn't make it a sock. What does make it one is being online at many different times and seeing this account appear right after one of the names in the Russian sock masters thread logs off.

So to answer your question I don't have absolute proof that it's a sock. But when all of the evidence is looked at...I felt comfortable enough to make the determination...I'm also willing to offer an apology if I'm wrong. But I don't suspect I'm wrong on this one.

I'm curious what others will have to say about this and what they look at to determine an account's status...

Kinetic IV · Post by **Kinetic IV** » Mon Feb 13, 2006 4:24 pm

Commerce: Magazine sales by "Holidaymags", the thread is hidden by the wormhole.

http://eplaya.burningman.org/viewtopic. ... 035#205035

EvilDustBooger · Post by **EvilDustBooger** » Mon Feb 13, 2006 8:20 pm

There is a "record" of sorts of the posters who are hacking into
the announcement thread that can be accessed by going to the wormhole
and start hitting the "view previous topic" button.
It will show you the offending posts in reverse chronological order.... minus the ones that got whacked by the admins...
I think most of these .ru posts are probably auto generated by some russian spamboy trying to increase his page rank and traffic by spamposting phpBB`s across the WWW .

Kinetic IV · Post by **Kinetic IV** » Mon Feb 13, 2006 9:04 pm

This is kinda iffy but I have a problem with this new account that just popped up.

All about adminprocd

Joined: 13 Feb 2006
Total posts: 0
[0.00% of total / 0.00 posts per day]
Find all posts by adminprocd
Location: USA
Website: http://procdshop.com/
Occupation: Software manager

There are billions of name choices out there so why does someone need one that could be confused with the working admin account on the board? Also the website links to a warez site....it's kinda obvious to me what it is. Could this account be removed?

emily sparkle · Post by **emily sparkle** » Tue Feb 14, 2006 6:42 am

got it. thanks.

Kinetic IV wrote:Commerce: Magazine sales by "Holidaymags", the thread is hidden by the wormhole.

http://eplaya.burningman.org/viewtopic. ... 035#205035

spectabillis · Post by **spectabillis** » Tue Feb 14, 2006 11:49 am

see spanky's update re: anti-spam mod install - http://eplaya.burningman.org/viewtopic. ... highlight=

EvilDustBooger · Post by **EvilDustBooger** » Tue Feb 14, 2006 11:59 am

way to be Spanky!
May this spell the end to our nemesis` of the eplaya,
Farewell :Spyder,
WWW::Robot, .....LWP::UserAgent,..... WWW::SimpleRobot, WWW::RobotRules,.... LWP::RobotUA, ....and all the other kith and kin of these spamming bastards.

Here is an interesting and informative discussion about spamming:
http://www.spamblogging.com/archives/000043.html

May the (((FORCE))) not mess with your cranium too much....

spectabillis · Post by **spectabillis** » Tue Feb 14, 2006 12:07 pm

yikes, interesting read edb, thanks.

Kinetic IV · Post by **Kinetic IV** » Tue Feb 14, 2006 8:27 pm

Pure commerce:
http://eplaya.burningman.org/viewtopic. ... 440#205440

Someone named mikney talking about clone seeding stuff.

emily sparkle · Post by **emily sparkle** » Wed Feb 15, 2006 5:03 am

got it.

Lassen Forge · Post by **Lassen Forge** » Wed Feb 15, 2006 3:20 pm

Selling electric apartment heating systems for Russians in Russian.

Viewing profile :: electric-heat

Joined: 15 Feb 2006
Total posts: 0
[0.00% of total / 0.00 posts per day]
Find all posts by electric-heat
Location: ×åëÿáèíñê
Website: http://www.selen-chel.ru
Occupation: ýëåêòðè÷åñêîå îòîïëåíèå (electric heat)

Lassen Forge · Post by **Lassen Forge** » Wed Feb 15, 2006 4:41 pm

Another bringing more Hi-tech lowbrow commercial advertising from the land of Rasputin...

Viewing profile :: whistler1
Joined: 15 Feb 2006
Total posts: 0
[0.00% of total / 0.00 posts per day]
Find all posts by whistler1
Location: WHISTLER - ÀÍÒÈÐÀÄÀÐÛ è ÐÀÄÀÐ-ÄÅÒÅÊÒÎÐÛ ÂÈÑÒËÅÐ
Website: http://www.whistler1.ru/
Occupation: ÀÍÒÈÐÀÄÀÐÛ WHISTLER è ÐÀÄÀÐ-ÄÅÒÅÊÒÎÐÛ WHISTLER

emily sparkle · Post by **emily sparkle** » Wed Feb 15, 2006 5:06 pm

Bay Bridge Sue wrote:Selling electric apartment heating systems for Russians in Russian.

Viewing profile :: electric-heat

Joined: 15 Feb 2006
Total posts: 0
[0.00% of total / 0.00 posts per day]
Find all posts by electric-heat
Location: ×åëÿáèíñê
Website: http://www.selen-chel.ru
Occupation: ýëåêòðè÷åñêîå îòîïëåíèå (electric heat)

i'm gonna just move those into the sock puppets file so i can keep track of them all in one place so when spanky gets the mod installed.... we'll get 'em.

thanks.

emily

Lassen Forge · Post by **Lassen Forge** » Sun Feb 19, 2006 1:52 pm

Apparent Hijacked Account - does not follow the first 10 posts of the alleged author (that or he's had a major stroke), plus has links to a non-safe PC site...

http://eplaya.burningman.org/viewtopic. ... 871#206871

(And I apollogize if I was harsh on that thread.)

bb