Another repeat.

IP address for this post
202.47.50.28 [ 1 Post ] [ Look up IP address ]
Users posting from this IP address
jacksim [ 1 Post ]

By MarkSHoyle (Bolo) on Wednesday, January 06, 2021 - 08:29 pm: Edit

"She's Back" in FC: Rules Questions...

Metal Detector.....

By Mike West (Mjwest) on Thursday, January 07, 2021 - 08:16 am: Edit

Please do ban the "SaraArianna" user. It is being very persistent and needs to go away.

By Jean Sexton Beddow (Jsexton) on Thursday, January 07, 2021 - 09:48 am: Edit

What I have done is block the IP addressed, both from Pakistan. It should keep the offenders from simply re-registering.

By Mike West (Mjwest) on Thursday, January 07, 2021 - 08:02 pm: Edit

Thanks!

By Mike West (Mjwest) on Tuesday, January 12, 2021 - 10:14 am: Edit

Interesting. Two seemingly decent posts were made in the FC Forum, except that they are literally identical. When I looked at the older one, I realized that it had three probably dangerous links added after its initial creation.

So, please get rid of both users. Thanks!

IP address for this post
1.186.224.84 [ 1 Post ] [ Look up IP address ]
Users posting from this IP address
BrooksBlakely [ 1 Post ] Search
DeanBlakely [ 1 Post ]

IP address for this post
94.237.97.14 [ 1 Post ] [ Look up IP address ]
Users posting from this IP address
LucyBryson [ 1 Post ] Search
HarperBryson [ 1 Post ]

Please ban all four users. They're bad.

By Mike West (Mjwest) on Tuesday, January 12, 2021 - 10:15 am: Edit

The other thing that is nasty about these is that they try to post something that actually is good and on-topic, then they go back and add their poisonous links. While the Blakelys didn't get the opportunity to add the links, both of the Brysons did. They're all bad.

By Jean Sexton Beddow (Jsexton) on Tuesday, January 12, 2021 - 11:15 am: Edit

Mike, I banned the IP addresses. Banning the users just has them pop up under a new name. One IP was from Germany, the other from India. For once, they didn't show up in the database of IP addresses with bad actors. I think it is probably because they do exactly what you spotted -- post something that is appropriate, then go back later and add the links.

Well spotted and done.

By Mike West (Mjwest) on Tuesday, January 12, 2021 - 01:35 pm: Edit

I wouldn't have even seen that, except for the duplicate post by someone else. When I went back to look, I found the links had been added. So, I only found it because they were sloppy.

I could have found it if someone else had posted to one of the threads and I saw the modified original post, but that isn't guaranteed.

At least now I know to occasionally go back and look.

By MarkSHoyle (Bolo) on Thursday, January 14, 2021 - 12:42 pm: Edit

Two New users in Federation Commander Forum...

Rules Questions: Cloaking Questions: jeflsdean84

General Discussion: Question about Seltorians: christesr75

After the last incident, seems prudent to watch for the moment....

By Mike West (Mjwest) on Thursday, January 14, 2021 - 02:09 pm: Edit

Sure. It would be good for everyone to make sure the original messages are not later modified. The cloaking questions one is really raising red flags.

By Mike West (Mjwest) on Friday, January 15, 2021 - 04:26 pm: Edit

IP address for this post
178.32.250.46 [ 1 Post ] [ Look up IP address ]
Users posting from this IP address
joshmacde85 [ 1 Post ]

Missed one earlier. Came back and edited post to add spam links.

By Mike West (Mjwest) on Friday, January 15, 2021 - 04:28 pm: Edit

IP address for this post
168.1.132.7 [ 1 Post ] [ Look up IP address ]
Users posting from this IP address
sarahwayn84 [ 1 Post ]

Another needs to go ...

By Mike West (Mjwest) on Friday, January 15, 2021 - 04:36 pm: Edit

IP address for this post
43.243.82.59 [ 1 Post ] [ Look up IP address ]
Users posting from this IP address
rosemaruq53 [ 1 Post ]

Missed the two above for a couple days, but this one was just yesterday.

I am just waiting for the two identified by Mark to go bad, too.

By Mike West (Mjwest) on Friday, January 15, 2021 - 04:41 pm: Edit

IP address for this post
67.205.187.130 [ 1 Post ] [ Look up IP address ]
Users posting from this IP address
normanred56 [ 1 Post ]

By Mike West (Mjwest) on Friday, January 15, 2021 - 04:54 pm: Edit

There must have been some kind of meeting on the dark web at the first of this year when the spammers were all getting back to work on using this approach. I don't know where they are getting the questions from. In fact, there is another user I am waiting to go bad (emilykiny62) which will be very disappointing since their questions were really *good*. They are questions on something the rules actually missed, and it will be disappointing if it was just all a setup.

But if it is a setup, how did they find it those questions? It is on Andro rules that are only available if you buy something. Are there really that many FC fans that are spammers!? Besides the original four, there are now four more, and the other three identified above I am waiting to "turn".

(Also, sorry for the multiple posts. Each time I thought it was the last one. I didn't expect four!)

By Jack Bohn (Jackbohn) on Friday, January 15, 2021 - 05:54 pm: Edit

They aren't reposts of older questions? I guess you'd know.

There's programs of not-really AI level that can output text that resembles input text, but they don't always make so much sense.

By MarkSHoyle (Bolo) on Friday, January 15, 2021 - 06:21 pm: Edit

It's a shame we have to be wary of every first time poster for the time being...

By Jean Sexton Beddow (Jsexton) on Friday, January 15, 2021 - 06:36 pm: Edit

Looks like we are dealing with clever people using various proxy services.

By Garth L. Getgen (Sgt_G) on Saturday, January 16, 2021 - 12:21 pm: Edit

Here's a list a recent accounts opened on the FedCmdr board since 1 JAN 2021:

##	Username	Joined	Posts
1	cobiesmul47	16-Jan-21	1
2	escoutdril54	16-Jan-21	1
3	NashLena	16-Jan-21	1
4	WalkerLena	16-Jan-21	1
5	emilykiny62	15-Jan-21	1
6	kharyptho84	15-Jan-21	1
7	jeflsdean84	14-Jan-21	1
8	christesr75	14-Jan-21	1
9	RileyDylan	14-Jan-21	1
10	DeanBlakely	12-Jan-21	0
11	BrooksBlakely	12-Jan-21	1
12	sarahwayn84	11-Jan-21	1
13	rosemaruq53	11-Jan-21	1
14	JorgeDamien	11-Jan-21	1
15	CarsonGrey	11-Jan-21	1
16	badlands122	9-Jan-21	2
17	LucyBryson	9-Jan-21	1
18	HarperBryson	9-Jan-21	1
19	joshmacde85	6-Jan-21	1
20	normanred56	6-Jan-21	1
21	jacksim	4-Jan-21	0
22	SaraArianna	3-Jan-21	0
23	Dragonlibrarian	1-Jan-21	2

A couple of them do look legitimate.


Garth L. Getgen

By Mike West (Mjwest) on Saturday, January 16, 2021 - 01:07 pm: Edit

I am trying a different tactic because it amuses me. Hope you don't mind. I will clean it up later.

Of the above list, the legitimate users are pretty much guaranteed to be:
- Dragonlibrarian
- badlands122

And while "jacksim" was not good, it wasn't part of this new group.

All of the other user ids are either:
- nine letters plus two numbers
- FirstLast (sometimes in pairs, oddly enough)

The only remaining exception is "escoutdril54" which has ten letters instead of nine. Not sure on that one. Plus, that one is just from today.

I am starting to think that the bulk of the user ids that follow the patterns I mention above are either just one or two people. Perhaps each person has their own pattern, so we now have three active:
- FirstLast
- Nine plus two
- Ten plus two

By Mike West (Mjwest) on Saturday, January 16, 2021 - 01:08 pm: Edit

Jean,

Thinking about it more, one thing to consider is just turning off the ability to edit posts for non-Moderators and non-Administrators. That is the ability they are leveraging to do their thing, and if we take it away, they might go away.

Doesn't have to be forever. Just long enough to make them stop. At least for a while.

By Garth L. Getgen (Sgt_G) on Saturday, January 16, 2021 - 01:17 pm: Edit

Over on the Trek-BBS, you have to have "X" number of posts before you're allowed to edit your own posts. I can't remember if X=10 or X=25, but it's a large enough number to curtail spam edits and small enough it gives the ability to (hopefully) trusted users.


Another interesting statistic: there are 922 accounts on the FedCmdr board with zero posts associated with them. I'm not saying they need to be swacked ... too much work for too little gain ... but I did find it interesting nonetheless.


Garth L. Getgen

By Jean Sexton Beddow (Jsexton) on Saturday, January 16, 2021 - 01:49 pm: Edit

Mike, the ability to edit a post on the FC Forum has been locked down to moderators. You may want to announce that.

By Mike West (Mjwest) on Saturday, January 16, 2021 - 03:33 pm: Edit

I will. Thanks!