About Recent Botnet Abuse / 继续对抗僵尸网络滥用[中英双语] (Updated on 2024-10-28)

in HIVE CN 中文社区28 days ago (edited)

Perhaps many community members have noticed the recent abuse of botnet users, which has caused some trouble and distress to many community managers. I got some more detailed information from @logic, a member of the Hivewatchers team. After seeking @logic's consent, I decided to share it with community members, hoping to help everyone fight against botnet users.

hacker-8003327_960_720.webp
(图源 :pixabay)

I first noticed this problem because of several posts from suspected new users in the Chinese community. When I investigated these users in depth, I found some strange commonalities.

Most of their names are letters + numbers
Their registration time is concentrated from August to October 2021
They registered through steemmonsters (currently called Splinterlands on HIVE)
For a period of time after registration, they played Splinterlands games through a bunch of accounts
They posted their first post in the past few days
The content of their posts is stolen from articles in 2021 by well-known users in various communities

Because these users have the same characteristics and behaviors, I can judge that they are definitely not new users but a group of skilled and premeditated abusers. I will disclose the information of these abusers in the Chinese community WeChat group, calling on everyone to downvote on the articles of these abusers. At the same time, I will report the abusers to Hivewatchers, hoping that they can be added to the blacklist to prevent them from continuing to do evil in other communities.

Soon I got feedback from @logic that these users belonged to a huge botnet. As of last Friday, the botnet had 17,462 members, which is a surprisingly large number.

@logic sent me a detailed list of 17,462 accounts. Here is a portion of it.
image.png

At first glance, this seems despairing.However, judging from HIVE's development over the past eight years, we have come through all the tough situations, haven't we? Moreover, this botnet has been discovered and accurately identified, so why should we worry about them continuing to do evil?

I discussed with @logic the feasibility of marking (Downvoted) the posts of botnet users as soon as they post, so that community users can easily identify the posts of this botnet user without having to conduct in-depth research. The reply I got was that this work is in progress and will be online soon.

At the same time, the Hivewatchers team also provides some tools to check whether a user is a blacklist user. The tool link is as follows:

https://hivewatchers.io/blacklist-search
https://hive-tools.io/hivewatchers

In addition, there is a complete list of abusers (including the botnet users this time) on the spaminator website. You can search by opening the list and using ctrl + F, or use this list to build your own community protection robot. The link is as follows:

https://spaminator.me/api/bl/all.txt

Thanks to the Hivewatchers team for their outstanding work in combating HIVE abuse, especially for timely discovering and compiling a detailed list of botnets, which will help community managers and members combat botnet abuse and avoid being deceived.

At the same time, we would like to remind friends in various communities, especially curators, to keep their eyes open and resolutely prevent botnet members from getting even a penny of profit, and strive to reduce their reputation points to 0 so that they can no longer commit fraud.

In this battle, as the side of justice and unity, we will surely achieve ultimate victory.

Updated on 2024-10-28

Special thanks to @louis88 who together with logic and hivewatchers and another friend did a deeper investigation and digging into the timing of this botnet attack and uncovered the mastermind behind it.

The administrators of the Aliento community also discovered the botnet abuse in a timely manner and responded to it. For more information, please refer to Oleada de cuentas falsas inundan comunidades populares en Hive [ESP-ENG] (Thanks to @michupa for providing relevant information)

I believe that more friends have already taken action, but due to my limited information channels, I cannot mention them one by one here. I would like to express my gratitude to them all.

(English part is translated using Google Translate)

ai-generated-8659546_960_720.jpg
(图源 :pixabay)

中文版

或许很多社区的小伙伴已经注意到了最近僵尸网络用户滥用的问题,这个问题给许多社区管理者带来一些麻烦和困扰。我从Hivewatchers团队成员@logic那里得到了一些更详细的信息,征求@logic 同意后,决定将其分享给小伙伴们,希望有助于大家对抗僵尸网络用户。

我最初注意到这个问题是因为中文社区中出现了几个疑似新用户发布的帖子,当我深入调查这些用户时,发现一些奇异的共同之处。

他们的名字大多是字母+数字的形式
他们的注册时间集中在2021年8月份到10月份
他们是通过steemmonsters (在HIVE上当前叫Splinterlands)注册
在注册之后的一段时间里,他们通过一堆账户玩Splinterlands游戏
他们在最近几天发布第一篇帖子
他们的帖子内容是盗取各个社区知名用户2021年的文章

因为这些用户具有相同的特征和行为,我可以判断他们绝不是新用户而是一组有技术、有预谋的滥用者,我将这些滥用者信息公开在中文社区微信群,号召大家去踩这些滥用者的文章,同时我将滥用者举报至Hivewatchers,期望他们能被加入到黑名单,以免他们继续在其它社区作恶。

很快我从@logic 那里得到反馈,这些用户属于一个庞大的僵尸网络,截至上周五,这个僵尸网络的成员多达17462个账户,这真是一个庞大到令人惊讶的数字。

@logic发送给我包含17462个账户的详细名单,以下是名单中的一部分。乍一看,这真让人绝望。

不过从HIVE 这八年多的发展情况来看,多么艰难的情况我们不都走过来了吗?何况,这个僵尸网络已经被发现并被精准识别,那还怕他们继续为非作歹吗?

我和@logic探讨了在僵尸网络用户发帖第一时间标记(Downvoted)他们帖子的可行性,这样就会便于社区用户识别出这个僵尸网络用户的文章,而无需进行深入的调研。得到的答复是这项工作正在进行中,很快就可以上线了。

同时Hivewatchers团队还提供一些工具可以查询一个用户是否属于黑名单用户,工具链接如下:

https://hivewatchers.io/blacklist-search
https://hive-tools.io/hivewatchers

另外,spaminator网站上有一个完整的滥用者名单(包括这次的僵尸网络用户),可以通过打开名单后使用ctrl + F来搜索,或者使用这个名单构建自己社区的防护机器人等。链接如下:

https://spaminator.me/api/bl/all.txt

感谢Hivewatchers团队在对抗HIVE滥用上的杰出工作,尤其是这次及时地发现并整理出僵尸网络的详细名单,这将有助于各个社区管理者和成员们对抗僵尸网络滥用,而不至于被蒙蔽。

同时,也提醒各个社区的小伙伴,尤其是策展人们擦亮双眼,坚决不让僵尸网络成员拿到1分钱收益,且争取把他们的声望分打击到0,让他们再也无法行骗。

matrix-5361690_960_720.webp
(图源 :pixabay)

在这场战斗中,作为正义的一方,团结的一方,我们一定会取得最终的胜利。

更新于2024-10-28

特别感谢@louis88,他和logic and hivewatchers and another friend 一起对这起僵尸网络攻击时间进行了更深入的调查和挖掘,并揪出了幕后黑手。

Aliento 的管理者也及时发现僵尸网络滥用并做出应对,详情请参考:Oleada de cuentas falsas inundan comunidades populares en Hive [ESP-ENG] (感谢@michupa 提供相关信息)

我相信更多的小伙伴都已经行动起来,只是碍于我了解消息渠道有限,不能在此一一提及,在此一并致谢。

相关链接

Sort:  

Well, i made a bunch of research a few days ago together with logic and hivewatchers and another friend - and found more or less the person behind this spam-attack wave. everything proofed down with screenshots of discussions, registrations etc. And yes, it's related to a Splinterlands Bot-Army and looks like it's someone can't get enough money since he is not anymore able or better say he is only able to monetize the huge amount of Splinterlands Bot Army anymore in Splinterlands and looking for other (unethical) ways to gain profit. idk if i should make my research on this public... if interested in more details - i'm open for discussion on discord.

Edit: As of right now i didnt saw any consequences for this bad action this guy did - either on hive or especially on splinterlands side of things.

He should be named and shamed, both the buyer and seller, but I guess they don't care

Thank you for conducting a thorough investigation and uncovering the mastermind behind the botnet.

Omg 17462 accounts such a huge number which are just farming. It's really big deal for all hive...
And anyway it should be shopped as soon as it possible!

这个数量有点庞大,不过目前有相应对策也能很好的避免类似的情况发生,大家一起共同监督,净化还给HIVE一个好环境。

holy crap that is a crazy amount of accounts made. Someone made an automation for this for sure.

Good you brought it to attention so it doesnt make sense anymore for the scammer to go for it

坚持抵制僵尸号,谢谢O哥告知如此详尽的信息,原来跟那游戏有关。看来专业撸铁的人真是不少,而且疯狂。

谢谢O哥做出的努力,做出的贡献!
我看到那样人发的文章,都加了一脚
希望社区得到净化

感谢hive上的技术领导!感谢咱们中文区的技术领导O哥!这一大篇中英文好高级的文章!
@tipu curate

I know this was tireless and thankless work on your and others' part. But I thank and appreciate you all's efforts. Take care.