[SPAM] Where does bot spam come from? [INQUIRY] [NET DETECTIVE] (56)

1 Name: Anonymous Addict : 2021-01-07 20:09 ID:A2XHXRdb

I once uploaded Kareha onto a server I was running from home, purely just to test the software and study the code. I didn't advertise the board to anybody, and only made three test threads. Amazingly, after having forgotten about the board, and coming back a year later, I found it full of spam and links.

Everybody knows about textboard spam, wakaba's /soc/ board was removed after being spammed to oblivion, the site that wrote the original gazouBBS (futaba's sourcecode) script's demonstration boards were also full of spam comments written in English, so on, we've all seen it.

Where is it actually coming from though? Has anybody ever gone down the rabbithole of internet spam and bots? How do they find no-name sites that nobody visits? What is their end goal? Who actually runs these bots? Is anybody even running these bots or have they been on autopilot for decades? Is there a network of spammers? What is your experience with spam?

Within the past three years or so, "scambaiting" has become a popular genre of youtube and twitch content, with people investigating tech support scammers and robotcallers and whatnot, but I feel like nobody really cares about the rabbithole of people spamming on websites, when it is just as vast and fascinating.

2 Name: Anonymous Addict : 2021-01-07 23:49 ID:uoRGEjrM

I find it hard to imagine an actual SEA sweatshop specialized on finding unused or unmoderated textboard installations... I'm guessing it's the occasional worker stumbling across a board and dumping all of his scheduled content there. Finding them is probably easy enough, just search for "kareha.pl".

It would be interesting to compare IPs and other patterns, but I'm doubt any active admins keep records of deleted herbal remedy links, and in the case of boards filled with spam there's probably some reason for the admin to be completely absent.

3 Name: Anonymous Addict : 2021-01-17 11:41 ID:+CPx5YYQ

I more wonder how often boards get hit with it out of malice, like how arisuchan was hit with a CP bomb that made the admins give up, rather than just being caught in an automated thing.

4 Name: Anonymous Addict : 2021-01-18 06:09 ID:Yt3C/El8

>>3
Rumor has it the occasional CP ad threads that have been popping up on niche IBs lately are manual rather than automated.

5 Name: Anonymous Addict : 2021-01-18 12:41 ID:A2XHXRdb

>>3,4
Just recently 7clams was hit with a cp bomb. relatively obscure hidden board that was run on the domain that 7chan hosts a lot of static files from. Was up for over 10 years before the bomb. Sad.

6 Name: Anonymous Addict : 2021-02-23 21:02 ID:/nXkVKbk

It feels like running your own anonymous imageboard or even textboard is just too risky these days thanks to the CP bombers, and there's not much point in running one when people are just going to use the big 2 imageboards anyways. It's a shame people just give up, I miss small cozy imageboards like shanachan so much.

7 Name: Anonymous Addict : 2021-02-26 07:59 ID:GG2qyXl0

>>6
it is absolutely possible to have a textboard without worrying about those things
there are HUNDREDS of abandoned japashit textboards with no cp of any kind, all you need to do is put some ngword/filters to stop those fags

8 Name: Anonymous Addict : 2021-02-26 08:20 ID:/mvml0vi

>>7
Or if you're a moderator checking the site more than once a week, leg alone a goddamn year.

9 Name: Anonymous Addict : 2021-03-09 11:58 ID:kTIDk2bz

It's so weird. For fun, I made it so that if you try to visit my IP address directly (instead of going to a vhost) you get a form that sends me an e-mail. A few days after I put it on, I started getting daily mails just saying "0x[]=androxgh0st". What does it mean?!

10 Name: Anonymous Addict : 2021-03-14 12:24 ID:7n0ZhPLW

Here's a fun exercise: pick a random old post, ideally one distinctive enough that you won't find much similar elsewhere, and google it. Then, go to the very last few pages of results. If you picked your phrase well, you will find a bunch of automatically-generated websites with random urls and content composed of low-res memes from decades ago, what might be CP, and pages upon pages of mangled stolen posts from various boards.
Maybe it's some elaborate way of getting money from ad revenue, but I don't understand how. No one will be visiting a url that looks like it came out of Satan's anus. There's definitely some elaborate money-making scheme tied up in there somewhere.

As for the spam that imageboards/textboards get, is it possible that the spambots used also operate on other types of boards as well? Maybe some relatively common spambot software package comes with built in support for various bits of imageboard software. I'd imagine that the spambot's authors implemented support for spamming Wakaba and Kareha boards back when there were far more around. Interested spammers continue to pay for use of said spambot services and they coincidentally end up including imageboards as a target. I expect that good spambot software is intelligent enough these days to automatically detect what is a forum it can post on.

I've always suspected that the CP ad spam could be federal agents trying to bait paedophiles into revealing themselves. That, or some pissed-off imageboard admins trying to get competitors shut down. Or maybe the links go to malware downloads that some skiddie is using to build up his cryptocurrency mining botnet. Probably all three, really.

11 Name: 408 - Name Request Timeout : 2021-03-14 19:21 ID:A2XHXRdb

>>10
You mean stuff like this? https://g-runth.com/x8kb46/what-does-based-mean-4chan-d8410b

The internet is a strange place.

This part of the internet is incredibly strange to me and I wish I understood what was happening here.

12 Name: 401 - Unauthorized Name : 2021-03-14 20:59 ID:y5h+X+yg

>>10
Oh yeah, it cracks me up whenever some retard YouTube video essayist actually cities "the POW Forums" or some similar site. Its probably just a way to farm e-mail addresses.

13 Name: 422 - Unprocessable Name : 2021-04-03 07:12 ID:oC0VaLyy

goat scrote

14 Name: 422 - Unprocessable Name : 2021-04-05 21:54 ID:Heaven

https://4-ch.net/img/res/508.html#1215
do you think the guy who posted this feels embarrassed

15 Name: 401 - Unauthorized Name : 2021-04-06 08:04 ID:Heaven

>>14
nvm, adblock hid the links on desktop. so probably not.

16 Name: 415 - Unsupported Name Type : 2022-04-02 20:30 ID:1w8wfsMe

>>6
This is why running a textboard is far better compared to an imageboard, no images = no illegal content. Obviously you still get pieces of shit who advertise links, but I can imagine is less of a headache for sysadmins to deal with.

17 Name: 403 - Name Forbidden : 2022-04-04 06:49 ID:WvCuu334

This all sounds a lot like that Dead Internet Theory thing.

18 Name: 408 - Name Request Timeout : 2022-05-26 19:32 ID:RZyrtCr5

hell, I administrate multiple websites and that "real rap ed woman" spam (which has been going on for a long while now) is getting out of hand in the last few days. I don't even know what is it's goal, but all files it links to are being hosted on different premium file hosts (meaning you need to pay the file host some money to download). Truly getting sick of it.
One more thing, it's man-made. I confirmed this multiple times by watching its patterns (e.g. posting in an existing thread to see which part of his message is being blocked by the regex filter i implemented, making a word play on the blocked part etc)

19 Name: 403 - Name Forbidden : 2022-05-26 21:26 ID:Heaven

rap ed (rap education)

20 Name: 409 - Name Conflict : 2022-07-01 05:08 ID:1YsRNjBa

This is a very interesting topic.

21 Name: 406 - Name Not Acceptable : 2022-07-02 03:41 ID:1YsRNjBa

>>1,9,18
For some reason this thread's been on my mind for a while now. If you're willing, I'd like to ask a few questions on this topic and maybe turn it into an article if I have the energy for it and the passion on the topic doesn't fizzle away. I won't be making any money on it and I'd keep it as anonymous as you'd want it.

22 Name: 403 - Name Forbidden : 2022-07-22 03:36 ID:TMK9ROPw

from bots

23 Name: 403 - Name Forbidden : 2022-07-24 14:06 ID:uOj8BtCf

>>18
Do you think that "real r**ed women" spam and the illegal content spam are the doing of the same people? For being man made, it's astonishing how aggressive and persistent it is. There has to be an endgame, but what it is is beyond me.

24 Name: 422 - Unprocessable Name : 2022-07-25 12:06 ID:dHzt9cV9

This thread reminds me of people who begin with an interest in a group of conspiracy theorist believers (e.g. Flat Earthers) and in their journey to understand the thought process of their subjects, they gradually develop a bizarre fascination and end up becoming the very thing they initially ridiculed.

If anyone here ends up evolving into a BBS spam bot manager and/or BBS spam bot, please detail your experiences in this thread.

25 Name: 409 - Name Conflict : 2022-07-30 01:55 ID:DZxXfsV8

>>16
You can do what multichan does and use image links to source embedded images. Best of both worlds. You get images but can outsource the liability.

26 Name: 408 - Name Request Timeout : 2022-07-30 08:43 ID:Heaven

>>25
If you do that don't forget to limit it to specific hosts only so people don't embed their own trackers to datamine users.

27 Name: 422 - Unprocessable Name : 2022-08-23 04:42 ID:blVLru5i

people keep posting cpz on my favorite altchan
is it feds or cloudflare

i think its just pedos

28 Name: 403 - Name Forbidden : 2022-09-14 12:26 ID:qJtDLLAl

The quality varies a lot, this new guy seems to have figured out how to use the name/link fields AND html formatting to spam his shoe (?) websites.

29 Name: 403 - Name Forbidden : 2022-09-15 15:07 ID:M+fR2ryk

>>28
I think you meant hoe websites.

30 Name: 422 - Unprocessable Name : 2022-09-16 05:47 ID:Heaven

30get

31 Name: 422 - Unprocessable Name : 2022-09-20 02:03 ID:Heaven

>>28
That spam bot has been around for a long while now. I'm guessing it was originally made to seek out blog comment sections, I've seen similar spam on those and those also have name/email fields and either HTML or BBCode formatting. Actually, just supporting BBCode is enough to summon a swarm of spambots.

32 Name: 406 - Name Not Acceptable : 2023-01-08 01:33 ID:XHYVBWyG

>>1
Very interesting, certainly. In my opinion it must be spam bot farms, some of which left running for decades (have you noticed Usenet spam has not evolved from the typical garbage links?), or even paid Indian spammers
>>27
Feds seek imageboards out to post CP in them to get them shut down. If the janitors/moderators are proactive removing the spam, the feds observe when the janitors/moderators are asleep to perform the spam again, or even, in the worst rumoured cases, actually become janitors and begin antagonizing the userbase to get them to abandon ship.

33 Name: 422 - Unprocessable Name : 2023-03-17 09:50 ID:Heaven

>>32
I have heard fed this glowie that, but do you have any proof or evidence for this?

34 Name: 410 - Name Gone : 2023-07-06 06:12 ID:CDfICpJZ

Merorin has been getting hit by CP spammers that are not bots, but manually posted

I dunno why

35 Name: 405 - Name Not Allowed : 2023-07-18 07:17 ID:hulg03OS

>How do they find no-name sites that nobody visits

https website certs are publicly available in a certificate transparency log and this is one way bots find domains to check

36 Name: 422 - Unprocessable Name : 2023-08-15 21:28 ID:YjPYTmMf

>>10

Those randomly generated sites are exploiting Google Search's AI-powered search engine and they do get ad revenue from it. What the owners of these sites do is build a scraper with Python, implement it into their (monetized) Wordpress website where they churn out endless low-quality articles, and somehow, Google picks it up and it lands on the first page of the search results.
They're always in the middle or the last part of the search results yet that seems to be enough to make money off it.
I've started noticing that because whenever I look up something programming-related, I come across a low quality site that very obviously stole a q&a from StackOverflow.

37 Name: 403 - Name Forbidden : 2023-09-27 14:37 ID:roDRU/e+

spam bots are from nashville

38 Name: 403 - Name Forbidden : 2023-09-30 13:01 ID:bR5FHXI/

Cloudfare spread the cheese pizza to blackmail little sites into paying them protection money. They have a big server full of CP that only top execs have full access to. They have a secret basement in their HQ where they have teams of people employed to spam sites with kiddie porn and take them down.

39 Name: 408 - Name Request Timeout : 2023-11-20 11:42 ID:Heaven

An interesting pattern I've noticed, dark-net sites have much less cp advertising, even those that allow explicitly pro-pedo posts (though not actual porn). Gets my noggin joggin'.

40 Name: 410 - Name Gone : 2023-11-20 11:44 ID:ryHFQ6q1

>>27
CP bombing is a very common way of getting forums taken down. I know some gay-ops groups hoard CP just for that purpose.

41 Name: 409 - Name Conflict : 2023-11-21 02:37 ID:Heaven

>>39
Well, it's probably much harder to automate spamming of a dark-net site

42 Name: 415 - Unsupported Name Type : 2023-11-22 23:51 ID:Heaven

>>41
It should actually be easier, since you don't need to worry about IP blocking and most sites won't have advanced anti-ddos/bot services like what cloudflare gives.

43 Name: 403 - Name Forbidden : 2023-11-23 02:37 ID:/yW3zxM+

Ota died because of illegal spam

44 Name: 408 - Name Request Timeout : 2023-11-27 01:40 ID:govTpM4P

It seems that there is someone or something routinely posting CP on schedule across multiple small imageboards, usually on the same days and on the same boards on a schedule. They use similar or identical images and they’ve been getting more and more graphic and extreme. No idea where they come from but a janny on another board say they think it’s a botnet although why it exists and what it’s far remains a mystery. Naturally, everyone blames the feds or claim it’s a law enforcement entrapment scheme but it’s probably to spread Chinese malware or something?

45 Name: 410 - Name Gone : 2023-11-30 02:41 ID:oPIyagTt

>>44
It's been going on for nearly a de ade now, if not longer. I know exactly what spam you're talking about.

I saw another chan admin theorize that it's actually third worlders being paid to post it manually. Grim.

With that said, if it's still happening, that must mean they've caught a few fish.

46 Name: 406 - Name Not Acceptable : 2023-11-30 20:29 ID:9V16lshk

>>45
Not all of it, but some of it is definitely third world manual spam. I've witnessed arabic IPs posting under residential IPs and going past custom captcha.

47 Name: 410 - Name Gone : 2023-12-03 11:14 ID:pC2z8SKs

>>45
>>46
3rd world manual spammer seems like the worst fucking job ever.

> "Go back to the content mines, Suparman, we need more adSense revenue and SEO money!"

48 Post deleted.

49 Post deleted.

50 Post deleted.

51 Post deleted.

52 Post deleted.

53 Name: 406 - Name Not Acceptable : 2024-02-05 20:57 ID:govTpM4P

Here's an interesting post. Apparently, it isn't bot spam at all but coming from commercial CP peddlers. They seem to hit the most active boards on any given site.
https://trashchan.xyz/meta/thread/374.html

54 Name: 415 - Unsupported Name Type : 2024-02-23 02:28 ID:Heaven

>>53
This kinda confirms what I already knew, that it was manual spam.

55 Name: 405 - Name Not Allowed : 2024-03-27 13:06 ID:Heaven

On the subject of spam, I was scrolling through Google Images at random and found this rather funny algorithmically generated store scam.

It presents itself as a store, except all the products are random images grabbed off the web with titles grabbed off whatever page the original image was on.
Each image has a random price attached, and all of them have 50% "discounts" on them. The page implies that the images are actual shippable products, and the payment button is surrounded by various antivirus logos as a guarantee of safety. Many of the images do not in any way correspond to real products and are are titled in totally incoherent ways, often with the name of the original site they were grabbed off listed as part of their title (some of them are grabbed off Wikipedia and have the "[article name] - Wikipedia" as their name). Each product page has a flashy countdown for until the discount ends (always under 2 hours from what I saw), a warning that the item is almost out of stock, occasionally a high "X people are viewing this right now" number, and a vast collection of generic reviews that do nothing to indicate what you are actually buying.

The "About US" page on the site reads as if it was either AI generated or written by some ESL and has some very dubious capitalization choices. The site footer links to jquery.com for some reason.

The product categories are rather funny too - the "kids sunglasses" category had a subcategory for "kids sunglasses" with a subcategory for "kids sunglasses" and "towel" under that. The "jewelry" category has another "jewelry" subcategory which then has "mens bracelets" and "hand bracelet" under it. Most of them have similarly repetitive category nesting. Some categories do not work at all. Some of the categories take you to a different url entirely, running the same scam store software and looking totally identical but with a different listing of categories.

The site search does not work.

I guess the hope is that one of the images (which they are clearly scraping at random off the web) would correspond to an actual product someone might want and some elderly person would see the antivirus logos, think that makes it safe, and give them their credit card number. The page I saw first was all of "products" that are obviously things you cannot buy, but looking at the front page most of the products there are real things grabbed off Amazon or other stores, and I could definitely see someone dumb or tech illiterate falling for it. Looking on archive.org, the url used to belong to a real business too.

I am almost tempted to try buying something from there to see what exactly gets shipped, if anything. Almost.

This sort of algorithmic spam fills me with great child-like joy and provides me with never-ending humor. I enjoy it deeply.



For the curious,
The site:
shoppb.tireshop-kokubo (dot) com/

First page I landed on:
rocheap.bedandbreakfaststamford (dot) org/category?name=elliptic%20curves%20and%20modular%20forms

(I feel this is insulting to anyone reading, but please remember this is a scam and don't try to buy anything or visit without a content blocker of some kind.)

56 Name: 403 - Name Forbidden : 2024-04-07 14:15 ID:Heaven

Link:
Leave these fields empty (spam trap):
More options...
Verification: