[SPAM] Where does bot spam come from? [INQUIRY] [NET DETECTIVE] (64)

1 Name: Anonymous Addict : 2021-01-07 20:09 ID:A2XHXRdb

I once uploaded Kareha onto a server I was running from home, purely just to test the software and study the code. I didn't advertise the board to anybody, and only made three test threads. Amazingly, after having forgotten about the board, and coming back a year later, I found it full of spam and links.

Everybody knows about textboard spam, wakaba's /soc/ board was removed after being spammed to oblivion, the site that wrote the original gazouBBS (futaba's sourcecode) script's demonstration boards were also full of spam comments written in English, so on, we've all seen it.

Where is it actually coming from though? Has anybody ever gone down the rabbithole of internet spam and bots? How do they find no-name sites that nobody visits? What is their end goal? Who actually runs these bots? Is anybody even running these bots or have they been on autopilot for decades? Is there a network of spammers? What is your experience with spam?

Within the past three years or so, "scambaiting" has become a popular genre of youtube and twitch content, with people investigating tech support scammers and robotcallers and whatnot, but I feel like nobody really cares about the rabbithole of people spamming on websites, when it is just as vast and fascinating.

15 Name: 401 - Unauthorized Name : 2021-04-06 08:04 ID:Heaven

>>14
nvm, adblock hid the links on desktop. so probably not.

16 Name: 415 - Unsupported Name Type : 2022-04-02 20:30 ID:1w8wfsMe

>>6
This is why running a textboard is far better compared to an imageboard, no images = no illegal content. Obviously you still get pieces of shit who advertise links, but I can imagine is less of a headache for sysadmins to deal with.

17 Name: 403 - Name Forbidden : 2022-04-04 06:49 ID:WvCuu334

This all sounds a lot like that Dead Internet Theory thing.

18 Name: 408 - Name Request Timeout : 2022-05-26 19:32 ID:RZyrtCr5

hell, I administrate multiple websites and that "real rap ed woman" spam (which has been going on for a long while now) is getting out of hand in the last few days. I don't even know what is it's goal, but all files it links to are being hosted on different premium file hosts (meaning you need to pay the file host some money to download). Truly getting sick of it.
One more thing, it's man-made. I confirmed this multiple times by watching its patterns (e.g. posting in an existing thread to see which part of his message is being blocked by the regex filter i implemented, making a word play on the blocked part etc)

19 Name: 403 - Name Forbidden : 2022-05-26 21:26 ID:Heaven

rap ed (rap education)

20 Name: 409 - Name Conflict : 2022-07-01 05:08 ID:1YsRNjBa

This is a very interesting topic.

21 Name: 406 - Name Not Acceptable : 2022-07-02 03:41 ID:1YsRNjBa

>>1,9,18
For some reason this thread's been on my mind for a while now. If you're willing, I'd like to ask a few questions on this topic and maybe turn it into an article if I have the energy for it and the passion on the topic doesn't fizzle away. I won't be making any money on it and I'd keep it as anonymous as you'd want it.

22 Name: 403 - Name Forbidden : 2022-07-22 03:36 ID:TMK9ROPw

from bots

23 Name: 403 - Name Forbidden : 2022-07-24 14:06 ID:uOj8BtCf

>>18
Do you think that "real r**ed women" spam and the illegal content spam are the doing of the same people? For being man made, it's astonishing how aggressive and persistent it is. There has to be an endgame, but what it is is beyond me.

24 Name: 422 - Unprocessable Name : 2022-07-25 12:06 ID:dHzt9cV9

This thread reminds me of people who begin with an interest in a group of conspiracy theorist believers (e.g. Flat Earthers) and in their journey to understand the thought process of their subjects, they gradually develop a bizarre fascination and end up becoming the very thing they initially ridiculed.

If anyone here ends up evolving into a BBS spam bot manager and/or BBS spam bot, please detail your experiences in this thread.

25 Name: 409 - Name Conflict : 2022-07-30 01:55 ID:DZxXfsV8

>>16
You can do what multichan does and use image links to source embedded images. Best of both worlds. You get images but can outsource the liability.

26 Name: 408 - Name Request Timeout : 2022-07-30 08:43 ID:Heaven

>>25
If you do that don't forget to limit it to specific hosts only so people don't embed their own trackers to datamine users.

27 Name: 422 - Unprocessable Name : 2022-08-23 04:42 ID:blVLru5i

people keep posting cpz on my favorite altchan
is it feds or cloudflare

i think its just pedos

28 Name: 403 - Name Forbidden : 2022-09-14 12:26 ID:qJtDLLAl

The quality varies a lot, this new guy seems to have figured out how to use the name/link fields AND html formatting to spam his shoe (?) websites.

29 Name: 403 - Name Forbidden : 2022-09-15 15:07 ID:M+fR2ryk

>>28
I think you meant hoe websites.

30 Name: 422 - Unprocessable Name : 2022-09-16 05:47 ID:Heaven

30get

31 Name: 422 - Unprocessable Name : 2022-09-20 02:03 ID:Heaven

>>28
That spam bot has been around for a long while now. I'm guessing it was originally made to seek out blog comment sections, I've seen similar spam on those and those also have name/email fields and either HTML or BBCode formatting. Actually, just supporting BBCode is enough to summon a swarm of spambots.

32 Name: 406 - Name Not Acceptable : 2023-01-08 01:33 ID:XHYVBWyG

>>1
Very interesting, certainly. In my opinion it must be spam bot farms, some of which left running for decades (have you noticed Usenet spam has not evolved from the typical garbage links?), or even paid Indian spammers
>>27
Feds seek imageboards out to post CP in them to get them shut down. If the janitors/moderators are proactive removing the spam, the feds observe when the janitors/moderators are asleep to perform the spam again, or even, in the worst rumoured cases, actually become janitors and begin antagonizing the userbase to get them to abandon ship.

33 Name: 422 - Unprocessable Name : 2023-03-17 09:50 ID:Heaven

>>32
I have heard fed this glowie that, but do you have any proof or evidence for this?

34 Name: 410 - Name Gone : 2023-07-06 06:12 ID:CDfICpJZ

Merorin has been getting hit by CP spammers that are not bots, but manually posted

I dunno why

35 Name: 405 - Name Not Allowed : 2023-07-18 07:17 ID:hulg03OS

>How do they find no-name sites that nobody visits

https website certs are publicly available in a certificate transparency log and this is one way bots find domains to check

36 Name: 422 - Unprocessable Name : 2023-08-15 21:28 ID:YjPYTmMf

>>10

Those randomly generated sites are exploiting Google Search's AI-powered search engine and they do get ad revenue from it. What the owners of these sites do is build a scraper with Python, implement it into their (monetized) Wordpress website where they churn out endless low-quality articles, and somehow, Google picks it up and it lands on the first page of the search results.
They're always in the middle or the last part of the search results yet that seems to be enough to make money off it.
I've started noticing that because whenever I look up something programming-related, I come across a low quality site that very obviously stole a q&a from StackOverflow.

37 Name: 403 - Name Forbidden : 2023-09-27 14:37 ID:roDRU/e+

spam bots are from nashville

38 Name: 403 - Name Forbidden : 2023-09-30 13:01 ID:bR5FHXI/

Cloudfare spread the cheese pizza to blackmail little sites into paying them protection money. They have a big server full of CP that only top execs have full access to. They have a secret basement in their HQ where they have teams of people employed to spam sites with kiddie porn and take them down.

39 Name: 408 - Name Request Timeout : 2023-11-20 11:42 ID:Heaven

An interesting pattern I've noticed, dark-net sites have much less cp advertising, even those that allow explicitly pro-pedo posts (though not actual porn). Gets my noggin joggin'.

40 Name: 410 - Name Gone : 2023-11-20 11:44 ID:ryHFQ6q1

>>27
CP bombing is a very common way of getting forums taken down. I know some gay-ops groups hoard CP just for that purpose.

41 Name: 409 - Name Conflict : 2023-11-21 02:37 ID:Heaven

>>39
Well, it's probably much harder to automate spamming of a dark-net site

42 Name: 415 - Unsupported Name Type : 2023-11-22 23:51 ID:Heaven

>>41
It should actually be easier, since you don't need to worry about IP blocking and most sites won't have advanced anti-ddos/bot services like what cloudflare gives.

43 Name: 403 - Name Forbidden : 2023-11-23 02:37 ID:/yW3zxM+

Ota died because of illegal spam

44 Name: 408 - Name Request Timeout : 2023-11-27 01:40 ID:govTpM4P

It seems that there is someone or something routinely posting CP on schedule across multiple small imageboards, usually on the same days and on the same boards on a schedule. They use similar or identical images and they’ve been getting more and more graphic and extreme. No idea where they come from but a janny on another board say they think it’s a botnet although why it exists and what it’s far remains a mystery. Naturally, everyone blames the feds or claim it’s a law enforcement entrapment scheme but it’s probably to spread Chinese malware or something?

45 Name: 410 - Name Gone : 2023-11-30 02:41 ID:oPIyagTt

>>44
It's been going on for nearly a de ade now, if not longer. I know exactly what spam you're talking about.

I saw another chan admin theorize that it's actually third worlders being paid to post it manually. Grim.

With that said, if it's still happening, that must mean they've caught a few fish.

46 Name: 406 - Name Not Acceptable : 2023-11-30 20:29 ID:9V16lshk

>>45
Not all of it, but some of it is definitely third world manual spam. I've witnessed arabic IPs posting under residential IPs and going past custom captcha.

47 Name: 410 - Name Gone : 2023-12-03 11:14 ID:pC2z8SKs

>>45
>>46
3rd world manual spammer seems like the worst fucking job ever.

> "Go back to the content mines, Suparman, we need more adSense revenue and SEO money!"

48 Post deleted.

49 Post deleted.

50 Post deleted.

51 Post deleted.

52 Post deleted.

53 Name: 406 - Name Not Acceptable : 2024-02-05 20:57 ID:govTpM4P

Here's an interesting post. Apparently, it isn't bot spam at all but coming from commercial CP peddlers. They seem to hit the most active boards on any given site.
https://trashchan.xyz/meta/thread/374.html

54 Name: 415 - Unsupported Name Type : 2024-02-23 02:28 ID:Heaven

>>53
This kinda confirms what I already knew, that it was manual spam.

55 Name: 405 - Name Not Allowed : 2024-03-27 13:06 ID:Heaven

On the subject of spam, I was scrolling through Google Images at random and found this rather funny algorithmically generated store scam.

It presents itself as a store, except all the products are random images grabbed off the web with titles grabbed off whatever page the original image was on.
Each image has a random price attached, and all of them have 50% "discounts" on them. The page implies that the images are actual shippable products, and the payment button is surrounded by various antivirus logos as a guarantee of safety. Many of the images do not in any way correspond to real products and are are titled in totally incoherent ways, often with the name of the original site they were grabbed off listed as part of their title (some of them are grabbed off Wikipedia and have the "[article name] - Wikipedia" as their name). Each product page has a flashy countdown for until the discount ends (always under 2 hours from what I saw), a warning that the item is almost out of stock, occasionally a high "X people are viewing this right now" number, and a vast collection of generic reviews that do nothing to indicate what you are actually buying.

The "About US" page on the site reads as if it was either AI generated or written by some ESL and has some very dubious capitalization choices. The site footer links to jquery.com for some reason.

The product categories are rather funny too - the "kids sunglasses" category had a subcategory for "kids sunglasses" with a subcategory for "kids sunglasses" and "towel" under that. The "jewelry" category has another "jewelry" subcategory which then has "mens bracelets" and "hand bracelet" under it. Most of them have similarly repetitive category nesting. Some categories do not work at all. Some of the categories take you to a different url entirely, running the same scam store software and looking totally identical but with a different listing of categories.

The site search does not work.

I guess the hope is that one of the images (which they are clearly scraping at random off the web) would correspond to an actual product someone might want and some elderly person would see the antivirus logos, think that makes it safe, and give them their credit card number. The page I saw first was all of "products" that are obviously things you cannot buy, but looking at the front page most of the products there are real things grabbed off Amazon or other stores, and I could definitely see someone dumb or tech illiterate falling for it. Looking on archive.org, the url used to belong to a real business too.

I am almost tempted to try buying something from there to see what exactly gets shipped, if anything. Almost.

This sort of algorithmic spam fills me with great child-like joy and provides me with never-ending humor. I enjoy it deeply.



For the curious,
The site:
shoppb.tireshop-kokubo (dot) com/

First page I landed on:
rocheap.bedandbreakfaststamford (dot) org/category?name=elliptic%20curves%20and%20modular%20forms

(I feel this is insulting to anyone reading, but please remember this is a scam and don't try to buy anything or visit without a content blocker of some kind.)

56 Name: 403 - Name Forbidden : 2024-04-07 14:15 ID:Heaven

57 Name: 422 - Unprocessable Name : 2024-05-15 13:14 ID:D+PxtbAM

>>9

Necro, so it wouldnt have been known as well back in 2021 when you posted, but androxgh0st is a (now) well known malicious web scanner that tries to scan sites for exposed credentials and then tries to use those credentials to compromise your assets so that they can be used as part of a spam botnet.

Feds have good details on it now https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a

androxgh0st will probe a page with POST requests sending strings similar to what you mentioned in the message body, so if your form method is POST on the emailer page, it may be taking that message body and doing the needful with it and sending it to you as an email according to whatever logic you have setup to handle the form.

58 Name: 401 - Unauthorized Name : 2024-05-18 21:32 ID:qGl7mFpm

>>55
That's something that has been bothering me for so long, you could look up the most random of queries like "steven universe background art" and get those sites

59 Post deleted.

60 Name: 409 - Name Conflict : 2024-07-02 18:18 ID:1cYwnKk/

>>53
that is old as fuck lol the owner of jschan (tom) had discovered that the cp poster was a real person

61 Name: 415 - Unsupported Name Type : 2024-07-22 21:39 ID:C8hLuW0V

null has mentioned once or twice that he thinks it's feasible the background radiation of spam to be prevented, but that Cloudflare, Google, etc. choose not to because they passively profit from it. I don't know how that's possible, but perhaps the specifics don't even matter, as long as the incentive structure is there. The actual spam is just entropy in principle.

And it doesn't help that very few people actually use the clearnet and are instead populating the massive darknets that have cannibalized the Internet such as the site formerly known as Twitter, Facebook, Discord. And I do mean darknet, because you can't access any of that stuff publically, can't even scrape most things anymore; you need to make an account and an api key -- and even then, it's not easy to get a clear picture of what's going on.

62 Name: 401 - Unauthorized Name : 2025-02-06 04:45 ID:RiaLCYFn

spam, i.e. unsolicited content, comes from people unsolicited by real economy, i.e. spam. you are spam, and your parents who made you for personal entertainment are spammers.

63 Name: 401 - Unauthorized Name : 2025-02-07 14:30 ID:Het82kHl

>>61
Given that pretty much everything Google does exists to be a vector for their adcrap, I wouldn't be surprised at all if they have some deals made to consider some spammers "legitimate" on things like search and GMail as long as they get a cut of the profits. I definitely get far less spam on the other mailboxes I switched to when I ditched GMail, but it's hard to tell how much that's GMail vs. how much I might've given the old address to some site that sold it around. (I also speculate that there might be spammers who just make up random GMail addresses on a bot to send spam to, but that's just speculation.)

As for your bit on the abandonment of WWW pages for things like Discord, on the one hand it does kind of suck, but on the other it's kind of understandable, running a WWW page is exhausting since you're basically putting it out there for any rando to interact with. And it's not just spam or what you'd probably think of as "bad attention", even having "fans" can lead to a lot of tiring "when update?" type messages, or trying to recruit you to their project that's vaguely related to your site topic (talking here about people who are "real" as opposed to driveby spam). So I can see the appeal of wanting to just make a friend group and share stuff to them instead of the world at large.

As for the topic of spamposts on boards like this one in particular, I do wonder if part of the scam is in the redirect links themselves; I know some redirector sites also run a "show ads on the redirection page, give you a cut" racket.

64 Name: 422 - Unprocessable Name : 2025-02-12 05:42 ID:HJ+uCA2x

Kind of spooky when you think about it

Link:
Leave these fields empty (spam trap):
More options...
Verification: