[調查報告] 廣告信 bot
[調查報告]
廣告信: [通告] 與其在網路上當鄉民,不如學會Know How做事業
此廣告信最近大量反復出現，分析手法如下:
(1) 使用包含中華電信與台灣大哥大多家不同的動態 IP
(2) 一律人工註冊，很用心的輸入假資料
(3) 耐心等待數天註冊通過後開始使用 bot ，
找出使用者列表並開始每 225 人寄一份通告
(4) 此人為中華電信固定式 IP 122.116.39.137 的用戶
(12/05/2011 仍為此人) 受害者可自行向中華電信抗議
由於使用 bot ，有時出錯會在其它看板留下奇怪的名單
(例: #1ErnrzlD (AngelPray) [ptt.cc] )
近日正在實驗新的砍廣告信 ID 方法，
整理今日已砍名單如下 (括號內是註冊時用的IP):
12/01/2011 14:29:49 faseball 59.120.142.81 (111.248.50.132)
12/01/2011 14:29:53 waxnight 59.120.142.81 (114.45.184.165)
12/01/2011 14:29:56 begoo 59.120.142.81 (210.242.144.78)
12/01/2011 14:29:59 uollyfase 59.120.142.81 (210.242.144.78)
12/01/2011 16:12:51 roallener 114.24.9.113 (115.83.57.191)
部份 bot 在 login 歷史記錄中使用過 220.133.188.154
同時在當天有來自 220.133.188.155 的使用者進行亂板
推測可能為同用戶分身，兩個 IP 一起 ban 掉
該 bot 於 12/02 起試圖改用水球發信:
jjgirl (reg: 11/21/2011 22:27:24 - 115.83.57.191)
12/02/2011 18:17:45 114.24.10.219
hitrustXX (reg: 11/21/2011 22:27:42 59.120.142.81)
12/02/2011 18:18:57 114.24.10.219
kolaromwl (reg: 115.83.57.191 11/21/2011 22:27:42)
12/03/2011 14:31:38 (111.248.49.73)
ullerman (reg: 115.83.179.243 11/25/2011 23:53:33)
12/03/2011 14:32:00 (111.248.49.73)
felipsco (reg: 115.83.179.243 11/25/2011 23:53:33)
12/03/2011 14:32:23 (111.248.49.73)
之後偶而水球偶而通告信:
reaasoney 12/04/2011 20:37:30 122.116.39.137
tellmmewhy 11/09/2011 00:18:40 114.45.182.144
11/29/2011 14:46:39 114.42.103.200
12/04/2011 20:37:05 122.116.39.137
12/04/2011 16:04:53 59.120.142.81
insterfook 11/09/2011 15:05:32 114.24.5.226
11/30/2011 17:26:39 122.116.39.137
12/04/2011 17:23:01 59.120.142.81
12/04/2011 19:58:19 122.116.39.137
daeoovec 11/09/2011 15:26:29 114.24.11.29
11/30/2011 17:27:52 122.116.39.137
12/04/2011 17:24:22 59.120.142.81
12/04/2011 19:58:30 122.116.39.137
一併砍除同來源同期註冊帳號:
goodguys jjbreae follin cosedo
12/04/2011 16:12:52: careeter usertrue lagega
查下列 ID 應為同一人所持有, 除 kk1981 外先砍除:
kk1981 R:10/19/2010 10:26:24 L:12/05/2011 14:19:58 (logins: 228, posts: 6)
weishih R:10/20/2010 09:53:20 L:12/05/2011 17:04:23 (logins: 79, posts: 1)
tesellamn R:11/07/2011 00:52:02 L:12/05/2011 14:38:07 (logins: 3, posts: 0)
laghtco R:11/29/2011 12:41:14 L:12/05/2011 14:08:54 (logins: 2, posts: 0)
tellmmewhy R:11/09/2011 00:18:41 L:12/04/2011 20:37:05 (logins: 4, posts: 0)
oully R:12/05/2011 13:47:41 L:12/05/2011 13:50:08 (logins: 1, posts: 0)
insterfook R:11/09/2011 15:05:34 L:12/04/2011 20:37:16 (logins: 3, posts: 0)
daeoovec R:11/09/2011 15:26:30 L:12/04/2011 20:37:23 (logins: 3, posts: 0)
reaasoney R:11/09/2011 15:30:27 L:12/04/2011 20:37:30 (logins: 3, posts: 0)
hgamer2 R:11/14/2011 16:28:07 L:12/05/2011 15:00:05 (logins: 3, posts: 0)
tlalalala R:11/29/2011 12:46:52 L:12/05/2011 14:16:38 (logins: 2, posts: 0)
sexxdance R:12/05/2011 13:45:29 L:12/05/2011 13:45:29 (logins: 1, posts: 0)
brayntshu R:12/05/2011 13:50:22 L:12/05/2011 13:50:22 (logins: 1, posts: 0)
liyifang R:12/05/2011 13:52:43 L:12/05/2011 13:52:43 (logins: 1, posts: 0)
catdogbear R:12/05/2011 13:55:12 L:12/05/2011 13:55:12 (logins: 1, posts: 0)
relaxxx R:11/29/2011 12:44:30 L:12/05/2011 14:14:13 (logins: 2, posts: 0)
foodballer R:11/24/2011 15:19:39 L:12/05/2011 12:22:50 (logins: 2, posts: 0)
nutriol R:12/03/2011 14:03:28 L:12/05/2011 12:22:11 (logins: 2, posts: 0)