Due to recent developments, we've had to lock down this community until further notice. For more information, please take a look at this post: https://feddit.org/post/10515288
Thank you for your understanding.
Just wanted to report that the latest Nicole spam I received 10 min ago is asking for crypto "donations".
So this may be finally the reason for the phishing, getting crypto donations from gullible people.
Looks like this:
https://i.imgur.com/....png (the usual stolen webcam shot and description)
Please donate to help me pay for next semester!
BTC: ...
LTC: ...
XMR: ...
By the way, has anyone contacted Imgur about this? I think they would take it pretty seriously.
It's clearly not the same as the gore spammer if real nicole spam is still happening
I just received a DM from a new account following the same pattern as the gore spam, 2+ year old account and the image link named after my username. This time it was a red anime picture saying "Do you like insanity?". Same person as the second actor?
Got that dm as well. They are posting the dead nicole image. I reverse image searched it and it's from a gore website.
It's description is
Murdered woman on autopsy table CHINA Leaked footage from a Chinese morgue shows a woman who died after being attacked with a machete. The attacker stabbed her neck several times and almost cut off her ear. Other details are unknown.
Caution, full link has a dead body
It has a pastebin link
Pgp public key
`-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEZ/ltsRYJKwYBBAHaRw8BAQdAirxngMSSqXGY0goRu5FeYPoSz6lGJPloz47n AKE4LIC0FUx1Y3kgPGx1Y3lAbHVjeS5sdWN5PoiTBBMWCgA7FiEEJmm9ee5H8hQN ujkVxRtYJXxnnZQFAmf5bbECGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AA CgkQxRtYJXxnnZRMdAD/ZTLsn1ece6qnGdNXodRdo9Eow4gOYbxq4AC8i4aaZZUB APOWxTjeK+YTsJu8Si3yEFrA7D6iCMnNS4yu0Kh4JrsGuDgEZ/ltsRIKKwYBBAGX VQEFAQEHQET+MYK1cO9X2eH5jPx5bKyjgY+NCJ7gCBHntxyATBA8AwEIB4h4BBgW CgAgFiEEJmm9ee5H8hQNujkVxRtYJXxnnZQFAmf5bbECGwwACgkQxRtYJXxnnZTw IgEAzjCEEcCnezg291terQ7/2nDar50S2UM+MHVJvllMqp0A/3oOmeKLPwZY9fwh oev5mxZRkrxq4Ori1i+bqhOh45sN =BA26 -----END PGP PUBLIC KEY BLOCK-----`
Key's registered owner
I looked it up, and the other pictures on that site show the woman's face in it's entirety up close. It definitely isn't Nicole.
Same account that just messaged me.
I just got the same shit. And I'm guessing the previous two DMs were also the same. I didn't realize that the links were to something other than my profile.
It looks like they're now posting the 1st gore image directly to communities everywhere.
So I may have a distant and weird connection to the originator of the Nicole spam. No proof, but here's my case.
I had this weird stalker on Lemmy—PapaSkwat@lemy.lol (account’s deleted now, so I think it’s fine to name him). Someone else did some digging and found out he was using a bot army to follow me around and downvote my posts.
While people were investigating that, they noticed something strange: the domains used by his bots matched the original Nicole spam domains.
Then, right after that investigation thread dropped, PapaSkwat suddenly deleted his profile. The same profile that had been active since around the time the Nicole spam started. And he’d been trolling and stalking me for months. One of his comments even admitted he was deliberately poking me to make me "snap.”
There’s this theory that the whole Nicole spam thing might’ve started as revenge. Like, maybe some guy got dumped or rejected, got obsessed, and started blasting her pics everywhere because he couldn’t let it go.
That kinda lines up with my stalker’s behavior. He’d get mad, obsessive, and go out of his way to tell people how awful I was. He even bragged about using alt accounts just to mess with me.
It was bizarre.
So here’s the chain: weird stalker gets outed for running downvote bots → bots are tied to Nicole spam domains → stalker suddenly vanishes → and now Nicole is “dead” (not for real, but metaphorically, like the spam just ends).
Maybe the guy realized the jig was up and decided to kill off the whole Nicole thing too?
I have no clue, no proof other that people's assumptions. It just seems a strange coincidence that my weird stalker guy disappears right after rumblings come up of him being involved in Nicole spam. Then right after he disappears, this dead nicole spam comes up.
Here’s the bot investigation post (2 Instances are being used for coordinated vote manipulation, and should be defederated. chinese.lol lemmy.doesnotexist.club): https://hackertalks.com/post/8713785
And here's a screenshot where he brags to someone about trying to make me "snap" and another where he brags to me directly about having alt names to stalk me too:
I sincerely doubt this has anything to do with you at all, and the only link is that those instances seem to have absentee admins who aren't taking action to ban users. Which is attractive to both spammers and botters.
So here’s the chain: weird stalker gets outed for running downvote bots → bots are tied to Nicole spam domains → stalker suddenly vanishes → and now Nicole is “dead” (not for real, but metaphorically, like the spam just ends).
Maybe the guy realized the jig was up and decided to kill off the whole Nicole thing too?
No. That is in fact not the chain of events as both regular "Nicole" spam and the gore spam (and now the anime picture spam) have continued well past your "stalker" got banned. In fact, both types of spam seem to still be ongoing.
Regular "Nicole" spam and the gore/anime spam have also occurred (and is still occurring) in parallel, with culprits using different origin instances.
Everything suggests this is (at least) two different, separate actors.
I didn't mean to imply that it had anything to do with me in that sense. Just that maybe the same guy who stalked me on here could be the same person behind the Nicole spam.
The creepy vibes I had from him also seemed to match up for the kind of person who would do the Nicole spam--someone who takes the smallest slight and blows it up and goes for revenge and just doesn't stop. Goes to the trouble of setting up and using bots to downvote my every post. Alt names just to follow me and give me shit and downvote. Took glee in taunting that I'd snap and quit Lemmy--which he also mentioned several times.
Definitely the same kind of guy who would take offense when some random girl doesn't give him attention, so he captures pics of her and spams all of Lemmy to creep her out and make her look bad.
But there are lots of weirdos like that in the world I guess.
(Special shout-out to the Lemmy's who supported his harassment of me though. That kind of toxic behavior doesn't help Lemmy.)
This might actually be a very good hint on who the spammer is. Thank you a lot for sharing.
Is it? Aren't both regular Nicole spam and the potential "second actor" spam still ongoing?
I do believe those instances were chosen for the same reason though, as they seem to have absentee admins who aren't banning spammers and botters.
Has anyone been getting "regular" Nicole spam since the gore picture event? If so, do they resemble the old style of spam in terms of content and instance it's sent from?
yes, someone did: https://fedia.io/m/meta@quokk.au/t/2038892
More indication then that the gore spammer was a secondary actor.
I think if Lemmy doesn’t have the infrastructure to defend against attacks like these which are presumptively conducted by one bad actor, then it doesn’t have the infrastructure to defend against wealthy organizations when our communities do get big enough to be noticed by them.
This community’s history underscores how the messaging system in particular needs a massive overhaul; using image recognition as a filter for messages like Lemmy.World does for image posts (with options for NSFW that isn’t NSFL?), preventing images (and URLs? or only allowing white-listed sites?) from being sent within the first message sent between users (unless a box is ticked?), not showing message recipients images until they are directly opened, and preventing the de-anonymizing of message recipients should be made first priority for the next patch.
I agree that it’s unclear if this newest bad actor sending the graphic image(s?) is that same one sending the vanilla images.
I think that we need to rethink how federation is done. Currently I can just spin up a server, federate with everyone and start sending spam DMs and do harmful stuff like vote manipulation on a mass scale. That won't scale at all when the bad actors come
Others have suggested that one should prevent images in messages altogether. Or at least if in the first message of an exchange. Or at least for new accounts or accounts without posts.
Coupling these ideas with federation, the following comes to mind:
Enable each instance to select from which other instances its users can receive messages with or without images.
Allow instance admins to set, individually for each instance they federate with, minimum requirements on accout age, number of posts, received upvotes etc., before (image) messages are accepted from an individual account. E.g. higher requirements if the account is on a poorly moderated instance. Or it has to have made at least one post or comment on the instance to whose user it wants to send a message.
In a different vein, which might be needed when Lemmy & other Fediverse services with private messages attract even more attention:
Most of these suggestions could probably work for upvotes/downvotes as well (only that it's more difficult to identify accounts that only manipulate votes and do nothing else – so an even fancier version of 3., perhaps even with broadcasting spam scores about individual accounts, could be needed).
I think they should add a feature, that automatically notifies admins when a single account sends a bunch of messages in a short time (dor DMs, comments and posts) and maybe they should also get an instant temporary ban until the admins have evaluated the situation.
Yeah. IDK anything about the code behind lemmy but some kind of DM limiter or alert seems trivial.
I think the following happened:
I think the latest message is just from a random psycho that either wants attention or likes to see how people react.
I therefore suggest the following:
I also think this is what happened, at least until somebody convinces me the dead person is the same person as "Nicole". I know they bore a passing resemblance, but to my eye they were different people.
It's not. It's from a gore website.
I would like to thank the instance admins dealing with this. I haven't seen any apart from the initial wave.
Do you think somebody should publicise the hash of the image? Since that'll perhaps make it easier for admins to remove without compromising any privacy
That seems like a good solution that could catch a lot of it, but they should definitely use a perceptual hash, otherwise the spammer could just barely alter the image and bypass the filters again.
Do we know if anyone has tried a reverse image search? That might be one way to confirm that it's someone sending gore for shock value just to be an asshole.
I reverse image searched it and it's two years old.
Murdered woman on autopsy table CHINA Leaked footage from a Chinese morgue shows a woman who died after being attacked with a machete. The attacker stabbed her neck several times and almost cut off her ear. Other details are unknown.
Thank you for the update. That makes me feel more confident this is a copycat. They're an asshole either way.
Multiple people said they tried, but it didn't come back with anything useful. Just with more gore. Then again, it might be from a Tor website...
Thanks for the info. The whole thing is despicable.
The end of an era
Isn’t this what they would want?
Maybe - but I, and a big part of the members of this community don't see how this should continue otherwise
IMO it would be in good taste to remove the community's title image until more is known.
Yikes, damn, it went in an awful direction very quickly... a very messed up situation, it's a good thing I didn't get those pictures, I'm very sensitive to that kind of thing. The jokes ended (as often happens) because of some sick bastard, and it looks like we may have been playing along with this bastard all along.
Yikes, the fun is over now. This has escalated too much.
The way lemmy is designed this will just happen again and again.
We don't need messaging features, it shouldn't be possible to DM users
There has to be a solution. Love it or hate it, DMs, I feel, are a necessary for social networking apps. I don't want to have to download another app if I want to send a direct message to someone on here.
I'm sure there's a good reason why it's difficult to implement but I'm surprised there's no rate limiter on DMs.
We don’t need messaging features, it shouldn’t be possible to DM users
Еh? Messaging is great, what are you talking about? 🤨 Sometimes you want to message a person personally, it would be very stupid to throw away the DM feature, in my opinion.
At least you don't have to have three page long threads. And if you don't understand the context or want a help with something, then use DMs.
