Due to recent developments, we've had to lock down this community until further notice. For more information, please take a look at this post: https://feddit.org/post/10515288
Thank you for your understanding.
Just wanted to report that the latest Nicole spam I received 10 min ago is asking for crypto "donations".
So this may be finally the reason for the phishing, getting crypto donations from gullible people.
Looks like this:
https://i.imgur.com/....png (the usual stolen webcam shot and description)
Please donate to help me pay for next semester!
BTC: ...
LTC: ...
XMR: ...
By the way, has anyone contacted Imgur about this? I think they would take it pretty seriously.
I got one just now as well. I suspect it might even be a different person using the Nicole spam as a cover?
Edit: does anyone know, are there any plans to allow users to disable DMs? It feels like it should be a basic privacy feature and would have stopped all this. Mastodon has the same issue (apparently there's an option to stop non followers DMing you, but I can't find it).
...i received the same message yesterday with a new image, so i suspect it's the original spammer finally firing his payload...
This was the username (already reported). The Nicole text was part of the image (green text on black) and the message body was the bitcoin IDs. I find targeting the Fediverse for this type of scam to be a bit pointless. I doubt there are many people on here who would fall for this sort of scam. The only advantage I can see to targeting the Fediverse is the inability to restrict private messages.
I got the message a few mins after logging on. Both times on Lemmy, I got the Nicole spam when online (I can't remember if that was the case on Mastodon). I don't know if that's coincidence.
...i've received nine nicole messages, each from different usernames, but the payload message was from goldeneyeitemis@lemmy.laitinlok.com...
I think the orginal spammer was a loser who got shunned by her, wanted his revenge and posted her pics and info all over to get revenge. (I also think it was the same person who got pissed at me and stalked me all over lemmy for several months, then started using spam bots to track and downvote my posts. As soon as someone mentioned he may have had ties to nicole spam, he deleted his account and disappeared.)
The new spammer is taking advantage and trying to get a payload. Because the whole vibe is different in the new ones.
What makes you think they're linked?
I wrote about it earlier in this same thread: https://lemmy.today/post/27138344/15514958
Basically, the guy who was stalking me had this obsessive, relentless vibe. He’d actually brag about using alt accounts to follow me so I wouldn’t know it was him, and even admitted to “poking” me just to try and make me "snap." Eventually, someone looked into his behavior and discovered he was using a spambot army to follow and mass-downvote me. During that investigation, someone noticed that the domain names tied to the bots matched the ones used in the infamous Nicole spam when it first started. His account also happened to be created right around the time that spam started.
As soon as that slight connection was made public, and after stalking me, trolling me, and downvoting me for months, he suddenly deleted his account (PapaSkwat@lemy.lol -- the account has been deleted, so I feel I can actually name it).
So maybe it’s just coincidence. But his obsessive behavior, his refusal to let anything go, and the way he bragged about using multiple accounts to bug me, and bragging about trying to run me off Lemmy, lines up exactly with the kind of person who might launch a spiteful spam campaign against the girl who is victim of the Nicole spam.
The timeline, the tools he used, and the general attitude; it all fits. Then again, there are plenty of unstable people online, so who really knows. Just my take.
Wow, you're the only person I've heard being targeted by the same person. What'd you do to piss them off?
I posted news articles from conservative sources to conservative communities. lol
He was so mad about it, he'd follow me to non-political communities just to mention it, then would downvote. Then he ramped up his campaign and started using the spambots.
For example, in a Positivity community, I posted a short post about my scooting on a nice day, "Great day for a simple scoot." He unleashed the bot on it and it has 60 downvotes. https://lemmy.today/post/27013791
Notice that after he got called out and deleted his acount, now my posts there eventurally get up to the regular-ish 5 upvotes that those sort of posts typically get. (They always start out early with a "0" though, because there is still another person that downvotes all my posts. But that person doesn't unleash bots on me, so all good) !positivity@lemmy.today
In the middle of his hate campaign against me, I actually asked him why didn't he just block me or the 3 conservative communities I posted to. And he said that he wanted to keep bugging me to make sure that I left Lemmy.
It was weird. I never even thought of leaving Lemmy, so not that big of a deal to me. But it's super fascinating to me that there are people out there who actively want to hate and be unhappy. So strange. Lemmy is just an online forum, no idea why so many take it so seriously.
Obviously me being a conservative on Lemmy means I get plenty of downvotes and spite. I'm fine with that. It's expected. After ragging on me a few times, most get bored and realize that I'm not going anywhere, so they just block me and/or conservative communities.
But that dude was on a whole 'nother level. LMAO
Again, I don't know for sure he was the same guy who's behind the Nicole campaign, just that the timing and his behavior totally lines up with it all. Just my personal theory and I have no solid proof at all.
hate campaign
You're blameless and think other people take Lemmy too seriously?
Apparently others thought it was the posters fault too and realized that he was bad enough to cause defederation: https://sh.itjust.works/post/35952149
As per that thread: "The targeted accounts are all outspoken users with very similar political opinions. I assume whoever is running the downvote accounts doesn’t like their politics."
I'm sure the poster is probably already back under an alt. Probably started another account 4 or 5 days ago. Guess he better cut back on the Nicole spam and downvote bots this time though. :)
Well this got real accusatory too quick for my blood. Good luck with your hate campaign or whatever.
I have no hate campaign, as I have no hate towards anyone. I didn't start the investigations into spambots or defed issues.
But I def hope they find the loser Nicole spammer guy. Incels like that need to be banned and dealt with accordingly because it's unhealthy for awesome places like Lemmy.
I only posted conservative articles to conservative communities though, so he had no reason to be so weird about it.
He was obsessive and stalked me, and used a freakin' bot army to follow me and downvote me. That's too far, and it's weird behavior. He probably also did it to other people he didn't like. That fits with the M.O. of the original Nicole spammer: a loser who can't accept rejection.
This thread isn't about me. It's about Nicole spam. I gave my feedback and theories about who it might be and why I thought that. That's it.
It's clearly not the same as the gore spammer if real nicole spam is still happening
I just received a DM from a new account following the same pattern as the gore spam, 2+ year old account and the image link named after my username. This time it was a red anime picture saying "Do you like insanity?". Same person as the second actor?
I just got the same shit. And I'm guessing the previous two DMs were also the same. I didn't realize that the links were to something other than my profile.
It looks like they're now posting the 1st gore image directly to communities everywhere.
Got that dm as well. They are posting the dead nicole image. I reverse image searched it and it's from a gore website.
It's description is
Murdered woman on autopsy table CHINA Leaked footage from a Chinese morgue shows a woman who died after being attacked with a machete. The attacker stabbed her neck several times and almost cut off her ear. Other details are unknown.
Caution, full link has a dead body
It has a pastebin link
Pgp public key
`-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEZ/ltsRYJKwYBBAHaRw8BAQdAirxngMSSqXGY0goRu5FeYPoSz6lGJPloz47n AKE4LIC0FUx1Y3kgPGx1Y3lAbHVjeS5sdWN5PoiTBBMWCgA7FiEEJmm9ee5H8hQN ujkVxRtYJXxnnZQFAmf5bbECGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AA CgkQxRtYJXxnnZRMdAD/ZTLsn1ece6qnGdNXodRdo9Eow4gOYbxq4AC8i4aaZZUB APOWxTjeK+YTsJu8Si3yEFrA7D6iCMnNS4yu0Kh4JrsGuDgEZ/ltsRIKKwYBBAGX VQEFAQEHQET+MYK1cO9X2eH5jPx5bKyjgY+NCJ7gCBHntxyATBA8AwEIB4h4BBgW CgAgFiEEJmm9ee5H8hQNujkVxRtYJXxnnZQFAmf5bbECGwwACgkQxRtYJXxnnZTw IgEAzjCEEcCnezg291terQ7/2nDar50S2UM+MHVJvllMqp0A/3oOmeKLPwZY9fwh oev5mxZRkrxq4Ori1i+bqhOh45sN =BA26 -----END PGP PUBLIC KEY BLOCK-----`
Key's registered owner
I looked it up, and the other pictures on that site show the woman's face in it's entirety up close. It definitely isn't Nicole.
Same account that just messaged me.
I think if Lemmy doesn’t have the infrastructure to defend against attacks like these which are presumptively conducted by one bad actor, then it doesn’t have the infrastructure to defend against wealthy organizations when our communities do get big enough to be noticed by them.
This community’s history underscores how the messaging system in particular needs a massive overhaul; using image recognition as a filter for messages like Lemmy.World does for image posts (with options for NSFW that isn’t NSFL?), preventing images (and URLs? or only allowing white-listed sites?) from being sent within the first message sent between users (unless a box is ticked?), not showing message recipients images until they are directly opened, and preventing the de-anonymizing of message recipients should be made first priority for the next patch.
I agree that it’s unclear if this newest bad actor sending the graphic image(s?) is that same one sending the vanilla images.
I think they should add a feature, that automatically notifies admins when a single account sends a bunch of messages in a short time (dor DMs, comments and posts) and maybe they should also get an instant temporary ban until the admins have evaluated the situation.
Has anyone been getting "regular" Nicole spam since the gore picture event? If so, do they resemble the old style of spam in terms of content and instance it's sent from?
yes, someone did: https://fedia.io/m/meta@quokk.au/t/2038892
More indication then that the gore spammer was a secondary actor.
I think the following happened:
I think the latest message is just from a random psycho that either wants attention or likes to see how people react.
I therefore suggest the following:
I also think this is what happened, at least until somebody convinces me the dead person is the same person as "Nicole". I know they bore a passing resemblance, but to my eye they were different people.
It's not. It's from a gore website.
So I may have a distant and weird connection to the originator of the Nicole spam. No proof, but here's my case.
I had this weird stalker on Lemmy—PapaSkwat@lemy.lol (account’s deleted now, so I think it’s fine to name him). Someone else did some digging and found out he was using a bot army to follow me around and downvote my posts.
While people were investigating that, they noticed something strange: the domains used by his bots matched the original Nicole spam domains.
Then, right after that investigation thread dropped, PapaSkwat suddenly deleted his profile. The same profile that had been active since around the time the Nicole spam started. And he’d been trolling and stalking me for months. One of his comments even admitted he was deliberately poking me to make me "snap.”
There’s this theory that the whole Nicole spam thing might’ve started as revenge. Like, maybe some guy got dumped or rejected, got obsessed, and started blasting her pics everywhere because he couldn’t let it go.
That kinda lines up with my stalker’s behavior. He’d get mad, obsessive, and go out of his way to tell people how awful I was. He even bragged about using alt accounts just to mess with me.
It was bizarre.
So here’s the chain: weird stalker gets outed for running downvote bots → bots are tied to Nicole spam domains → stalker suddenly vanishes → and now Nicole is “dead” (not for real, but metaphorically, like the spam just ends).
Maybe the guy realized the jig was up and decided to kill off the whole Nicole thing too?
I have no clue, no proof other that people's assumptions. It just seems a strange coincidence that my weird stalker guy disappears right after rumblings come up of him being involved in Nicole spam. Then right after he disappears, this dead nicole spam comes up.
Here’s the bot investigation post (2 Instances are being used for coordinated vote manipulation, and should be defederated. chinese.lol lemmy.doesnotexist.club): https://hackertalks.com/post/8713785
And here's a screenshot where he brags to someone about trying to make me "snap" and another where he brags to me directly about having alt names to stalk me too:
I sincerely doubt this has anything to do with you at all, and the only link is that those instances seem to have absentee admins who aren't taking action to ban users. Which is attractive to both spammers and botters.
So here’s the chain: weird stalker gets outed for running downvote bots → bots are tied to Nicole spam domains → stalker suddenly vanishes → and now Nicole is “dead” (not for real, but metaphorically, like the spam just ends).
Maybe the guy realized the jig was up and decided to kill off the whole Nicole thing too?
No. That is in fact not the chain of events as both regular "Nicole" spam and the gore spam (and now the anime picture spam) have continued well past your "stalker" got banned. In fact, both types of spam seem to still be ongoing.
Regular "Nicole" spam and the gore/anime spam have also occurred (and is still occurring) in parallel, with culprits using different origin instances.
Everything suggests this is (at least) two different, separate actors.
This might actually be a very good hint on who the spammer is. Thank you a lot for sharing.
Is it? Aren't both regular Nicole spam and the potential "second actor" spam still ongoing?
I do believe those instances were chosen for the same reason though, as they seem to have absentee admins who aren't banning spammers and botters.
Do you think somebody should publicise the hash of the image? Since that'll perhaps make it easier for admins to remove without compromising any privacy
That seems like a good solution that could catch a lot of it, but they should definitely use a perceptual hash, otherwise the spammer could just barely alter the image and bypass the filters again.
I would like to thank the instance admins dealing with this. I haven't seen any apart from the initial wave.
IMO it would be in good taste to remove the community's title image until more is known.
Do we know if anyone has tried a reverse image search? That might be one way to confirm that it's someone sending gore for shock value just to be an asshole.
I reverse image searched it and it's two years old.
Murdered woman on autopsy table CHINA Leaked footage from a Chinese morgue shows a woman who died after being attacked with a machete. The attacker stabbed her neck several times and almost cut off her ear. Other details are unknown.
Thank you for the update. That makes me feel more confident this is a copycat. They're an asshole either way.
Yikes, damn, it went in an awful direction very quickly... a very messed up situation, it's a good thing I didn't get those pictures, I'm very sensitive to that kind of thing. The jokes ended (as often happens) because of some sick bastard, and it looks like we may have been playing along with this bastard all along.
