[调查报告] 广告信: [通告] 与其在网路上当乡民,不如学会Know How做事业 此广告信最近大量反复出现，分析手法如下: (1) 使用包含中华电信与台湾大哥大多家不同的动态 IP (2) 一律人工注册，很用心的输入假资料 (3) 耐心等待数天注册通过後开始使用 bot ， 找出使用者列表并开始每 225 人寄一份通告 (4) 此人为中华电信固定式 IP 122.116.39.137 的用户 (12/05/2011 仍为此人) 受害者可自行向中华电信抗议 由於使用 bot ，有时出错会在其它看板留下奇怪的名单 (例: #1ErnrzlD (AngelPray) [ptt.cc] ) 近日正在实验新的砍广告信 ID 方法， 整理今日已砍名单如下 (括号内是注册时用的IP): 12/01/2011 14:29:49 faseball 59.120.142.81 (111.248.50.132) 12/01/2011 14:29:53 waxnight 59.120.142.81 (114.45.184.165) 12/01/2011 14:29:56 begoo 59.120.142.81 (210.242.144.78) 12/01/2011 14:29:59 uollyfase 59.120.142.81 (210.242.144.78) 12/01/2011 16:12:51 roallener 114.24.9.113 (115.83.57.191) 部份 bot 在 login 历史记录中使用过 220.133.188.154 同时在当天有来自 220.133.188.155 的使用者进行乱板 推测可能为同用户分身，两个 IP 一起 ban 掉 该 bot 於 12/02 起试图改用水球发信: jjgirl (reg: 11/21/2011 22:27:24 - 115.83.57.191) 12/02/2011 18:17:45 114.24.10.219 hitrustXX (reg: 11/21/2011 22:27:42 59.120.142.81) 12/02/2011 18:18:57 114.24.10.219 kolaromwl (reg: 115.83.57.191 11/21/2011 22:27:42) 12/03/2011 14:31:38 (111.248.49.73) ullerman (reg: 115.83.179.243 11/25/2011 23:53:33) 12/03/2011 14:32:00 (111.248.49.73) felipsco (reg: 115.83.179.243 11/25/2011 23:53:33) 12/03/2011 14:32:23 (111.248.49.73) 之後偶而水球偶而通告信: reaasoney 12/04/2011 20:37:30 122.116.39.137 tellmmewhy 11/09/2011 00:18:40 114.45.182.144 11/29/2011 14:46:39 114.42.103.200 12/04/2011 20:37:05 122.116.39.137 12/04/2011 16:04:53 59.120.142.81 insterfook 11/09/2011 15:05:32 114.24.5.226 11/30/2011 17:26:39 122.116.39.137 12/04/2011 17:23:01 59.120.142.81 12/04/2011 19:58:19 122.116.39.137 daeoovec 11/09/2011 15:26:29 114.24.11.29 11/30/2011 17:27:52 122.116.39.137 12/04/2011 17:24:22 59.120.142.81 12/04/2011 19:58:30 122.116.39.137 一并砍除同来源同期注册帐号: goodguys jjbreae follin cosedo 12/04/2011 16:12:52: careeter usertrue lagega 查下列 ID 应为同一人所持有, 除 kk1981 外先砍除: kk1981 R:10/19/2010 10:26:24 L:12/05/2011 14:19:58 (logins: 228, posts: 6) weishih R:10/20/2010 09:53:20 L:12/05/2011 17:04:23 (logins: 79, posts: 1) tesellamn R:11/07/2011 00:52:02 L:12/05/2011 14:38:07 (logins: 3, posts: 0) laghtco R:11/29/2011 12:41:14 L:12/05/2011 14:08:54 (logins: 2, posts: 0) tellmmewhy R:11/09/2011 00:18:41 L:12/04/2011 20:37:05 (logins: 4, posts: 0) oully R:12/05/2011 13:47:41 L:12/05/2011 13:50:08 (logins: 1, posts: 0) insterfook R:11/09/2011 15:05:34 L:12/04/2011 20:37:16 (logins: 3, posts: 0) daeoovec R:11/09/2011 15:26:30 L:12/04/2011 20:37:23 (logins: 3, posts: 0) reaasoney R:11/09/2011 15:30:27 L:12/04/2011 20:37:30 (logins: 3, posts: 0) hgamer2 R:11/14/2011 16:28:07 L:12/05/2011 15:00:05 (logins: 3, posts: 0) tlalalala R:11/29/2011 12:46:52 L:12/05/2011 14:16:38 (logins: 2, posts: 0) sexxdance R:12/05/2011 13:45:29 L:12/05/2011 13:45:29 (logins: 1, posts: 0) brayntshu R:12/05/2011 13:50:22 L:12/05/2011 13:50:22 (logins: 1, posts: 0) liyifang R:12/05/2011 13:52:43 L:12/05/2011 13:52:43 (logins: 1, posts: 0) catdogbear R:12/05/2011 13:55:12 L:12/05/2011 13:55:12 (logins: 1, posts: 0) relaxxx R:11/29/2011 12:44:30 L:12/05/2011 14:14:13 (logins: 2, posts: 0) foodballer R:11/24/2011 15:19:39 L:12/05/2011 12:22:50 (logins: 2, posts: 0) nutriol R:12/03/2011 14:03:28 L:12/05/2011 12:22:11 (logins: 2, posts: 0)