AnimeSuki Forums

Register Forum Rules FAQ Members List Social Groups Search Today's Posts Mark Forums Read

Go Back   AnimeSuki Forum > General > Forum & Site Feedback

Notices

Reply
 
Thread Tools
Old 2013-01-25, 08:49   Link #1
demonix
Senior Member
 
 
Join Date: Jul 2006
Location: Hayes, Middx UK
Age: 35
Send a message via Yahoo to demonix Send a message via Skype™ to demonix
does AS have anything to do with Helion research

I am wondering this as I received an e-mail yesterday through my hotmail account (which isn't the account I used to register) from that company advertising a mystery shopper job which I thought was just some unsolicited spam until I noticed the URL it asked me to visit (they did mask the last bit with a few x's, but this is what I saw which has been broken to stop anyone clicking on it).

hXXp://www.helionresearch.com/evaluator/r/animesuki

Now I'm not sure if my data was handed to them by this place, or if they crawled the profiles looking for any viable e-mail addresses since the only one they could get from my account was the MSN one (if the latter is the case since user profiles can be viewed by anyone, then it might be a good idea to lock profiles views down to registered users only).
demonix is offline   Reply With Quote
Old 2013-01-25, 09:42   Link #2
RWBladewing
Elderly "Love Live!" Fan
 
 
Join Date: Oct 2007
Location: Listening to "Aishiteru Banzai!" on repeat
Age: 30
You have the user "HelionResearch" in your list of recent profile visitors (as do I and several other members) so it's a good bet that your theory about profile crawling is correct. Also, you can set your profile to only be viewable by registered users; it's under "Edit Options" in the User CP. Though unfortunately that wouldn't have actually helped in this case since that spam account managed to register and view profiles before being banned.
RWBladewing is offline   Reply With Quote
Old 2013-01-25, 11:08   Link #3
Cosmic Eagle
宿命に全てを奪われた少女
 
 
Join Date: Jan 2009
Location: 宿命と時間の巻きに
Isn't registered users the default? Just don't post your email so openly
__________________
Cosmic Eagle is offline   Reply With Quote
Old 2013-01-25, 15:11   Link #4
Kudryavka
Senior Member
 
 
Join Date: May 2009
No, AS doesnt have anything to do with Helion research. That email you got was just from a spammer who saw your email on your profile.
Kudryavka is offline   Reply With Quote
Old 2013-01-25, 15:41   Link #5
relentlessflame
 
*Administrator
 
 
Join Date: Dec 2003
Age: 32
Yeah, this seems like a sort of phishing campaign.

1. Join a forum (become a registered member)
2. Scrape useful data from as many public profiles as you can
3. Send spam that alludes to the forum, hoping that makes it more believable/likely to be clicked

The MSN Messenger address is a prime target for this, since it's in the form of a valid/working E-mail address. (But with MSN Messenger being phased out in most places, that problem may be going away.)

We'll have to think if there's anything we can do to prevent this, or at least to make it more difficult. But I do thank you for bringing it up, at least so it can be clear that, no, this has nothing to do with the site or its staff, and we certainly do not authorize this use of the Forum Profile data.
__________________
[...]
relentlessflame is offline   Reply With Quote
Old 2013-01-25, 18:47   Link #6
monir
cho~ kakkoii
*Moderator
 
 
Join Date: Nov 2003
Location: 3rd Planet
Yikes! Well, even when I used to chat, privacy is pretty much the main reason why I've never listed any MSN, ICQ, Yahoo Messenger etc. under my profile. I cringe anytime I see such in any users profile. In this age of cellphone, chatting is dieing a slow death, and even if I want to chat with someone, I would rather PM the person with my info than listing it under my profile.

Perhaps we should just consider disabling the option to add Instant Messaging all together from the user profile, or am I overreacting?
__________________
Eat and sleep! And Solace. Sig by RRW.
Space Brothers Executive member of the ASS. Ready to flee at the first sign of trouble.
monir is offline   Reply With Quote
Old 2013-01-25, 19:03   Link #7
NoemiChan
Banned
 
Join Date: Oct 2010
Location: Philippines
Age: 26
Send a message via Yahoo to NoemiChan Send a message via Skype™ to NoemiChan
What is Helion research anyway?
NoemiChan is offline   Reply With Quote
Old 2013-01-25, 19:06   Link #8
Kudryavka
Senior Member
 
 
Join Date: May 2009
Quote:
Originally Posted by GenjiChan View Post
What is Helion research anyway?
let me google that for you
Kudryavka is offline   Reply With Quote
Old 2013-01-25, 19:07   Link #9
NoemiChan
Banned
 
Join Date: Oct 2010
Location: Philippines
Age: 26
Send a message via Yahoo to NoemiChan Send a message via Skype™ to NoemiChan
Quote:
Originally Posted by Kudryavka View Post
Thanks..... hmmm and I thought it was interesting..
NoemiChan is offline   Reply With Quote
Old 2013-01-25, 19:17   Link #10
Kudryavka
Senior Member
 
 
Join Date: May 2009
Quote:
Originally Posted by GenjiChan View Post
Thanks..... hmmm and I thought it was interesting..
No problem man.
Kudryavka is offline   Reply With Quote
Old 2013-01-26, 09:11   Link #11
demonix
Senior Member
 
 
Join Date: Jul 2006
Location: Hayes, Middx UK
Age: 35
Send a message via Yahoo to demonix Send a message via Skype™ to demonix
Quote:
Originally Posted by monir View Post
Perhaps we should just consider disabling the option to add Instant Messaging all together from the user profile, or am I overreacting?
Your overreacting as these crawlers can only benefit from IM systems like MSN/WLM where you need the full e-mail address to be able to add someone on that client, so removing those that require that (although since MSN/WLM is being shut down soon, it would most likely be better if the MSN messenger handle part of the instant messaging section in the edit your details part of the use CP was removed even though those people who merge their microsoft and skype accounts could use either as a skype ID once WLM is shut down).

I've now done some changes to my profile, removing my MSN details and adding my skype ID.

It also looks like the profile visibility option doesn't work since it is set to members only, yet I was able to view my profile without logging in (it looks like that option doesn't cover everything since the rest of the profile that can be viewed without logging in is controlled by the profile privacy section of the user CP as once I'd put my contact details to members only they didn't show if I'm not logged in).
demonix is offline   Reply With Quote
Old 2013-01-26, 21:36   Link #12
relentlessflame
 
*Administrator
 
 
Join Date: Dec 2003
Age: 32
Quote:
Originally Posted by demonix View Post
It also looks like the profile visibility option doesn't work since it is set to members only, yet I was able to view my profile without logging in (it looks like that option doesn't cover everything since the rest of the profile that can be viewed without logging in is controlled by the profile privacy section of the user CP as once I'd put my contact details to members only they didn't show if I'm not logged in).
I'm not sure that I quite follow this, but I think "Profile Visibility" just means that the more detailed profile info is hidden. You can view the basic profile no matter what, but it's a question of how many details are shown. So I'm pretty sure, again if I'm understanding correctly, that this is by design.
__________________
[...]
relentlessflame is offline   Reply With Quote
Old 2013-02-02, 10:20   Link #13
NightWish
…Nothing More
*Administrator
 
 
Join Date: Mar 2003
Age: 34
Quote:
Originally Posted by demonix View Post
It also looks like the profile visibility option doesn't work ...
You could argue it is a bug, but relentlessflame is correct in that it is working as designed. Only the design hasn't been well conveyed and the "bug" is that the options form was misleading to older users (those who joined the forum before the option was added).

When the option was added the default was set to "Members Only", because I thought that was the best option for new accounts being created. Partly it was for privacy and partly to stop spammers from joining and filling their profiles with links in visitor messages. Most bots (and most human spam teams) don't know to change the option because it is bespoke.

However, we didn't want to just change how the forum worked for existing users. Indeed some wanted it to stay as it was. Unfortunately this compromised meant I missed an important detail. The way the form looks if you don't have any value set in the profile option. If the default had been the same as existing users, it wouldn't have been a problem.

The forum software correctly sets default options for new profiles, but not existing ones. So while it said "Members Only", because that is the default, your profile didn't actually have the privacy setting set to anything at all, it was blank. The logic that decided if you can see the page was treating this lack of setting as it always had: "everyone can see this page". Changing the setting and saving would correct this.

I've since fixed the step I missed before that means the profile correctly reflects how the forum will handle the setting regardless of when you registered (i.e. everyone has a profile visibility set explicitly now). I've also changed the display logic to fail-to-private (so if a blank does creep in again it will fail to members only this time).

Oh and I've taken the liberty of changing your settings to Members Only. If you repeat your logged-out viewing test it should block as intended. My apologies for the confusion and any leak of information that may have resulted.
__________________
🐾
…to be bold, to be brave; it is the thinking that the heart can still be saved.
And the darkness can come quick. The danger's in the anger and the hanging on to it.
NightWish is offline   Reply With Quote
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -5. The time now is 21:01.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.
We use Silk.