Printable
Index
News
20071113 - Fake_ Fanclub_ Revealed

Fake Fanclub Revealed

2007-11-13 written by Spacesynth.net Team

Today we have disabled the accounts of multiple users from the Spacesynth.net forum. The reason for this is that they were all created by one source and are not real persons. These users have been used to promote a record label Hypersound Productions.

People who have been around in the community for a while know very well these people and the history. To re-cap: for many years various spacesynth forums have been crowded by a group of users who have an identical taste of music, same opinions and same writing style – and they all love Hypersound. They were involved in many fights and flames on forums and frequently put down labels that were competing with Hypersound. It all looked like they were a group of fanatic people from various countries with a mission. But eventually it got so surreal that we started to do some research of who these people really are.

Our forum software quickly shows if there are IP connections between users. First we noticed that many of these users were sharing same IP addresses. Our alarm bells started ringing. Forum posts usually came in groups, posted within one hour and all agreeing with each other. Furthermore, we did some additional programming to the software to help us with this research and we started to monitor their IP’s on daily basis.

Some of the mentioned users have their own websites. These websites have only content that is linked to Hypersound such as album covers of all Hypersound releases. The persons behind these users were always hidden and remained a mystery. No photos of them were ever shown for example. Their writing style is strikingly similar with same spelling errors, same usage of colors and same vocabulary even though they say they come from different countries and continents. Also, these users were used to visit the Spacesynth channel on IRCnet, mostly to promote Hypersound releases and badmouth competitors. All these IRC conversations and IP’s were logged which we investigated. Other non-spacesynth websites have also been used for the same agenda.

All IP addresses were traced to one Internet Service Provider located in Switzerland called Bluewin.ch. As we know, Hypersound office is located in Switzerland. So logically we checked if there was any connection between these users and Hypersound.

We were utterly astonished by our findings.

By comparing timestamps and IP addresses of forum posts and Hypersound’s e-mails it was revealed that they were sent from the same computer. This was confirmed multiple times and required patience and a bit group effort to confirm. The time difference between forum posts and e-mails from Hypersound’s office was so small that realistically it was not possible that they were using same IP’s by chance. We also contacted Spacesynth.de about this and they confirmed our findings about IP's. Anyone with some technical knowledge would notice and know that the IPs are being reserved about one day for certain computer (or computers) behind the specific ISP connection (in geek terms; normal behavior for DHCP).

We wanted to know how Hypersound team can explain that their computers were used for this so we sent them the following e-mail.

Greetings Hypersound Team,

It has come to our attention that several usernames posting at Spacesynth.net and Spacesynth.de forums are one and the same person. This person has created multiple accounts and uses them to heighten Hypersound Productions to a degree that fills the description of promoting. The claimed persons behind the usernames do not exist in real life.

These users say they come from several different countries and different continents. However, tracked IP addresses show that the forum posts and e-mails from these particular usernames come from the same place. To be more specific, they originate from Switzerland using the same Internet Service Provider - Bluewin.

One of the persons posting from the same IP address is "Andreas Bosseler" (using pseudonyms "andreasb" or "M-Freak") who, according to your website, is now working for Hypersound. We have been analyzing e-mails and comparing them to forum posts dating back to early 2000. The result of our research is that there's an undeniable connection between the fake users and Hypersound Office. It's been confirmed multiple times that the Hypersound office uses exactly the same IP addresses.

We have been monitoring the situation extensively for a few months now and collecting evidence with the help of several other people. We have gone through numerous forum posts and e-mails sent to different people. Also we put up a system to our forum to monitor its usage selectively to help this research.

Now after our research, we have enough evidence to take this public. We of course don't have any other choice than to remove these usernames from our forum because the actions that have been shown are against netiquette and is not tolerated. The fact that this has been put together to promote a company makes this a more serious issue. The usernames have also been used to badmouth competitors. Such methods are totally unfair to competing record labels.

The following usernames at the Spacesynth.net and Spacesynth.de forums will be removed because of Internet Abuse:

Ackaert, baroni, Denis, Electro, konstantinos, M-Freak, Proxyon, space-dance, Zsolt, Alessandro, Jabdah, jkramer, Lars, Laser-Simon, Marcel, mark keaton, Patrick

If you require more detailed evidence, such as time stamped cross referencing of data, as IP addresses collected from various sources, we can provide those of course. The evidence is such that it's undeniable. This data also tells us that the person uses sometimes Windows XP computer and sometimes Mac OSX computer.

Before making this issue public, we are giving Hypersound Productions a chance to explain what is your involvement in the issue. We are expecting your reply to the matter soon.

signed,
the administrators of
SPACESYNTH.NET
SPACESYNTH.DE
SPACESYNTH DISCUSSION GROUP

Humphrey Robertson's reply:

hello team, we were very surprized to hear about these forum users and that our ip address was used. we have checked our system and somehow our browser was used for posts on the mentioned forums! some years ago we gave remote access to our system for file exchange and it looks like someone hacked the password and used our browser for posts.(we also found cookies) that prove your findings. we now have deleted all access to our system. If you should get more posts from these users check the ips. From our side it should not be possible to do this anymore.

Kind regards
Humphrey Robertson

All these years someone has been secretly using Hypersound's system to promote the company? We decided to ask for some further technical details to find out how this was possible and sent this e-mail:

Hello,

Thanks for checking it out.

This sounds a very surprising finding. May we ask what software you are using which was compromised? ie. what remote access software you were using for the file exchange and what kind of setup (of hardware and software) you have there for remote access?

Do you have any logging of the unauthorized remote access as basis of this password hacking? That is besides the cookies (in this case it would be just two cookies, one for each forum), which don't really tell anything except that your computer browsers were used for visiting and logging in into the forums; and that we already know 100% sure. You implicated there was some other information.

Hope to hear from you soon.

SPACESYNTH.net team

But they didn't have more to add. Humphrey Robertson replied back with the following:

Hello
we don't have anymore info that we gave you last time.

for us the problem is solved (we have closed the "leak" in our system)
kind regards
Humphrey

The whole detective process took long because we wanted to be absolutely sure that we are not barking up the wrong tree. This "leak", as Humphrey Robertson puts it, has been practiced for years and has caused many harmful incidents to the community. It is both surprising and highly disappointing that the trails eventually led to Hypersound's computers. Our job is not to be the judge but to tell people what they should know. From our side, the case is closed.

We want to thank everyone who have been helping and being patient with us. During the years we have wasted so much time dealing with these users but now it's time put an end to that show. It feels that the community has a new era ahead. So let's just enjoy the music and keep the positive spirit alive.

- SPACESYNTH.net Team

Discussion

Discuss more this news in the forum

Fake Fanclub Revealed

Discussion

More News To Read