Case study. The specifics of “hunting” in the asian segment
I don't currently have a private practice (only in exceptional cases), but once a person named B. approached me with a specific request that I found very interesting to look into.
It's a short case, but I still wanted to share it.
How it all began
B. makes fairly specific, narrowly focused applications (not in a bad way :) ). At some point, he found out that someone from asian forums had started selling his applications, promising additional bonus features. B didn't care about legal disputes, he was just consumed by curiosity: “Who needed this and why? What bonus features are they promising?”
Let's go?
The content appeared on various asian forums such as 52pojie and Kanxue. We found several such ads on one chinese resource: the same nickname, preview, description, Telegram as the contact point, and we also found payment details. Telegram was clean and recently created, and the crypto addresses did not provide any useful information.
So, should we work with the nickname? It would be desirable to find additional accounts, possibly some reviews about this seller, discussions about him, where there might be new information.
The nickname problem
In a normal situation, we would copy the nickname and start searching for it using dorks and various nickname search resources, but not today. We tried, of course, but it didn't yield any significant results. As it turns out, this method does not always work on the asian internet. Why?
- Nicknames are rarely used as exact strings.
- They are almost never copied verbatim.
- They exist more as a description or sound than as a stable unique identifier.
- The same set of characters can have different meanings depending on the context, for example, being part of an expression rather than an identifier.
A nickname in such discussions is not a unique name, but an “object of retelling,” so when a user with a latin nickname appears on an asian (chinese, for example) forum, the following happens:
- someone rewrites the nickname in characters based on how it sounds
- someone shortens it
- someone describes it (“that seller with the nickname X”)
- someone uses a hybrid of latin and local characters
As a result, the nickname begins to exist in several forms at once, and none of them are required to match the original string. The same thing happens if the original nickname is not in latin but in chinese characters.
So the task was not to find the exact same nickname, but to reconstruct how it might have been retold or adapted.
Furthermore, it is advisable to consider adaptation for several languages, including russian and english.
What does the direct phonetic transcription into chinese characters look like?
Total possible transcription: 诺瓦艾克斯
This is not a translation of the meaning - it is a representation of the sound.
In reality, in conversations and discussions, no one writes the full phonetic nickname, they write an abbreviated version because long transcriptions are inconvenient. For example:
These same parts can be combined, simplified, or joined together, for example: 诺艾斯 or 瓦艾, etc.
That is, different people can write different variants that sound similar but do not match verbatim
Sometimes it can be even worse, and semantic variations appear. This is when, in transcription, the choice of characters can not only convey the sound, but also bring additional meaning - depending on the characters chosen. I don't fully understand how this works, but there seem to be examples.
One possible option is 诺瓦克 (nuò wǎ kè), which sounds close to the original:
- 诺 - nuò (means “promise, agreement”)
- 瓦 - wǎ (means “roof tile, ceramic tile”)
- 克 - kè (often used in borrowings)
Or 牛娃想 - niú wá xiǎng, ox + child + think/want.
Linguists and people familiar with East Asian languages, please correct me if I am mistaken.
Continued
We did find mentions of this seller on a couple of american forums, but this did not yield any new information. More interesting information was found on a Korean forum, where one user wrote about fraud in the reviews (surprisingly, only one), but wrote quite a long time ago.
Initially, we collected all possible variations of the nickname so that we could check each one separately. On this forum, we came across a rather unusual spelling of the name, which we decided to check right away. Since the review was written a long time ago, perhaps it would be related to the seller's old accounts, which we could use to identify the person?
That's how it turned out. This nickname was linked to other accounts on various IT forums (but on different topics and in completely different areas), and one of them had a link to facebook for communication. The facebook account was under his real name (we later wrote to him for fun), with a photo, but without any specific details.
It immediately reminded me of a situation when I managed to identify one “anonymous” person from a cybersecurity community: his account had a link to his website. The website was empty, but it had been indexed by the web archive a long time ago, and the old version of the website had a link to a vk (vkontakte) group with only one administrator. The page was also empty, but vkhistory (tool) came to our rescue - the page previously had a phone number listed. I checked the data against his messages from various telegram chats - everything matched.