Anti-spam: Blocking questions whose bodies end with a raw hyperlink

Question

I see a fairly high amount of spam that takes the following form (pardon the italics, my DejaVu Sans is broken and drupal.se ends up italicized):

That is, a body of text that ends with a raw (no markdown) hyperlink (and no punctuation after it - the very last thing in the body). Sometimes (although not in the above example) there are hyperlinks elsewhere in addition to the one at the end.

Here is another example from right here on MSE:

If you hang out in chat you will see a lot of these, particularly on drupal.se for some reason. Maybe a dozen or so per day.

Does it make sense to enact a spam filter that blocks questions that end with a non-markdown hyperlink? There are some considerations that I do not have any real knowledge about:

• Are there legitimate posts that take this form? At a glance I am unable to find any although this is made difficult by performance issues in queries against Posts.Body.
• Would this actually help or would it likely just be a short matter of time before the spammers changed the format?

Even with those in mind I wonder if it would be worth a shot for a while. Spam of this form is the overwhelming majority of the spam that I see come up in chat, at least.

Another option might be to require a captcha for questions of this form.

Answer 1

We've experimented with this sort of thing in the past, and it hasn't been very successful for any appreciable amount of time. This is for two reasons:

• We have to tell users why something can't be submitted, although we can be kind of vague as to what's wrong, to avoid users 'fixing' only the stuff they think will get it submitted rather than making better improvements

• Spammers are robots with masters, or assimilated humans being paid by the link planted. They see this, they alter tactics, they alter text and then it's a game of pin the regex on the (new) pattern.

We block an enormous amount of this, a fresh graph:

_{The drop for today is due to no data for the day to speak of, as it rolls over during a very inactive period.}

Notice, the amount of work users have to do in order to keep it out isn't commensurate with the amount we actually block, but this particular wave that you're mentioning is in fact changing that perception, even though it's not the case.

The SE quality project ML has yet to be really tested on this type of stuff, and I think it might end up being the perfect companion to the spam system if our goal is to make sure this stuff never hits the front page, thus bringing the perceived effectiveness of the system as a whole a bit close to reality.

I don't want to start poking and prodding at a better blacklist until and if that proves to be insufficient, and even then, I think we're looking at something a bit more Bayesian.

And, whatever is doing this is freaking huge, I've been battling it for a few weeks now, and quite sick of it along with everyone else. I just don't want to start taking flailing, wild stabs at simple pattern matching that aren't going to ultimately get us anything - I'd rather our next move be closer to end-game.

Update

I've spent a considerable amount of time looking into this, and I have made some changes network wide. I can't go into too many specifics, but here's the gist of it:

• We hold a grudge longer than we used to.
• We're much quicker to block outright when 1 moderator, or 6 users indicate the presence of a spammer using spam flags
• If a moderator destroys a spammer, it's a near instant block on most sites, or an instant one on others. I'm not saying which is which, it's prone to changing during a bi-weekly maintenance cycle where I turn knobs and pull levers after analyzing activity
• Tripping honeypots is now considerably easier to do, and doing so deals an instantly blocking blow (which hasn't changed, they're just more sensitive)
• Stuff we've got baking in the quality initiative project is now showing promise of augmenting the spam system, I'll have more on that as it solidifies.

We can't hope to block 100% if we're going to remain a network that trusts you until you give us a reason not to trust you any longer, and that's a premise we're very inclined to cling to. However, the vast majority of networks that we track only hit us with spam, so we're now working considerably faster.

Answer 2

A better route might be to flag this or automatically add it to the Low Quality review queue (as suggested in the comments) - or even create a new queue (but only if the volume of posts warrants it).

This way we get eyes on these posts very quickly and the spam can be flagged up and removed, people innocently adding a link as a signature educated and other posts edited into shape.

The only danger with this is a possible pile on effect of down-votes and inappropriate comments so either this queue would need to be restricted in some way or only require one user's action to remove it from the queue. Actually this sounds OK as the point is that the system has said "I think this is spam" and all that's happening is that a human is saying "yes"(at which point it gets spam flagged) or "no" (at which point it's ready to be treated like any other post).