We stop the majority of this in its tracks with honeypots. We do a couple of things here:
- If someone tries to spam a post that has a recent substantial number of rejected spam edits over the last month or so, they're dealt a blocking penalty score in our system
- Anon edits that try to change too much are also closely monitored.
The problem is snow shoe spammers, that come from 10 or 15 different /22
or /20
sized networks (typically walking up class C blocks in countries where there's very little teeth to laws about this sort of thing) - some manual intervention is needed on our part, or it takes about 100 spam messages to show up in your inbox before the system is finally trained on all of the abusive origins.
This particular bot appears to be an explorer type, which I've observed will attempt to see what kinds of markup will be rendered as links.
I'm going to run a query and manually break these networks down, which should quiet things down quite a bit.
I learned something from this - these innocuous posts that are targeted seemingly randomly by spam cartels do in fact have one thing in common - all of them tend to be quite short. Not sure what to do with that, but .. fascinating.
Update
31 networks (approximately 7200 unique hosts) now eat this when trying to post anything on any of our sites. Sorry about the noise and inconvenience.