Spam Profiles are getting my goat. Could we have better tools for mods to deal with profile spam?

Question

Super User got hit by another batch of spammers creating profiles. They've got accounts on other sites from what I've heard from other mods and from the comments here.

Last time it was streaming. Now it's insurance sales... with phone numbers (as of december, looks like they're spamming scammy finance too). I had 160+ pages of users from that search (though I've deleted a good chunk of them since it was posted, and on the aggregate we have none left) , and a quick look suggests most of them are spammers. Comments from this post indicates it's network wide - and a quick check indicates Stack Overflow has a handful of these too, though not as many as we have.

While the powers at be have been taking action, both directly, and indirectly, it feels like between shared IPs and search, mods might be able to take a good chunk of these out if we can somehow have a way to delete accounts somewhat in bulk. You guys are awesome. But these... People keep doing it still, and it would be nice to see their works undone.

Unlike our streaming spammers, they've switched to phone numbers, presumably because Adam so kindly blocked links.

There's a few good suggestions at mitigating these - but ideally - I've heard from fellow mods that we want them gone.

They add to the broken window effect - which we can't do anything about due to sheer volume, and they probably poison our search engine results.

We can probably reduce the risk of oops by filtering by IPs (clearing everything on an IP lets me whack, 10, or so users at once, rather than clicking through 3-4 pages a user) and optionally selectively not deleting accounts that seem legit, we can probably clear out a bunch of these without really needing CM intervention. It does make it a little too easy, but these incidents, well kinda need a flamethrower's gentle warmth.

I'm cool with a no. I'm probably going through the usual channels in future. Would be nice to have something that lets mods deal with this effectively though.

Related:

• Is spam in the “about me” field a reason to worry? - Actually goes into the impact of this
• Question on MSU by a user - so clearly these are discoverable to an average user
• apparently spotify got hit with something similar

Answer 1

Maybe SE simply shouldn't publicly show profiles for users that have no interaction at all on the site. Users that have never voted, posted or done anything at all are just noise in the user listings anyway. Of course the user itself should be able to see their own profile, but there is really no reason why anyone else would look at it.

Looking for this kind of spam profile is a huge time sink, and not really worth the effort. But leaving lots of this kind of spam visible is also not really a good option. Not showing these profiles at all publicly would mean they only waste a few bytes in the database, which is probably irrelevant. But it would mean there is no need for any moderators or CMs to waste time on this.

Answer 2

A further refinement to Ilmari Karonen's answer (which refines Mad Scientist's): make profiles of new accounts that haven't done anything visible only to logged-in users.

This does a few things:

• Keeps them out of Google. No 'noindex', no robots.txt -- Google just can't see it. That's gotta be more reliable.

• Keeps spammers from being able to send their employers a link to a public post so they can collect their bounties. (I've been told that spammers need to be able to prove they were successful.)

• Keeps the information visible to anybody on the site who might need to look at it. That's probably just moderators (for certain kinds of fraud investigations) and yes you could make an exception for moderators, but maybe having fewer exceptions is better.

• We already have some behaviors that change based on whether you're logged in (front-page view is different, "join" button, tour invitation), so there's logic to hook into.

This question focuses on the spammer profiles. Spammy names can still show up in the list of new users and the badge lists (Autobiographer in particular for this attack). I don't know what is reasonable to do for those exposures -- reasonable in terms of both UX and code complexity. We should identify all the places the names show up before deciding (is it just those two or are there more?).

Answer 3

As a subtle alternative to Mad Scientist's suggestion, we could simply add a noindex meta tag to the profile pages of users with less than some minimum amount (say, 5 or 10 points) of rep. This would keep those pages out of Google's index, and thus make them much less attractive as spam targets, without any really noticeable effects otherwise.

What this suggestion would not do is actually stop the creation of such spam profiles, or hide them in any way from normal users. But it does remove the incentive for that kind of spam, which should gradually reduce the amount of it that we'll get, as spammers notice that it's not working any more. And in the mean time, we'd at least be making the Internet a slightly better place by keeping spam out of search engine indexes.

Answer 4

These profiles are starting to spill into other sites as well.

Yesterday after this meta post was made, I hopped into the user search for RPG Stack Exchange, which I moderate, and looked for profiles which mentioned car insurance. I found two, and I destroyed them both.

Today I checked again and there were sixteen:

These have also been destroyed. The ones I checked into in further detail also had network accounts on Super User.

A moderator on Philosophy Stack Exchange has mentioned they are also deleting 6–10 per day.

This is a drop in the ocean to Super User's several thousand, but it makes me concerned that this may just be the tip of the iceberg, and that this spam might have the potential to become less a finely focused abuse of Super User, and more a network-wide oil spill.

I like several ideas above: hiding 1-rep profiles from listings, letting only the user themselves and moderators see those profiles and/or only logged-in users, making editing your profile a trivial 5-rep privilege, and telling Google not to index these. I'm posting this because I hope to suggest the rest of the network needs a stopgap and/or full solution as well.

Answer 5

I looked at a fair number of these car insurance profile pages and noted that they all seem to have the same phone number. I couldn't find anything interesting about that number in the phone spam database I looked at, so they may not be spamming cell phones also.

A google search on that phone number is a bit interesting. It seems to turn up a lot of spamming all over, not just SE.

It just occurred to me that this might be an attack by someone on the owner of that phone number, rather than against the site. It would probably be very effective, generating a lot of angry calls to the number. The history of the spam accounts may indicate otherwise, but the possibility should be considered.

Answer 6

Are we applying anti-spam filters to profile descriptions? That seems important.

I notice that that these all have a similar format, littered with non-ASCII characters, phone numbers, and long run-on sentences. We could block those.