22

Is there anything you can do against spam answers?

Over the last week or so the amount of spam answers on Ask Ubuntu has significantly increased (a couple of deleted spam answers: Reinstall of OS after CPU Upgrade needed?).

Right now I edit the answer to remove its content, flag it as spam, and sooner or later they get burned alongside their users. Some questions seem to attract such answers, which can be protected, but that's all we can do.

This is a - likely incomplete - list of the URLs with the first batch showing up multiple times (could be true for the rest, I just went through my spam flags and I'm asleep during the spam peak time):

http://www.beddingroom.org/
http://www.buybvlgari.com/
http://www.cheaprift.com/
http://www.goodsimport.com/
http://www.inriftgold.com/
http://www.sopgame.com/
http://www.sopgold.com/
http://www.sweetgoods.org/
http://www.tovipbags.org/
http://www.watchfaner.com/
http://www.webshopvip.com/

http://www.bags365.info/
http://www.beddingon.com/
http://www.featabout.com/
http://www.inbra.info/
http://www.magicrolex.com/
http://www.paneraishop.org/
http://www.spellshop.org/
http://www.sweetteenbedding.com/
http://www.watchreg.info/
Improve this question
5

5 Answers 5

Reset to default
20

These attacks all came from a bot, I strengthened our anti bot protection.

After this change I can track how sophisticated these bots get and will not rest until these bots either run a full blown web browser with a full blown JavaScript interpreter or discover an algorithmic solution to reCAPTCHA.

Looking at stats since the last deploy, my fix - fixed it.

--

Shame I fixed it, I really would like a Louis Vuitton bag, I think it would go wonderfully well with my Rolex watch.

Improve this answer
2
  • 2
    ping me here, if you notice any new "clearly bot" activity
    – waffles
    Commented Oct 26, 2011 at 0:08
  • ping: There's been rather a lot of spam pointing to URLs in the fixtoolbox.com domain lately. It looks rather like a bot trying to be clever and not draw attention to itself. (It could be humans though, but I think it might be worth a look). They've all followed an identical pattern and it looks like it's keyword based. They've hit at least SO, SU, SF, askubuntu, askdifferent, graphics, pm, sharepoint, dba and I think 1 more, but I can't remember which.
    – Flexo - Save the data dump
    Commented May 1, 2012 at 7:51
26

Right now I edit the answer to remove its content,

Please don't do this. It makes it harder for spam posts to be removed. Flagging is excellent. Spam posts do get deleted very quickly, if they are left unedited and flagged.

Improve this answer
8
  • 1
    On the contrary, editing to a standardized text can also make it easier for others to search for and find the spam.
    – John
    Commented Oct 22, 2011 at 22:37
  • @John - no. Flagging makes it much easier for people to remove spam posts; ban the account; ban the IP; and ban the url.
    – DanBeale
    Commented Oct 24, 2011 at 18:24
  • I'm saying flag it and edit it. If everyone agrees on what to edit spam posts to, everyone can just search for that sentence and it's that much easier for everyone else to find and flag also.
    – John
    Commented Oct 24, 2011 at 18:46
  • 2
    @John If you flag it, and then edit it, it's harder to notice the post was spam because who verifies it is really spam should see what the post contained before your edit. There should also be background tasks that check posts, and they would not report anything about them. For example, on Drupal Answers, there have been many spam posts that have been flagged for low quality; that is how (as 10k user) I was able to notice them.
    – avpaderno
    Commented Oct 24, 2011 at 20:56
  • 4
    No - do not edit out the spam. We've discussed this before on Super User Meta and the same applies elsewhere. Editing spam removes context, making it difficult for mods/devs to search for patterns in the spam, find links between accounts, and look for other important information. Spam flags get handled quickly on almost every SE site. At the request of the moderators and SE community team, please do not edit out spam. Just use spam flags - that's what they're for.
    – nhinkle
    Commented Oct 26, 2011 at 0:12
  • So far I haven't edited any spam posts, but should I rollback edits I see made? ( @nhinkle )
    – John
    Commented Oct 26, 2011 at 1:07
  • @John in the interest of not starting a rollback war, you should probably just leave it. Do leave the editor a comment though directing them here to remind them not to do that. Thanks for your help!
    – nhinkle
    Commented Oct 26, 2011 at 2:06
  • @nhinkle Will do. Thanks for the info!
    – John
    Commented Oct 26, 2011 at 2:08
15

Flagging as spam is the right action, enough spam flags automatically delete the post. They are also visible to moderators, which can nuke the post or even the user directly.

The SE team can also blacklist URLs that are spammed a lot, if it's always the same URLs you can ask that those be added to the blacklist.

Improve this answer
1
  • Since they all pretty much look the same, I'm going to collect the URLs and will request those getting added to the blacklist. Thanks!
    – htorque
    Commented Oct 22, 2011 at 12:17
11

The same spammer hit Drupal a few days hours ago. See the discussions here and here. The sites linked to were:

  • appwatches.org
  • beddingroom.org
  • boyshop.info
  • cheaprift.com
  • diablo3goldvip.com
  • glistenshop.com
  • inbeddingsets.com
  • shopsister.com
  • sopgold.com
  • onbedding.com
  • tomorrowmoon.org
  • tovipbags.org
  • towholesale.net
  • wathtel.info
  • webshopvip.com

Comparing to your list: (after alphabetizing):

  • bags365.info
  • beddingon.com
  • beddingroom.org - DUPE
  • buybvlgari.com
  • cheaprift.com - DUPE
  • featabout.com
  • goodsimport.com
  • inbra.info
  • inriftgold.com
  • magicrolex.com
  • paneraishop.org
  • sopgame.com
  • sopgold.com - DUPE
  • spellshop.org
  • sweetgoods.org
  • sweetteenbedding.com
  • tovipbags.org - DUPE
  • watchfaner.com
  • watchreg.info
  • webshopvip.com - DUPE

There are three five duplicate links. Also, these attacks happened within a week. Finally, all the URLs are similar. This evidence seems sufficient to demonstrate that both hits are from the same people.

I suggest that all the URLS in these lists be blacklisted. However, this is probably insufficient; whatever this spammer is doing they certainly have a lot of URLs to choose from. I suggest that the team take a good look at their logs and attempt to find any characteristics that could be used to identify spam.

Improve this answer
2
  • @c69 - Did you intend to comment to this answer? What case are you referring to? I proposed that the used sites be blacklisted, and that more analysis be done on the spammed posts, which would work across the whole network.
    – Kevin Vermeer
    Commented Oct 27, 2011 at 17:00
  • i think i have reading issues, in the evenings after work. Have not noticed your last paragraph, at all.. - just first one and link lists.
    – c69
    Commented Oct 27, 2011 at 17:05
5

If they're all linking to the same URL/domain it's possible to get that blacklisted. Flagging through the "other" is a way to suggest it.

If there's a pattern of spammyness too it's possible/likely to all be coming from the same IP addresses, again those can be blocked.

You can include searches for URL patterns in flags too, e.g.:

https://askubuntu.com/search?q=url%3A%22http%3A%2F%2Fubuntu.com%22+deleted%3A1&submit=search

which makes it easier to show a broader pattern through one flag and find sock puppet accounts created for doign it at the same time. My experience of this on SO has been that flagging things like this has resulted in sensible action from mods.

(You'll need to replace * with %2A manually because of this issue)

Improve this answer
3
  • The problem is, that I don't exactly want the URLs to stay there until the post gets deleted and using the search I cannot find the older revisions.
    – htorque
    Commented Oct 22, 2011 at 12:13
  • Another useful tool (mods and 10ks only, I think) is /admin/find-users which searches for users who have posted certain content. Ex. http://askubuntu.com/admin/find-users?q=cheaprift.com
    – Kevin Vermeer
    Commented Oct 22, 2011 at 20:14
  • 1
    @KevinVermeer - looks like it's Mods only because I can't see the corresponding page on SO where I've got 10K
    – Flexo - Save the data dump
    Commented Oct 22, 2011 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .