16

While I was on the meta asking this question, I saw 8 of those printer support number posts (I flagged 7). They get handled quickly enough by the community flags, but is there any way to block whoever is behind all of those?

Here is an example of what (for anyone that has not seen it) is going on.
spam printer support posts

17
  • 3
    FYI, you got reported. – user259867 Jun 9 '15 at 19:51
  • @David That was a bot detecting spam. If it finds certain words in your question, it's gonna post a chat message raising a warning about your post. I suspect support was the case this time. – M.A.R. Jun 9 '15 at 19:54
  • As best I could see (as a bystander that is) there was one user who posted several of them. It's just your typical spam formula. Maybe SE should look out for posts that have repeating symbols (I assume they already do), telephone numbers, specific terms ({brand} printer {tech}? support), or other potentially "spammy" terms. (According to that log, SE already has a comprehensive spam catching system.) – Der Kommissar Jun 9 '15 at 19:55
  • @EBrown, that's a bot written by users, not SE itself. – Andy Jun 9 '15 at 19:57
  • Tim Post said it's a botnet. Whatever the case is, it feels that majority of new posts on meta.SE is tech support spam. – Mysticial Jun 9 '15 at 19:58
  • @Andy If it's not an SE spam catcher, perhaps SE should implement some more effective heuristics and drop questions that meet certain criterion into a specific queue. Or delete certain ones altogether. – Der Kommissar Jun 9 '15 at 20:01
  • 4
    Some context on this spam: meta.stackoverflow.com/questions/295964/… (see the rest of that discussion for more). It's a group that's been attacking SO for months and has spread to other sites. Even blocking techniques that stopped other distributed spammers aren't slowing them down. An attempt at a blacklist for their content didn't quite go as expected: meta.stackexchange.com/questions/258317/… – Brad Larson Jun 9 '15 at 20:02
  • @EBrown - you are underestimating how cunning these spammers are. pr1nter 5upport? p-r-i-n-t-e-r? – Oded Jun 9 '15 at 22:28
  • 1
    @Oded Not at all. Any capable programmer could easily make adjustments for certain structure. Hell even with my limited skills in regular expressions I could probably come up with something that was moderately tolerant. – Der Kommissar Jun 9 '15 at 22:41
  • 5
    @EBrown - thanks for calling me incapable ;) - I've tried. These guys kept changing the format enough every time to evade the regex. And at a certain stage it got so wide that it caught legitimate users out. – Oded Jun 9 '15 at 22:43
  • 2
    @EBrown such as /.*/? original meta.stackexchange.com/questions/258317/… – David Jun 9 '15 at 22:43
  • @Oded My mistake, poor choice of wording. I wrote it on my phone while standing in Kroger, and didn't do my usual vocab-check (only spelling/grammar). What I mean to say, is that perhaps you guys are going about it wrongly. I don't know the specific code/regex/logic you currently use, but perhaps (not to insinuate you are a bad/incapable programmer) you should look at it from a different point of view. How do you know (as a person) that these questions are spam? – Der Kommissar Jun 9 '15 at 22:59
  • 1
    @EBrown - believe me that we are looking at alternatives. Most of the signals that work well for other spammers don't seem to work on these, though we are certainly looking at options (don't forget that we need these checks to be quick and CPU cheap, given our scale). – Oded Jun 10 '15 at 8:26
  • @Oded do you have any insight into how the spammer(s) are effortlessly getting around captchas? – Carrie Kendall Jun 11 '15 at 13:38
12

We've leaned harder on some of our existing spam blocking infrastructure (mostly to do with adding spam keywords to a dictionary).

I've been monitoring the spam block logs as well as the deleted posts here on MSE and am happy to report that for the time being, this measure has worked well.

By which I mean none of the printer spam has gotten through in the last 24 hours.

16

That's a persistent spammer. Just keep flagging them as spam when you see them; MSE is active enough that most of them get shut down in under a minute. Keep up the good work.

3
  • Interestingly, the latest one had a link to a legit looking profile - is the spam bot getting good enough to create realistic profiles or are user's machines compromised in some way? – slugster Jun 9 '15 at 23:07
  • @slugster hmm, good question. (I was too late to see the profile you linked.) Presumably if those accounts had any other worthwhile activity SE would respond differently (suspend rather than destroy, I'd guess), so if compromised, we're talking about accounts that people bothered to set up but then didn't use. Of course, it's possible that the spammers are simply scraping and copying profiles... – Monica Cellio Jun 10 '15 at 1:20
  • 2
    @slugster Realistic in the sense of having a regular name and a picture of a person? Most of spam accounts are like that. The image is usually a stock image from somewhere. – user259867 Jun 10 '15 at 1:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .