10

They are back.


Today (2018-10-16) several accounts were used to post answers that look like legitimate answers but the strange thing is that they include a sequence of numbers, sometimes preceded by call +1.

Specifically, the answers copy text from the question to make the answer look somewhat legitimate and insert a (spam) phone number.

This morning I flagged several of them as spam but they are still coming. I'm wondering if they found a way to bypass the anti-spam IP filtering.

It looks that the posts made this morning by using other puppet accounts were already deleted.

Exhibit 1

From https://webapps.stackexchange.com/a/121432

(and thus already fixed; **gmail help :###'###"####**just try again), a local connectivity issue (we can't help with that), or your browser has an extension that's messing things up (again, we

The common pattern are the numbers which are always the same, with a zero replaced with a uppercase letter O in some examples, the separators between the numbers change.

Exhibit 2

From https://webapps.stackexchange.com/a/121435

all this "allocation" of **call @@###@###@@####**deposits has been done manually by the intern but it takes a lot of time and it is not very efficient, particularly when an invoice was forgotten in the past, is added to the table

  • That's not spam. Just VLQ or NAA. – DavidPostill Oct 16 '18 at 20:49
  • 8
    @DavidPostill These are spam answers. They copy some text from the question and inject a phone number. Use spam flags so that the accounts/IPs are rate-limited. – Laurel Oct 16 '18 at 20:57
  • 3
    @DavidPostill - definitely spam. – ChrisF Oct 16 '18 at 21:31
  • 1
    @ChrisF Yep, clear having seen the second example. – DavidPostill Oct 16 '18 at 21:53
6

I've dealt with all the flags for now.

All the posts have been spam-flag deleted and the accounts destroyed.

That'll hopefully put a brake on their activities - unfortunately they'll probably come back when they find a new IP address. If they do just keep flagging and encouraging others to flag and we'll clean up as and when we're online.

  • 1
    It looks that the found a new IP Address. – Rubén Oct 16 '18 at 21:53
  • 1
    Thanks. I was away tonight and missed all of the "excitement." – jonsca Oct 17 '18 at 1:32
5

Wow, that's a lot of spam. :-(

Those look like attempts to get a phone number past automated filters.

If spam flags aren't slowing them down, pop into the Charcoal HQ chat room and link them to a couple examples. They can automate the whack-a-mole response until the spammers give up or get enough of their IPs blocked to be inconvenienced.

Meanwhile, if everybody who sees it flags it, we can remove at least some of what's already there. If your community has people who hang out in chat or on meta but might not have seen the attack yet, let them know there too -- the more people who know, the more flaggers you have.

  • This morning I flagged them as spam but they are still coming. I'm wondering if they found a way to by-pass the ip fiiltering – Rubén Oct 16 '18 at 21:01
  • 1
    Have you raised this directly on that site's meta? Their moderators can see where it's coming from but the rest of us can't. Sounds frustrating -- good luck. – Monica Cellio Oct 16 '18 at 21:03
  • I think that the Web Apps Mods participate more frequently here than there :) – Rubén Oct 16 '18 at 21:05
  • 2
    @Rubén Why do you think that? The mods there get a diamond notification every time a meta question is asked on their site. They don't get something similar for questions asked here. Unless they look for it here specifically, they won't see it. – Catija Oct 16 '18 at 21:07
  • Oh, try letting Charcoal know -- see my edit. – Monica Cellio Oct 16 '18 at 21:08
  • They already know and have it followed but it's good advice. ;) – Catija Oct 16 '18 at 21:09
  • @Catija Because I saw that with my own eyes :D (I'm aware they could do many things on the site that aren't viewable by non-diamond-mods) – Rubén Oct 16 '18 at 21:09
  • @Rubén Saw what? I'm kinda confused what you mean. – Catija Oct 16 '18 at 21:11
  • Well, I'm out of flags there for the day... – Monica Cellio Oct 16 '18 at 21:11
  • @Rubén I'm pretty sure that Monica is specifically talking about that site's five diamond mods, not the high rep users. – Catija Oct 16 '18 at 21:15
  • @Catija I understood that Monica was referring the diamond mods – Rubén Oct 16 '18 at 21:18
  • Regarding the Charcoal HD "Processed Meat" already added a link to this thread -> chat.stackexchange.com/transcript/message/47205047#47205047 – Rubén Oct 16 '18 at 21:21
  • 2
    @Rubén When moderators are on one of the sites they moderate, they have a special diamond in their top bar next to their user info that lights up in a few specific situations - one of which is when a new post gets asked on meta. So, they don't have to be active on their meta sites to know when a question is asked there. – Catija Oct 16 '18 at 22:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .