27

Arts & Crafts doesn't get a lot of traffic. I just noticed an unusual number of new users on the Users tab. There's 66 pages of new users. Starting with the last row of new users on the first page to the end of the list (about 2,600 accounts), they are all odd usernames, either entirely what looks like Chinese, or Chinese mixed with snippets of numbers and occasional Latin characters, often containing the same snippets. They include a mix of the default gravitars.

Spot checking the accounts, many or most have a profile "About" section populated with similar random garbage or nonsense, also in Chinese, apparently random content, user instructions, and other filler snatched from activity on the web. The accounts appear to have been created in batches on particular days, many 6 or 7 days ago, apparently by some automated process. It looks like all of these bogus registered accounts have no actual activity, and the initial rep of 1 point.

In some cases, the accounts are linked to similar accounts on other SE sites. I spot checked Super User, which gets way more traffic. Only the last 700+ new users were these same kinds of accounts, and many were a few weeks older than the ones on Arts & Crafts. On Meta SE, it looks like most of the last 3,000 new Users are these same bogus accounts. It looks like they started about the same time (40 some days ago), but the most recent batch I spotted here was 8 days ago.

My recollection is that the New Users tab covers only something like the last 45 days, so this activity could have been going on for longer, and there could be lots more in the system. I didn't bother checking other sites, but it's obvious that this has been done on a lot of sites based on the linked accounts.

It isn't clear what threat, if any, these accounts represent. It might simply be a test to see if they can overwhelm the system, or probing to see if they can get away with it unnoticed. I don't know what impact tens of thousands of bogus accounts has on system resources. If the perpetrator were to use the accounts to flood sites with automated garbage posts, it would be a job to get ahead of it, especially if moderators and active users are not aware that the scope is not individual posts.

Right now, the immediate effects are just distortions of site stats and some inconvenient navigating. But these are obviously not legitimate accounts, and we might want to do some large scale deletion before they are used for mischief. Be aware, though, that there appear to be some legitimate accounts scattered in with user names in Chinese characters, so clearing these would need to be a bit surgical.

Given the breadth of scope, any action would probably need to be from SE staff. Is this something people were aware of, and should anything be done about it?

3
  • 2
    I can't speak in general terms, but I've seen a proportion of spam accounts fitting this profile -members for a few months, when posting the spam, the profile gets edited to display the company name etc.. I'm guessing some enterprising young thing is attempting to sell these on somewhere shady. They usually last less than 2 minutes on main meta, and the new new-user-first-question-interface-sandbox-thingy will scupper them when it's finished rolling out.
    – W.O.
    Jul 29 at 3:26
  • 12
    Just to note the moderation teams on the respective sites are... rather aware, and we've escalated through the appropriate channels for action.
    – Journeyman Geek Mod
    Jul 29 at 3:27
  • 5
    The spike in new accounts created is fairly noticeable on Arts & Crafts. (screenshot of graph since graph will change if/when accounts are deleted) Jul 29 at 4:06

1 Answer 1

21

Just to note the moderation teams on the respective sites are... rather aware, and we've escalated it through the appropriate channels for action.

I don't really want to go into details for obvious reasons - but profile spam is something that needs at least mod level powers.

If you see any 'new' sort of spam documenting and letting the mods know is helpful - we'll take it from there, though with the sheer volume, we're pulling in help from staff for slightly less artisanal methods of spammer reaping.

3
  • 6
    Just to clarify, I'm not aware that these accounts have been used, yet, for nefarious purposes, and the profile content isn't spam. The "About" filler is just flotsam and jetsam in Chinese to make the accounts look more legitimate. The accounts look like they are being created entirely by an automated process to create them on a massive scale. But if you're already dealing with it, great. I looks like not every affected site's mod team is familiar with the issue, though, so maybe this question will educate those that aren't.
    – fixer1234
    Jul 29 at 4:10
  • 2
    @fixer1234 I've been dealing with profile spam on Stack apps since I was appointed there. I was active when a similar spam flood came in on my site. Despite all tooling and userscripts I had at my disposal I couldn't destroy these accounts at the rate they were created. After one hour of 100% of my time going into destroying new accounts (some literally within seconds of being created) I gave up, reported in the mod room what happened and decided to clean-up at a slower rate over a longer period or until an SE dev does delete * from users ...
    – rene
    Jul 29 at 7:01
  • 1
    The accounts are not used cause posted spam has roughly the lifespan of a snowball on the surface of the sun. Profile spam is harder to deal with and the current tools don't really address them
    – Journeyman Geek Mod
    Jul 29 at 8:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .