11

Yesterday, a whole slew of new questions began to appear from users with a reputation of 1 and as @w3dk pointed out, were registered 4 days ago (now 5). @dan made the first attempt to clean-up the mess by removing all the questions that were submitted by a single IP address and using any criteria such as searching to see if the question was posted somewhere else on the net. I did a quick look and some of the questions submitted at the time remain. I am not being critical. Coming in after the fact, I cannot imagine what else could have been done quickly while trying to remain fair to honest OPs. However, just a few minutes ago, it all began again.

I assume the pay-off for the spam messages are eventual links to the spammers site be they in the question, an answer, the profiles, or even in comments to gain reputation for their site.

I have to admit, this p[***]es me off. It is damaging to the site and blocks fair questions from honest OPs with a need from having their question seen or answered. Too many good people have worked here to make this site useful for others by sharing their expertise and ideas. The SE suite of sites have helped me solve problems. There is no better resource for people to get help anywhere especially when in a bind.

To that end.

Is it possible to go back and see what accounts were created at the time and disable them? It might get one or two innocent people, however, this may still be the better option. Or is there something else that can be done.

I am just concerned and curious if there is a good solution for such an attack.

Cheers!!

7
  • 2
    We're looking into this now. Thanks for reporting it
    – Tim Post StaffMod
    Commented Feb 1, 2016 at 19:28
  • 1
    As I indicated in the chat room yesterday, just flag them to let us know if you spot any. I also notified the other mods to keep an eye out for these and to destroy the user, which blocks their IP address from creating new accounts. They can of course use other IP addresses, so we'll just have to keep an eye out till they get the message that this won't work anymore.
    – dan Mod
    Commented Feb 1, 2016 at 22:52
  • @dan Okay. You got it! I am glad you jumped in to fix this mess. I have no idea what you needed to do to clean-up this onslaught, but I am sure it was significant. Thanks!!
    – closetnoc
    Commented Feb 1, 2016 at 22:58
  • NP. It was great to have the community point it out in the chat room. I'm always happy to see flags (even if in doubt), they make our job easier, the site better, and keep users engaged in the process. BTW, looks like Tim blocked a batch of offending IP's.
    – dan Mod
    Commented Feb 1, 2016 at 23:09
  • @TimPost Some time ago I was studying the various spam software packages for recognizable patterns to be used against them. The last time I looked, SE was a target. It is just possible that one of these software packages has up'd the game. This attack came fast enough and was so well organized it lead me to think either this guy did his homework perfectly or had help. The odds of manually doing this amount of work this quickly with little to no errors is extremely remote. I doubt if someone actually wrote their own script for this. Most spammers are lazy and not always tech savvy.
    – closetnoc
    Commented Feb 2, 2016 at 0:26
  • This appeared to be a somewhat manual attack. They were copying on-topic questions from another site and even going so far as to upload images that went with them. In some ways the automated attacks are easier because the content isn't as good.
    – Stephen Ostermiller Mod
    Commented Feb 2, 2016 at 0:42
  • @StephenOstermiller Some of the spam packages would scrape content from the web just like we are already familiar with. This was 3 - 3.5 years ago. Keep in mind that there are some professionally written packages that spam dang near anything that will gather and organize content into a database. Not sure that is what is happening, but the software was surprisingly sophisticated and effective back then except that most spammers are not actually that bright and could not figure out all the features. ;-) Good for us.
    – closetnoc
    Commented Feb 2, 2016 at 0:59

1 Answer 1

Reset to default
8

Right now these users are mostly on page 6 of the new users ordered by creation date:

https://webmasters.stackexchange.com/users?page=6&tab=newusers&sort=creationdate

I'm working on cleaning up the latest round of these questions. They all appear to be plagiarized from moz.com. For the record, here are links to some of the now deleted questions:

My next step is to note the account details and see if I can do a more thorough cleanup of these users.

8
  • 2
    I know that you all are working hard on this. Thank you for that!! I was not sure what could be done. I just wanted to ask. I also thought it might help the mods to ask the question if there were any differing ideas. I have stayed out of the mix partly because I did not see a point in attending to questions that may be deleted. As well, I have been struggling with a sick Mother in and out of the hospital and not taking her medication the past few weeks and have been too tired to make much sense - at least until today (maybe - time will tell). ;-) Cheers!!
    – closetnoc
    Commented Feb 1, 2016 at 18:21
  • I did find some info that ties these accounts together. I posted more info about it into moderator chat. I'm going to try to get StackExchange staff involved -- with DB access they are more likely to be able to do advanced queries that can help us.
    – Stephen Ostermiller Mod
    Commented Feb 1, 2016 at 18:23
  • Another curiosity question. A simple one really. Are you able to block by IP address or at least sandbox?
    – closetnoc
    Commented Feb 1, 2016 at 18:23
  • 1
    As a moderator I can see the IP address of a user and see who else has been using that IP address. I can use that info to delete multiple accounts. In this particular attack the users are created at most three users per IP address. I don't have the ability to block IP addresses, but one would assume that when I destroy a user for spam SE uses that information to put in appropriate blocks, for example by IP address.
    – Stephen Ostermiller Mod
    Commented Feb 1, 2016 at 18:25
  • It is good to be king - sorta. It appears that mods have good tools available or at least resources to back you up. That is good! Makes me happy. Back to struggling with a new site... (sigh)... I have a question I wanted to post yesterday but will wait till the 5h17 storm has ended.
    – closetnoc
    Commented Feb 1, 2016 at 18:25
  • You have some work to do. Please do not take offense when I say I do not envy you at this moment. You volunteer to put a lot of work into this site and it is good people like you that make this site work as well as it does. BTW- I did a search in G for perl email form and selected the first link and who's site do you think I landed on?? I will be trying the solution later. I just did not want to write code for myself (as I would normally do) for a quick and dirty 3-4 pager. Cheers!!
    – closetnoc
    Commented Feb 1, 2016 at 18:30
  • 1
    I assure that my contact form is a good one. Free and open source as well. :)
    – Stephen Ostermiller Mod
    Commented Feb 1, 2016 at 18:32
  • I do not intend to look anywhere else... once I saw it was you, the search was over! I am using a frustrating but nice looking template to create a website for my apartments. I paid good money (was not cheap) to advertise with a large real estate rental advertising agency and got 0 leads in 3 weeks. I live up in the mountains so that is not a huge surprise, however, I know that I can out rank everyone immediately and forever so why not just do it myself?? I want quality leads and you just do not get that easily using the traditional ways around here.
    – closetnoc
    Commented Feb 1, 2016 at 18:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .