345

I was recently applying my limited SQL skills to poke through a list of users with many answers, all of which exceed some minimum score. While this query highlights some really awesome contributors (50 answers, all with score 3+!), I also identified what I suspect to be a spam ring. Normally I would raise a custom moderator flag, but (in the spirit of a recent meta post) since the potential ring is quite extensive and I've already done a lot of digging, I wouldn't be able to capture all the details in a flag message, so I'm posting the details on meta for community and moderator review.


The first product of concern is a (non-free) service to connect to dedicated Mac virtual machines. The following users promoted this service in one or more answers (in all cases upvoted to 3 or higher at the time of writing this post, with no mention of affiliation to the products):

  • Rachel Henderson: Answer 1 (Alex Stevens has a 7 score comment agreeing) ; Answer 2 (Steven Holt has a 3 score comment agreeing) ; Answer 3 (Alex Stevens has a 3 score comment agreeing) ; Answer 4 (mentions alternatives but specifically promotes the product of concern; Art A. and Steven Holt have 3+ scored comments agreeing)
  • Alex Stevens: Answer 1 ; Answer 2 ; Answer 3 ; Answer 4
  • Steven Holt: Answer 1
  • Art A.: Answer 1

The other three products of concern are all (non-free) debuggers (for JavaScript, VBScript, and ASP Classic). The following users promoted one of these three products in one or more answers (in all cases upvoted to 3 or higher at the time of writing this post, with no mention of affiliation to the products):

For all seven users I have listed, at least half of their answers promote the four products of concern. There's additional evidence linking the four products -- the three debuggers share the same website and all four websites have an auto-playing video that seems to me to be the same person. There's also some additional evidence linking some of the users -- Art A. and Art Aroustamoff have similar usernames, and non-promotional answers (all 3+ scored when I wrote this post) by Alex Stevens, by Steven Holt, and by Art A. seem virtually identical.


To me, this all seemed quite suspicious, but it's worth noting that one of the users explicitly denied being a developer for one of the debuggers of concern. As a result, I wanted to know if moderators could further investigate to determine whether or not this is a spam ring and, if it is, to take appropriate measures. I think it would be important to remove the indicated answers if they are found to be spam, especially because some are on high-volume questions -- in total the associated questions have more than 1.4 million views.

21
  • 76
    Nice find. They are the only ones ever to recommend this debugger.
    – Jongware
    Commented Sep 12, 2015 at 22:23
  • 24
    And almost the same for the online service.
    – Jongware
    Commented Sep 12, 2015 at 22:25
  • 31
    Artie A. owns xcodeclub and should have stated so, rather than understating it as having "full admin rights..."
    – Jongware
    Commented Sep 12, 2015 at 22:31
  • 5
    @Jongware excellent find on the Whois record! I don't think Art A. was disclosing an affiliation with the "full admin rights" statement you mention; instead, I think Art A. was saying that when you use the virtual machine you get full admin rights to that machine. I didn't see anywhere in the answers I linked where the poster disclosed an affiliation, and I've updated this question to highlight that important fact.
    – josliber
    Commented Sep 12, 2015 at 22:35
  • 61
    Steve Holt!!!!! Commented Sep 13, 2015 at 0:37
  • 12
    sorry for my apparent ignorance but ... who? what's so special with him that it deserved so many exclamation marks? :) Commented Sep 13, 2015 at 1:34
  • 9
    @quetzalcoatl I believe it's an Arrested Development reference (I had to google it). See: en.wikipedia.org/wiki/…
    – josliber
    Commented Sep 13, 2015 at 1:35
  • 27
    @thumbtackthief I believe it's spelled Steve Holt! \o/ Commented Sep 13, 2015 at 2:29
  • 6
    In the case of the virtual/remote MAC questions at least, I notice most of the questions have been closed, and the rest should be. I mean, isn't this the main reason why we ban questions that merely solicit recommendations?
    – Alan Moore
    Commented Sep 13, 2015 at 9:49
  • 53
    I have to say, independently of the outcome of this, congratulations on this finding and linking. You have some serious investigation skills there.
    – acdcjunior
    Commented Sep 14, 2015 at 0:54
  • 69
    I leave for a concert for a day and I come back and someone has dug up a spam ring. I should probably just bail out of SO altogether so people can find all the spam rings.
    – BoltClock Mod
    Commented Sep 14, 2015 at 9:53
  • 7
    How is this getting downvotes?
    – Almo
    Commented Sep 14, 2015 at 13:25
  • 13
    I'm glad that you didn't simply raise a mod flag. I'd like to infamously remember the names of the products.
    – Stryner
    Commented Sep 14, 2015 at 13:34
  • 9
    @JamesThorpe I actually started a chat room with a mod to give them the details, but they suggested I post on meta instead, hence the post.
    – josliber
    Commented Sep 14, 2015 at 13:42
  • 3
    @Almo The Spam Ring Strikes Back
    – TylerH
    Commented Sep 15, 2015 at 21:16

2 Answers 2

112

Thanks for the information. This clearly was a coordinated attempt to spam a set of products by this company, although at least they were better written than most such spam. The users you point out above all were obviously connected in a voting ring to prop up this spam, so all but one of these accounts has been deleted. The last one was left a stern warning so they know what happened, but none of these accounts has been active recently.

By my answer over here, I didn't mean that you should never post anything on Meta about spam rings like this, just that we can detect a network like this with surprisingly little information. Had you pointed out one or two of these accounts with an "other" flag telling us to look into a connection between them, we would have been able to see all the others. This isn't the only spam ring like this I've handled over the last week, and a starting point is all we need to unravel this like a sweater.

The problem with a Meta post like this is that it can sometimes trigger dogpiling that can go in an uncomfortable direction. In fact, I had to decline a couple of spam flags that people cast as a result of this on posts by innocent developers. People seemed to be doing blind URL queries and spam-flagging everything that came up without looking at the poster. Moderator flags let us clean things up without it becoming a public spectacle, and we have a bit more information to determine who might have been involved.

5
  • 3
    So just to clarify: are you going so far as to say that it would have been preferable for the poster to not spend the time doing the research himself and instead just use an "Other" flag mentioning one or two of the connected accounts (since you'd have rapidly unravelled everything anyway, and the public post is undesirable)? Whatever the policy on this for future sleuths like the OP here, I'm glad we now have at least one case of a large spam ring thoroughly documented on Meta; it's an awesome case study for those of us who, unlike you, don't see this stuff routinely.
    – Mark Amery
    Commented Sep 15, 2015 at 10:48
  • @MarkAmery - the takeaway I got was that doing the homework is good, although the mods don't need that much info to investigate. When flagging we've got as many characters as a comment to play with (500), it should be more than enough to get the point across, with a few links to some users as an aside. Multiple profile URLs could probably even be shortened to something like /users/12345/username if you know of multiple accounts
    – Robotnik
    Commented Sep 15, 2015 at 10:55
  • 2
    @Robotnik: The shortest you can get with a clickable link is stackoverflow.com/u/<userid>.
    – BoltClock Mod
    Commented Sep 15, 2015 at 11:15
  • 3
    @Mark Amery: Research is great, case studies are great, but as long as the meta effect is a thing we don't feel 100% comfortable with public postings that out specific posts and user profiles. That's what Brad is saying.
    – BoltClock Mod
    Commented Sep 15, 2015 at 11:18
  • So... Basically what I said in my rather-heavily-downvoted "answer". Splitting hairs - but I didn't say you shouldn't make a meta post (it's your choice), I said no mod should have told you to.
    – Mogsdad
    Commented Sep 15, 2015 at 11:19
3

In his answer to Possible spam ring, but trying to describe it is too long for the custom moderator textbox, Brad Larson says that it should be enough to raise a custom flag with only some of the evidence:

Thanks for pointing this out. Even a little bit for us to go on in an "other" moderator flag is usually enough to get us to start pulling on a thread and unravel networks like this, so don't be afraid to use one of those even if you can't fit all details into it.

If Brad's response is correct, then no mod should have told you to make a Meta post.

A little consistency would be nice. Can mods discuss amongst themselves, and provide a canonical answer for how we should report these rings?

15
  • 5
    Even if your point if definitely a good one here (2 mods, 2 different messages), I don't think this answers the original post. Maybe a completely new meta post asking for a "canon" answer to this would be in order?
    – Patrice
    Commented Sep 14, 2015 at 14:09
  • 1
    Thanks for the feedback! I would also like to hear an official policy, but in complicated cases I personally think a meta post is warranted. I spent a number of hours digging up all the evidence I've presented here, so I think it would have been a shame to condense everything to a few hundred characters and have a mod have to do all that digging all over again.
    – josliber
    Commented Sep 14, 2015 at 14:10
  • @josilber Even though you investigated it, a moderator still has to review each account and possible answer.
    – Taryn StaffMod
    Commented Sep 14, 2015 at 14:11
  • 14
    @bluefeet: The difference being at least this time we're given tons of information to go on. Sure, some of them might turn out to be red herrings, but the rest might well be damning evidence. That's work done for us, without our even asking.
    – BoltClock Mod
    Commented Sep 14, 2015 at 14:20
  • 10
    I don't think it's possible to have a consistent policy here. Every case is different. I don't blame the OP for posting on meta, even though he could well have simply tossed a few links into a flag and nary an explanation.
    – BoltClock Mod
    Commented Sep 14, 2015 at 14:22
  • 5
    My $.02, I don't see why there has to be an "official" policy - both a meta post and a custom flag will get the balls rolling in the correct way; I think Brad is correct that a custom flag would have been sufficient, I also agree with @BoltClock that providing even more information that can only help.
    – durron597
    Commented Sep 14, 2015 at 14:44
  • 1
    Is there any reason not to flag one post and follow up with an email, linking the flag and including the rest of the information?
    – ssube
    Commented Sep 14, 2015 at 14:49
  • 2
    @Patrice - The original post is tagged "discussion", and does not ask a question that can be answered - thus, this post continues the discussion, tangentially.
    – Mogsdad
    Commented Sep 14, 2015 at 14:53
  • 1
    @ssube seems promising, though I'm not sure what address I'd send the email to (an individual mod based on posted contact details?). I believe the "contact us" link at the bottom of the page contacts SE, while I would ideally get in touch with the SO mods.
    – josliber
    Commented Sep 14, 2015 at 14:54
  • @ssube - one reason not to take that approach: there is no email address designated for that. Maybe a private chat inviting some psuedo-user though?
    – Mogsdad
    Commented Sep 14, 2015 at 14:57
  • @josilber The contact us link should contact SE support, who can send it on to the write people there. Why do you need to contact any particular employee or moderator directly? I think letting them handle it will probably get a better response time.
    – ssube
    Commented Sep 14, 2015 at 15:01
  • 8
    @ssube Your reasoning might make sense if you know how SE is organized, but a lot of places, the "contact us" link is basically a black hole guarded by support personnel who are trained to fend off everyone, or marketing who are trained to misunderstand everything and spam you. Most of us have a strong and well-founded desire to avoid going there.
    – tripleee
    Commented Sep 15, 2015 at 5:17
  • @tripleee: the contact us form goes directly into the community team's inbox, who have readily available access to moderators on every site.
    – Amelia
    Commented Sep 15, 2015 at 9:32
  • @Amelia That's excellent, but that's not the problem I am trying to discuss. As josilber remarked a couple of comments back, the problem is that "Contact a moderator" doesn't seem to be properly documented; and without documentation and/or inside information like yours, users are grappling.
    – tripleee
    Commented Sep 15, 2015 at 9:39
  • 3
    Posted a follow-up: meta.stackoverflow.com/questions/306097/…
    – tripleee
    Commented Sep 15, 2015 at 9:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .