13

While Stack Overflow employs a good number of anti-spam measures, some spammers are bypassing them on a daily basis. The Smoke Detector seems to be doing a good job of identifying these for manual closing, but the spammer just keeps on hammering the site. As a regular user, what more can I do to persuade them to stop, beyond trivially flagging the individual posts as spam?

This question is about a recent incident, but I am looking for answers about how to respond in the general case.

20
  • 51
    Sigh. If you pay a lot of attention to a smoke detector then you are going to find a lot of brush fires. That does not mean there are too many fires. Spam is not a problem at SO, tens of thousands of hands make light work and they don't need a detector. I personally rarely have to delete spam. Maybe that means your detector works well, but hey, don't hog it all for yourself, deleting spam is fun. And for crissake, never respond to a spammer. That tells him that the spam is getting read, encouraging him to post more of it. Commented Aug 17, 2016 at 12:09
  • 2
    @HansPassant Thanks, I'll emphasize that in my answer. I hope we agree that fixing the root cause would be a lot more satisfying than hiding the problem.
    – tripleee
    Commented Aug 17, 2016 at 12:11
  • 38
    There is one simple answer: flag it. That's it. There is no need for the hundreds of words in your actual answer below. And this coming from someone that incessantly writes TL;DR answers!
    – Cody Gray Mod
    Commented Aug 17, 2016 at 14:38
  • The TL;DR comes from having Meta posts voted into oblivion by people who would only read the first three sentences. I've updated the question to clarify that I mean beyond trivial flagging, though this update comes kind of late. I apologize for not being clear about this in the first place.
    – tripleee
    Commented Aug 17, 2016 at 16:22
  • 1
    Cody Gray's comment should be the answer. Flag it and walk away.
    – TecBrat
    Commented Aug 17, 2016 at 17:57
  • 3
    I'm a bit baffled. If you don't want to do more about spam that's fine, but you seem to be saying that those who want to do something more than just the routine filtering should not. That's frankly irresponsible.
    – tripleee
    Commented Aug 18, 2016 at 5:52
  • 7
    Well, the whole point, though, is that flagging the spam is only "trivial" in that it requires minimal exertion on the part of the spammer. The system, however, has a lot of smarts in how it handles spam flags. The whole point is that you really don't need to do anything more. And shouldn't have to---if you have some ideas on how to make the system smarter, propose them as feature requests for the team. Not things the end user should have to do.
    – Cody Gray Mod
    Commented Aug 18, 2016 at 10:39
  • The question is not about what you need or have to do. I agree that the title might suggest otherwise but am hesitant to change it at this point.
    – tripleee
    Commented Aug 18, 2016 at 10:44
  • I should perhaps also explain that this came out as a tangent of a discussion in chat about what additional actions the system, or we as users, could take against spammers. This is not about automation (though if we could automate this, it would be grand, of course); it's about what actions make sense, and (implicitly) which actions don't.
    – tripleee
    Commented Aug 18, 2016 at 10:45
  • 3
    I highly doubt Cody has some exterior motivation or an agenda to push. These comments are simply suggesting to you that all you need to do is flag -- it is not your job to report spam domains or anything else. If you really want to, you can, but the benefit of it is probably small and I wouldn't suggest wasting your time that way.
    – hichris123
    Commented Aug 18, 2016 at 10:50
  • 1
    @HansPassant SE has effective spam filters and catches 99% of the spam attempting to hit the sites. Smoke Detector catches (I think a higher percentage >99%) of the remaining 1% of spam that makes it to the site. I am a believer that all the community should be included in flagging spam and removing it from the site. After all that is what the flags are for. You're right it's very therapeutic flagging and helping to delete crap off the site. ;)
    – user3956566
    Commented Aug 18, 2016 at 11:19
  • 8
    Yes, I am making a point. And not particularly subtly. I think your suggestions here are misleading and a waste of time. People on Meta who search for "what to do with spam" will come across this, become overwhelmed, and fail to do what they really should be doing. A detailed exploration of how spam comes to be, what spammers motivations are, and how to root it out at the source is not specific to Stack Overflow and is therefore off-topic on Meta. It belongs somewhere else, like Webmasters or SF or SU. This Q&A is not useful. If the spam detection system can be improved, let's do that instead.
    – Cody Gray Mod
    Commented Aug 18, 2016 at 11:37
  • 1
    @CodyGray I agree flag flag flag and make it known for people to do so meta.stackoverflow.com/questions/327636/… Also SE is always looking at ways to improve anti spam measures
    – user3956566
    Commented Aug 18, 2016 at 11:47
  • 3
    The title does not well describe the content of this post.
    – jpmc26
    Commented Aug 18, 2016 at 19:06
  • 1
    @Yvette Thanks; updated. With that change, I'm afraid I will also move the accept to my own answer, since yours now is somewhat tangential.
    – tripleee
    Commented Aug 21, 2016 at 9:40

3 Answers 3

32

On average, SE catches 99% of the spam before it hits the sites, Smoke Detector catches the bulk of the spam that then does make it to the sites.

Angussidney reports

around 7% of all identified spam has to be reported manually, 93% is caught by Smokey

There are many people who sit in Charcoal HQ just for the love of flagging spam.

SE is continually looking at ways to improve spam detection and there is a vague possibility of incorporating smoke detector into this.

A quote from Pops

/... This all sounds amazing, and that's really saying something because knowing you all I had high expectations to begin with. ../.. I'm going to keep poking around both at smokey and on our end. Feel free to ping me if you have further questions/requests/ideas, I will definitely be back in the coming days with more info about my thoughts.

I'm a great believer in using the sites greatest resource to do the things that automation cannot. The users. And flag, flag, flag. It's highly therapeutic watching a post be deleted and knowing that your flag assisted in that.

So in short to answer this:

As a regular user, what more can I do to persuade them to stop, beyond trivially flagging the individual posts as spam?

Nothing trivial about it, it's our greatest tool on the site. Spam and abuse flags. They bypass the usual close voting to deletion, and cost accounts a penalty of rep, that also gets mod attention. Once a particular message gets a sufficient number of spam flags, it will be removed from the site. (Users with 10k+ reputation can still review it.) The details of these mechanisms are documented in more detail here.

6
  • 2
    to do: remember to post a comment about the to dos in this answer.
    – Tunaki
    Commented Aug 19, 2016 at 21:32
  • 6
    There are many people who sit in Charcoal HQ just for the love of flagging spam. TIL there are completely crazy folks on SO.
    – enderland
    Commented Aug 20, 2016 at 1:10
  • 3
    @enderland: It really took you that long to notice? Commented Aug 20, 2016 at 1:16
  • 2
    @LightnessRacesinOrbit it's Friday night and I'm reading MSO. I'm... not sure my comment doesn't apply to me.
    – enderland
    Commented Aug 20, 2016 at 1:17
  • 1
    @enderland: Fairly sure it does :) Commented Aug 20, 2016 at 1:18
  • 2
    @enderland I sit in charcoal between 3 and 5 hours a day because killing spam is catharthic and with the browser extension that pings you on every report, and the userscript that automates feedback when you flag, its really easy to kill every single spam that goes through smokey while doing something else entirely. Thanks to the association bonus you can create an account and start killing spam on the entire network instantly once you reach 200 rep anywhere. Its great really.
    – Magisch
    Commented Aug 20, 2016 at 11:41
11

Spam is pesky because there is often a food chain between the actual spam and the ultimate beneficiary. Often, the money trail is hard or even impossible to follow. The following attempts to draft up a hierarchy from low-hanging to possibly impossible-to-reach fruit.

TL;DR: My conclusion is to go after the web site hoster. This is a resource which they are paying for each month, and (to the extent that they ever have returning customers) one which they probably want to keep. Email accounts, open proxies, and zombie computers are an expendable, consumable resource which they fully expect to lose and replenish on a regular basis.

Also, before we proceed, never ever expose yourself to the actual spammer - they will often regard even negative feedback as a sign that their campaign is working; and if they don't, they might have a nasty desire to retaliate.

As the underground economy develops, we are seeing an increasing specialization, which serves two purposes. On the one hand, outsourcing parts of your operation is simply good economy on the part of the shady marketer. On the other, using intermediaries offers you plausible deniability - up the food chain, at every stage, you will find operators saying "yes, we hired those guys, but they assured us they would not stoop to spamming". A third benefit is that if one piece of the downstream gets taken down or just decides to quit, it can quickly be replaced.

At the top of the food chain, you have the operation with a product or service to market. They will sometimes outsource the marketing to a spam specialist, who in turn might use a (possibly legitimate) mailing list management software or service, email address database, and/or email delivery service. Even if they don't, they might well pretend to be doing this, again to achieve plausible deniability.

(Because of spam, email in this day and age is error-prone and murky. There used to be a time when you could be sure that an email message was either delivered to a mailbox, or you would receive a bounce message indicating an error. Not so any longer. Spammers have poisoned every well, and the email industry has sometimes responded with countermeasures which did not work out so spectacularly. This created the opportunity for a completely new service, the email deliverability experts.)

Web site / blog / forum spam is governed by the same economics as email spam; though some details will differ, the general picture is similar. You might have a crawler bot which brings up new sites or pages to post spam to, and a script or even a network of human users who post the individual spam messages, but the general game play looks the same - smack one, and another will pop up faster than you can say "whack a mole".

With this background out of the way, my recommendation follows.

If the spam has a link to a web site, complain to the network owner.

For example, searching Metasmoke for online + training currently brings up the following incidents from the last week:

(The domain names link to a MetaSmoke search for the domain name itself; not all of them use "online training" in the title, though that seems to be quite predominant at the moment.)

As of right now, sunitlabs.com, suryaonlinetraining.com, and 123trainings.com all resolve to 23.229.226.4. Reverse DNS identifies this as belonging to secureserver.net, which (if I am reading this correctly) is Go Daddy. whois for all three domains seems to bear this out. Googling for the phone number brings up some additional web sites which appear to be part of the same operation, as well as a number of warnings and spam complaints, which (it would seem) ought to be enough to persuade their ISP to take complaints seriously.

There is an abuse contact form at https://supportcenter.godaddy.com/abusereport where you can click the "spam" option and select the radio button "I wish to report unsolicited comments on a forum, blog or in an instant message". They are asking for your name and your email address in the next step of the form. They require a screen shot; I gave them the Metasmoke query results which I link above, and the URL of this post.

If you could find the IP address of the client which posted the spam to Stack Overflow, you could complain to the ISP who administers that part of IP space. But more often than not, this doesn't get you anywhere - ISPs are much too busy to police individual users, who are possibly hopping from one IP address to another via mobile roaming etc. Frequently, the IP address turns out to be a member of a zombie network - an innocent broadband customer has had their computer hijacked by malware, and co-opted into a secret spam and malware distribution network while the owner continues to use (what is left to them of) their computer for legitimate work. And anyway, the IP address of another user is not visible to us mortal users.

14
  • 12
    I'm not sure what you think the hosting provider can (or will) actually do? There is no way the spam is sent or created from the same server where the websites are hosted, so from their point of view it could be anyone, including people who want to troll the website itself.
    – DavidG
    Commented Aug 17, 2016 at 15:21
  • 1
    A single complaint is unlikely to sway the hosting provider one way or the other, but enough reports with enough evidence that they are knowingly violating basic netiquette in general and the hosting provider's AUP in particular should eventually get them disconnected. I'm sure they have a contingency plan for this scenario, too; but in the long run, this is the only way to convince them that spamming is not tolerated. (I hope we agree that we are not all complacent towards spam, and regard it as undesirable.)
    – tripleee
    Commented Aug 17, 2016 at 15:39
  • 2
    But I'm saying that you won't have any direct evidence that they can use. Sending GoDaddy a complaint saying "we got spam from IP address a.b.c.d" when that address is not owned by them, even from 10,000 people, will not make them touch a clients service. And quite rightly so too.
    – DavidG
    Commented Aug 17, 2016 at 15:44
  • 17
    While I appreciate the thought you put into this, I don't see how this is ever going to work. You're trying to beat a cheater with rules. Even if this worked a few times (not that it would for reasons @DavidG pointed out), they would just find a way around it. That's why we have flags and mods that commit time to keep spam from the feeds. Commented Aug 17, 2016 at 15:53
  • 9
    This has some merit. Most domain registrars have a pretty strict no-spam policy. So strict, in fact, that you can pay a botnet to spamvertise your competition and delight as their domain falls into purgatory until they find some way of proving that they had nothing to do with it. Web hosts also have a similar policy, you can't spamvertise your site and continue to be hosted, even if the spam comes from elsewhere. I want to run some numbers on the frequency of domains in text that folks almost never see (because we block and log it, and that still is the majority of what comes in). [1/2]
    – user50049
    Commented Aug 17, 2016 at 18:59
  • 6
    We might be able to automate abuse complaints for really serious cases, but I have to look at the load that would put on our operations folks because each one would need some human follow up. [2/2]
    – user50049
    Commented Aug 17, 2016 at 19:00
  • reverseip.domaintools.com/search/?q=23.229.226.4 currently reports 153 domains, but the free version only shows the first few, two of which seem unrelated to this spam operation.
    – tripleee
    Commented Aug 18, 2016 at 6:51
  • 4
    This answer is completelly useless to solve anything, but was really interesting to read. Unlike on main site, on meta such answers deserveupvote IMHO. Commented Aug 18, 2016 at 14:14
  • 1
    It would be so nice to respond in kind to the actual spam source sites, using the combined computing power of the Stack Exchange user base. But we can't do that because we're the Good Guys. :)
    – PM 2Ring
    Commented Aug 20, 2016 at 11:19
  • Suggesting illegal actions here is not particularly funny, let alone constructive. There are many ways to react to spammers, but becoming more like them is generally the worst.
    – tripleee
    Commented Aug 21, 2016 at 13:25
  • This passive DNS query currently gets me 91 domain names, which is obviously less than the alleged 135, but perhaps also better, because it excludes inactive sites. passivedns.mnemonic.no/search/…
    – tripleee
    Commented Aug 21, 2016 at 13:39
  • Looks like all the spam domains moved to a completely different netblock now. The provider is still Go Daddy. To my mind, this suggests that complaints do have some effect, though getting them thrown off is going to be a time-consuming effort (at which time they will probably find a different provider). passivedns.mnemonic.no/search/…
    – tripleee
    Commented Aug 29, 2016 at 14:53
  • For what it's worth, it is now 5 months since this spammer apparently went away.
    – tripleee
    Commented May 10, 2017 at 12:04
  • Belatedly, here is a Metasmoke search of the domains belonging to this operation. metasmoke.erwaysoftware.com/domains/tags/83
    – tripleee
    Commented May 18, 2018 at 4:21
-12

Some users used to leave this comment on extremely trivial questions:

Good question. Have you heard about Google?

Maybe we can guide some spammers to a service they can use to advertise stuff properly with a similar comment.

Good product/service. Have you heard about Google Ads?

1
  • 5
    No. Don't interact with spammers. Flag and move on. Report them to those who are in a position to make them stop if you want to do something more.
    – tripleee
    Commented Aug 21, 2016 at 9:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .