145

I've found two pools of users whose profiles are probably machine generated. Their creation dates spike near certain days. The users don't seem to have done anything (no posts, no comments, last access date is the same as creation date, etc.), so there isn't much "active" harm being done, but...

This seems like a strange thing to allow to happen here.

Note: In 2018, accounts that had existed for over two years without doing anything* got deleted, and prior to that, automatic deletion used to be done routinely. The users I found probably meet the criteria for deletion. If there's a future batch deletion, any profiles here which meet the criteria will probably get deleted.

Data about the users can be found in this group of SEDE Queries. It shows all the profiles, and graphs the creation date spikes.

User Pool #1: "美女妹子能上门着叫"

Most (all?) of the users' display names contain "美女妹子能上门着叫". I can't read Chinese, but Google Translate says their username means "Beautiful girls can call at the door", which is somewhat of an eyebrow raiser and might be walking some lines with the terms of service / code of conduct.

The profiles' "About Me" sections don't seem to all have identical content, but they seem to be following a pattern:

  • The first part seems like an advertisement for an escort service,

  • then some kind of news report about the Regional Comprehensive Economic Partnership (which I don't know anything about, but seems like a weirdly specific topic),

  • then some tabloid / gossipy news,

  • then what might be an excerpt from a book / poetry.

User Pool #2: "服务真在妹子真找一晚上电话多少"

Google Translate: "service is really in the girl really looking for a night how many calls"

The "About Me" content follows a similar pattern to the previous one, but instead of the RCEP, it has "AsianInvent2020".

Stack Overflow's Acceptable Use Policy

Link.

  • Spam. Users that do not publish meaningful content, use deceptive means to generate revenue or traffic, or whose primary purpose is affiliate marketing, will be suspended.

  • Mass Registration and Automation. Accounts that are registered automatically or systematically will be removed and access will be permanently suspended.

  • Sexually Explicit Material. Accounts that use Stack Exchange to post sexually explicit or pornographic material, or links to it, will be suspended.

If you don't think the above two pools count toward "sexually explicit", then how about this one, from a pool of 461?

To Be Continued?

There are more. Here's a SEDE graph of spikes in created users with "。" or "," in their profiles' About Me sections.

A different heuristic I found recently was to search by Avatar Url. Lots of these groups of yucky profiles have the same gravatar within the group (maybe they're using the same emails and somehow got a same hash-salt value?). I discovered this by modifying a query rene made in a comment to an MSE post (Why do so many users have no hash value for their identicon, resulting in the default identicon being used for each of them?). Here's the modified SEDE query based on the one rene made: https://data.stackexchange.com/stackoverflow/revision/1702306/2070941/. Update: that probably no longer works now (see "We're regenerating all identicons"). But I've found another pretty good way: by finding accounts with the same website URL (here's a SEDE query).

22
  • 11
  • 40
    SE's official policy is "ignore it". We've asked for SE to make changes which would substantially minimize the impact (e.g. don't publicly display profiles for users with < X rep, where X is quite low, like 5 or 10). We, mods across the SE network, have asked for better tools to deal with it. Mods could fairly easily find such profiles. We could destroy them on our site only, but the user could just immediately recreate the profile on that site from the SE account and have back everything that was in the profile (i.e. any profile spam, etc.).
    – Makyen Mod
    Commented Nov 13, 2022 at 23:19
  • 30
    Please don't flag for these, unless they are exceptionally egregious (e.g. child porn). [For those that are exceptionally egregious, please do flag.] If moderators want to spend time on these, then we can find hundreds of thousands of them on our own, and it's a lot faster for us to handle them that way than the one or small number which you might fit in a flag.
    – Makyen Mod
    Commented Nov 13, 2022 at 23:23
  • 39
    Lot's of us are quite frustrated with these, but to actually deal with the problem requires changes to the system which would need to be made by SE. So far, SE has not spent time on making such changes, although there are hints that SE might take a small step in the direction which would allow moderators to be effective in at least getting rid of them on the individual sites where they are a moderator, if the moderator wants to spend quite a bit of time handling them.
    – Makyen Mod
    Commented Nov 13, 2022 at 23:29
  • 16
    Well, bots or not, still "new" user accounts and those look fine when you show some growth charts for the next business presentation.
    – Tom
    Commented Nov 13, 2022 at 23:33
  • 36
    @starball Lack of available time, mostly. To make what I'd consider to be a real answer would require me doing a notable amount research to dig out references from various meta posts and separate out what's in mod-private areas vs what's public on MSO, MSE, and other metas. Me commenting is mostly me expressing frustration with the current situation.
    – Makyen Mod
    Commented Nov 13, 2022 at 23:36
  • 2
    Policy: Profile only, with no activity: meta.stackexchange.com/a/297999/282094 or enough activity to activate links in profile: meta.stackexchange.com/q/1323/282094
    – Rob
    Commented Nov 14, 2022 at 0:21
  • 47
    16809 Accounts Nearly seventeen THOUSAND obviously abusive accounts. I think "It not hurting anyone" is not a valid excuse not to nuke the ever-living crap out of such blatant spam. It's not difficult to hide a user's about me section when they have low rep...
    – Cerbrus
    Commented Nov 14, 2022 at 10:11
  • 13
    We just have to restrict the low rep users. I.e. they need 5 - 15 rep to be able to change the generated name (user12345) and maybe 25 rep to change their bio.
    – Lino
    Commented Nov 14, 2022 at 10:17
  • 14
    @Lino I honestly don't remember how account registration worked, but I wouldn't restrict usernames like that. New users have enough trouble asking questions as it is without an anonymized profile. (At very least allow setting the username, but restrict when it's shown to above a rep treshold)
    – Cerbrus
    Commented Nov 14, 2022 at 11:59
  • 7
    Eight views in total, according to the query, most of which are probably yours. Seems like the only ones wasting their time are the account creators themselves. Commented Nov 14, 2022 at 13:19
  • 23
    These accounts might not be causing harm (yet) on SO but they are potentially being used for harming other servers, with SO being used as a middleware. It could also be used as a demonstration to sell the tool script for mass-creating those profiles. The user pools described resemble similar spam accounts created by Asian-based hackers on Facebook. Such accounts lay dormant for some time until they are massive enough to cause damage to their intended target i.e. overwhelming APIs, mass-creating accounts using cross-site (OAuth) login, mass-reporting target accounts, etc. Commented Nov 14, 2022 at 17:42
  • 31
    Do they have the blue verified icon (TM)? Did they pay $8?
    – Javier
    Commented Nov 14, 2022 at 19:49
  • 5
    @kaya3 At least for the ones identified here for which I've used Google Translate on the profile contents, they sound like typical spam for escort services, which we see all the time, both in profiles and in posts. There's a notable difference between those and the ones which appear to be trafficking. If it appeared to be trafficking, then, yes, that would be something for which we'd like to see a flag, even for it being in a profile. If it's in posts and it's spam of any sort, then a spam flag on the post is appropriate (and the more egregious ones can get a custom flag).
    – Makyen Mod
    Commented Nov 16, 2022 at 0:44
  • 11
    The discrepancy between "things on which SE Inc acts" and "things on which SE Inc does not act" is astonishing. Sure, saying that there is no "active" harm in these accounts is technically true (as is saying that there is no "active" harm in handgranades on children's playground). But I cannot even imagine the attack vectors of several thousand fake accounts. I'm not surprised. Just deeply, deeply disappointed. So ... nothing new here.
    – Marco13
    Commented Nov 20, 2022 at 2:29

1 Answer 1

58

Now what?

On Stack Overflow, probably nothing. I'm not a moderator there anytime soon. On smaller sites, it depends. It doesn't look good when your new users page is full of crap. It isn't welcoming to your community when the Recent Badges is dominated by "Autobiographer" badges awarded to spammers.

On Stack Apps, the flag load is light enough that I can spend 30 minutes on doing busy work each day. There are some custom built queries, apps, chat bots and user scripts that assist moderators to find these profiles and then reset the username, clear the profile, push the changes to all sites, suspend the user and destroy the account.

A quick inspection reveals that the accounts you found didn't cause havoc yet on Stack Apps. I do have a similar case that I have no problem with sharing. These accounts were created while I was actively monitoring the site and I literally nuked accounts seconds after they were created. The problem? The spammer was able to create accounts quicker than I could nuke them. The mod-tooling for this task is so underpowered that for 1 destroyed account 5 new ones were created. Just FYI: moderator actions are rate-limited, especially in this area.

There was some hope that Stack Exchange would be willing to clean-up this specific network-wide profile spam mess, but in the end, it is left to the site moderators again. I know of at least one moderator that also cleaned up the spam flood I referred to. I'm in the process of destroying all these accounts on Stack Apps. Those accounts have been "handled".

We're reassured again and again by Stack Exchange staff that these spam profiles are only a local nuisance. The user profile is not indexed1 so having 16 thousand pages link to a website won't help their SEO ranking. From that point of view, I can understand this issue doesn't get any priority to get fixed soon™. We have to do it with the manual labor of willing site moderators, now and then supported by the CM team. It is far from ideal.

Now what? Wait for 6 to 8 weeks. Hold my beer, I have some accounts to nuke.


1. I don't think SE is right with their non-index argument. I don't believe it is true as I have seen instances where profiles were found, by me and by several others .... but I can only go with the official reading until someone at the company admits they made a mistake. They can be forgiven as soon as that happens.

13
  • 3
    "I have some accounts to nuke." but "I'm not a moderator". How do you do it then? I don't get it. Commented Nov 14, 2022 at 21:56
  • 14
    @ThomasWeller Each quote applies to a different site? rene is a moderator on stackapps.
    – Dan Mašek
    Commented Nov 14, 2022 at 22:03
  • 8
    "Just FYI: moderator actions are rate-limited, specially in this area". Well to that I can say UUUUUGGGGGHHHHHHHH. Commented Nov 14, 2022 at 22:24
  • 10
    @AndrasDeak--СлаваУкраїні I take it you don't remember the last time a mod script went rogue.
    – wizzwizz4
    Commented Nov 15, 2022 at 0:46
  • 2
    @AndrasDeak--СлаваУкраїні kinda makes sense to rate-limit mods, not as much as normal users, but still. You wouldn't want somebody to get up on the wrong side of the bed one day and nuke thousands of profiles for whatever reason, or mess up an automated bot doing the same thing. I don't think the problem is about the rate limiting here :\ Commented Nov 15, 2022 at 11:27
  • 6
    Are you sure the user profiles are not indexed? I remember finding them in Google search
    – Dharman Mod
    Commented Nov 15, 2022 at 14:53
  • 1
    @wizz (and Marco) what are we even doing if we can't trust mods not to abuse their powers? I assumed there was an assumption that mods are above all that, so "mod abuses powers" should be the exceptioniest of exceptions. In other words nerfing normal mod activities is the harmfully dumb choice in my opinion. Yes, if once every 5 years something goes wrong, an employee will have to clean it up. We'll still be better off. Discipline the mod, unmod them, give mods a sandbox to debug scripts in, whatever. (Side note: I'm not a huge fan of "mod scripts". Make it easy and fast for humans to mod.) Commented Nov 15, 2022 at 16:52
  • 6
    Just an FYI: Mods are permitted to use userscripts to automate actions which they would normally perform while they are active using their browser (i.e. where the actions have immediate oversight). However, bots (e.g. operations which are not directly and actively overseen) are not permitted to be run with moderator credentials. While the difference between these isn't clearly defined, the intent is that it's not permitted to not have a human in the loop actively instigating and overseeing the actions.
    – Makyen Mod
    Commented Nov 15, 2022 at 17:22
  • 9
    Also, keep in mind that there are several hundred moderators across the SE network on almost two hundred different sites. So, even if the only reason to have some rate limits was to limit the damage which could be done by someone with legitimate access to moderator credentials, it would still be reasonable to have some rate limits. However, that's not the only possible issue. Just like any restricted access, one also has to consider that it's possible for someone to gain illegitimate access. In such cases, rate limits, particularly on destructive actions, are quite helpful to limit damage.
    – Makyen Mod
    Commented Nov 15, 2022 at 17:27
  • 5
    @Dharman I didn't say SE is right with their non-index argument. I don't believe it is true as I have seen instances where profiles were found so .... but I can only go with the official reading until someone admits they made a mistake. They can be forgiven as soon as that happens.
    – rene
    Commented Nov 15, 2022 at 18:06
  • 3
    @rene or 6 to 8 weeks later. Commented Nov 15, 2022 at 18:08
  • @Dharman I just Googled my account name with site:stackexchange.com and found a few of my profiles...
    – Esther
    Commented May 22, 2023 at 17:44
  • ByteSpider, the current fastest web crawler, is ignoring robots.txt. So spamming on non-indexed content can still affect some Large Language Models.
    – Cœur
    Commented Oct 30 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .