MathOverflow

« first day (3229 days earlier) ← previous day next day → last day (749 days later) »

10:14 AM

FWIW the fake phone number support spammer is now targeting your site

in Charcoal HQ, 38 secs ago, by SmokeDetector

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, bad phone number in body, bad phone number in title, obfuscated word in body, +2 more (485): Coinbase Customer Service + 1850-2034-674 Service Number‭ by user481389‭ on mathoverflow.net

tripleee

speak of the devil

Martin Sleziak

@tripleee It seems that all post have been removed.

tripleee

yeah, the vast majority get removed within seconds but if it takes more than I think two minutes there will also be a notification here

Martin Sleziak

Each of them from a new unregistered account.

tripleee

10:20 AM

this is a known spammer, they circle from site to site; just figured I'd add a heads-up here in case somebody here would need to be aware of the wider picture

Martin Sleziak

@tripleee Well, that's true only for the rooms where the posts by SmokeDetector is enabled, I guess. (Perhaps such thing could be useful also here - but I am not sure whether the mods would agree with that...)

tripleee

I think there was a meta post when they first started back before Christmas but I can't find it now

@MartinSleziak oh true, I didn't look properly so I assumed this was one of the Smokey rooms but of course I guess it's not

Martin Sleziak

Yes, the message was posted by me. I have mentioned SmokeDetector in this room a few times.

A new post from the same spammer. :-(

This is how I think it works: It needs 6 spam flags from regular users to spam nuke a post. Once a post gets nuked due to spam flags the IP address is fed into SpamRam, effectively denying access to the network for the spammer from that IP. If they switch to a new IP address then the whole game of whack-a-mole starts again. As long as the spammer hasn't reached the 6 spam flag threshold, they are only held to the normal rate limiting. — rene Aug 14, 2021 at 6:43

Looking at the above comment, I suppose that a spammer like this has to change IP. (Otherwise they would be blocked from posting by now.)

It seems that the same spammer moved to another site now:

in Charcoal HQ, 40 secs ago, by SmokeDetector

[ SmokeDetector | MS ] Bad keyword in body, bad phone number in body, bad phone number in title, obfuscated word in body, phone number detected in title, +2 more (471): Binance Contact Number + 1850-2034-674 Binance Number‭ by user18988236‭ on academia.SE

tripleee

some of them clearly are loosely organized, e.g. by hiring people in internet cafés to post promotional links on their behalf ... but probably let's continue over in Charcoal if you want to discuss spammer tactics further

Martin Sleziak

I think I should finally go to get some lunch.

@tripleee In any case thanks for the offer - maybe next time.

And also thanks for posting here.

See you later!

« first day (3229 days earlier) ← previous day next day → last day (749 days later) »

all rooms