3

Errmm... I keep getting things like this on the review thing - it seems to be anonymous users spamming...

Here is a screen-shot in case the link does not work: enter image description here

Is there anyway of blocking this?

Edit: Another example has just appeared here

  • 1
    Nope. But, you can report the malicious site: security.stackexchange.com/questions/1728/… – blade19899 Jan 13 '14 at 19:20
  • 2
    just reject them... – Braiam Jan 13 '14 at 19:22
  • 1
    If they keep using the same link we might be able to blacklist it.. but just reject them – Seth Jan 13 '14 at 19:24
  • 1
    Just like to mention, I've seen this several times on the same post. This one in particular has been spam edited a few times. And this similar post as well. Could there be a pattern? – kiri Jan 17 '14 at 0:47
  • Yeah, sort of weird and interesting isn't it... Rather annoying, rather pointless, but interesting... Rather daft spam messages,so why any one would bother? Spam robot perhaps ?@minerz029 – Wilf Jan 17 '14 at 10:37
8

Rejecting these as spam trains the spam filter, which very quickly keeps them out. It's very rare that the same spam network only targets one of our sites; those that hit Ask Ubuntu also tend to hit Magento and Stack Overflow, the sites all use the same spam data, so all benefit from the actions that everyone takes.

What you might see, depending on the size of the attack, is spam edits still in the queue from things that have already been blocked, it's just some of their edits linger. I'm looking at purging recent suggestions from blocked anon users, but that's ... a little tricky and somewhat dangerous.

We do a good job of quickly blocking it, what we're not so good at is quickly dumping it from peoples in boxes and flushing the remaining junk out of the queue - I'm going to try to get a solution for that in place (or at least planned for the very near future) by the end of the week.

Update (1/20/2014)

We now have honeypots deployed, which detect these seemingly innocuous posts as targets based on activity, and deal a much harsher penalty to those that attempt to spam them after they've been identified as a target.

The actual parameters that go into 'what is a target?' are secret, but I can say that they very from site to site, depending on the activity that they see. They're also central, if you get blocked for spamming a honeypot on Drupal or Stack Overflow, you'll also be blocked on Ask Ubuntu (or the reverse of that).

There's still the question of getting better at auto-purging likely spam that blocked origins have 'contributed' in the hours leading up to their block - but this is sort of dangerous. We're going to continue to analyze how well the honeypots work, and go from there.

Still, this should prevent an even larger chunk of it from getting through.

  • 5
    Tim Post, you're awesome! – Seth Jan 14 '14 at 17:39
  • So now will new ones like this be blocked? @Seth +1 – Wilf Jan 18 '14 at 14:03
  • @wilf Yes, that's what the answer says ;) – Seth Jan 18 '14 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .