How to properly identify a spammer?

Hey guys.

I have several spammers a day on one of my forums.
Most of them (95% at least) are recognized either by Discourse, or by Akismet, or are flagged by users when the post is obviously spam.

But some spammers look legit and/or harmless.

Two similar examples:

This one was quickly suspected to be a spam account.
The username is random, but the bio is empty, and there is no brand, logo, or label of any kind so… What’s the point of posting here?

Follow-up:


The user never came back.
So, what do you think is up here? If it’s a spammer, what’s the logic behind this behavior There’s no ad at all?


Another one:

The account is active, but I wonder how it got these 1.5k posts read?


So, for the first one, the registration and last IP were from different European locations, not near Houston as the poster said they have a shop.

For the second one, their email is present with many entries in stopforumspam.com with various usernames, but I don’t know if this website is legit. Do some of you use it?

Do you know any public database that helps detect potential spammers based on information like email addresses?

How do you handle and identify accounts to be sure they’re spammers or not?

5 Likes

Trojan account? Win some level of trust then share affiliated links or product later as if from a legit trusted member of the community? This is more complex social engineering potentially, but it’s fairly obvious when they put little effort into intervening posts before the affiliate link or product promotion comes …

I’m not sure how you’d automate catching that.

One part of the solution: I don’t let low trust levels post external links. TL2 on one of my forums. That means the poster has to put quite a lot of effort in before they can post what they really wanted to post all along. (Because of this I’ve seen recent accounts sometimes suggest what people should put into google search to find what they are promoting! lol). Once they drop that payload they miraculously disappear and never post again.

I believe I caught someone reviewing themselves from another account. When I checked the location of the IP it was the same as the business service provider that was being reviewed. What are the chances given the business was an online business with customers all over the world? Catching that is also not something that would be easy to automate?

4 Likes

When we were getting hammered with spam, we took the nuclear option to require approval for all new posts.

10 staff members worked round the clock to manually clear the review queue of spam. It took about a month for it all to die down. The entire community had been really helpful with this.

3 Likes

We have maybe around 10 spammers a day, maybe a little more (we’re three people moderating and I know they also delete several accounts a day).

Discourse, Akismet, and user reports work like a charm, we need neither automation nor nuclear option. :smile:

Suspected spammers don’t take much work and are fairly rare, but I wonder if there are techniques or third-party services that can help identify manually a suspected account.


Though I add that this is not a real issue to fix on our forum, I’m just wondering.

3 Likes

From experience I can say that some real users might have troll looking behavior. Tackling this is hard and useless.

4 Likes

Yep, an opinionated drive-by user with a short attention span might look like a spammer, but might just be an opinionated drive-by user with a short attention span!

4 Likes

Yes, I use it, and find it very useful.

I’ve seen recent spammers working together - one account posts a legitimate-looking query, and another one later responds with a promotional link.

It may be useful to bear in mind that it’s one business that’s creating accounts, and another business which will use them to post spam - either in posts, or in the profile. Don’t think of spammers as people, but (at best) as employees of a business. That is, the motivations are not personal, but business.

3 Likes

One way I identify them is to just look at the response they give, I sometimes talk very humanly and that identifies the spammer. Like talking about street foods in their locality and how there family is doing, what were your grades in the 12th, typically what a simple neighbor would ask.

No response under 1 month or some weird response proves the spam.

1 Like