# \`levenshtein distance spammer emails\` should flag accounts that are similar even if no accounts have been marked as spammers yet
**URL:** https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858
**Category:** Feature
**Created:** [7 בספטמבר, 2016, 10:10pm UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858 "2016-09-07T22:10:57Z")
**Posts on this page:** 20
**Page:** 3
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [9 בספטמבר, 2016, 3:18am UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/41 "2016-09-09T03:18:22Z")
> [@jomaxro](#):
>
> She wasn’t really thinking “let’s delete the account so Discourse will block the IP”, she was just trying to stop the barrage of spam from these accounts.
I would definitely train your moderators to “delete as spammer” any spam accounts **immediately** , there’s a bunch of stuff that just can’t happen if that doesn’t happen:
- none of the IPs are blacklisted
- none of the emails are blacklisted (or tested for levenshtein distance)
- none of the post content is sent to Akismet for bayesian spam inference
Also, your idea that “hey just look for similar emails at signup, it’s easy!” doesn’t actually _help_ in the cases I’ve seen; it’s quite rare for spammers to use nearly-identical emails, they usually generate 12-16 character random emails. I also simply don’t agree that we should check other new accounts, **all of this is predicated on spammers being deleted and _correctly tagged as spammers_** first.
(It is interesting @sam that these bamwar-esque koreans did _not_ fall afoul of the fast new user typist check though. I also think Stonehearth might be missing the “korean characters are an immediate warning flag” check? They also clearly came from a variety of different IP addresses, otherwise they would have hit the no-more-than-3-new-users-from-the-same-IP check.)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [9 בספטמבר, 2016, 3:27am UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/42 "2016-09-09T03:27:36Z")
Stated another way, here’s all the checks these spammers passed:
- Akismet explicitly said “not spam” on each and every post they made
- They did not come from the same IP address, or they would have run into our default “no more than 3 new users from the same IP” block
- They did not hit the “super fast typist” new user check
Failing to delete them as spammers also means:
- we did not add them to the IP block list
- we did not add their email to the email block list
- we did not test their emails against recent spam block emails
- Akismet did not get the spam content to add to its bayesian inference engine as a spam signal
Other than the korean character check, not sure there’s a whole lot else we could really do here. It is _critical_ that staff understands to **Delete as spammer as quickly as possible** though. Until the user is unequivocally marked as “YES THIS IS A SPAMMER” our hands are a bit tied. I am _not_ down with randomly comparing emails of new users, _until_ those users have been confirmed as spammers.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [9 בספטמבר, 2016, 3:36am UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/43 "2016-09-09T03:36:02Z")
Thanks for the detailed look into what happened. I will inform staff of the importance of using the “delete as spammer” option as quickly as possible. To check, does deleting a user from the Admin user page (and blocking IP/email) do the same thing? Looking through the logs it seems each moderator deleted people differently.
> [@codinghorror](#):
>
> I am not down with randomly comparing emails of new users, until those users have been confirmed as spammers.
Understanding all the checks they managed to pass through, I am curious why you are _not_ down with checking emails on registration? Checking emails against the last 100 registered emails shouldn’t be a performance issue, doesn’t seem to be a privacy issue (the check is by the system, not a human looking at an email), and won’t effect 99% of people. I guess what I am asking is what harm would it do to check emails before spammers are confirmed?
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [9 בספטמבר, 2016, 10:25am UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/44 "2016-09-09T10:25:25Z")
> [@jomaxro](#):
>
> To check, does deleting a user from the Admin user page (and blocking IP/email) do the same thing? Looking through the logs it seems each moderator deleted people differently.
You are presented with an option to Delete and Block or simply Delete. (just like using the Delete button from the User’s Public Profile
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [9 בספטמבר, 2016, 11:53am UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/45 "2016-09-09T11:53:48Z")
> [@cpradio](#):
>
> You are presented with an option to Delete and Block or simply Delete. (just like using the Delete button from the User’s Public Profile
Right, I see the option to delete an block in all 3 spots. I just wanted to verify that it didn’t matter where the blocking was done from, as the delete and block from the spam flag queue explicitly says “Delete Spammer”.
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [9 בספטמבר, 2016, 12:43pm UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/46 "2016-09-09T12:43:40Z")
Yes, it doesn’t matter. So long as you choose the correct one and do not choose “Delete Only”
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [30 בספטמבר, 2016, 11:12pm UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/47 "2016-09-30T23:12:02Z")
We figured out the bamwar folks were using _edits_ in the grace period to get around some of the spam checks. @sam added a new site setting as a temporary fix to prevent TL0 users from editing their posts, but we need a deeper fix so edits in the grace period go through the normal validation paths..
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [1 באוקטובר, 2016, 4:32am UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/48 "2016-10-01T04:32:01Z")
Thanks for the update @codinghorror. We appreciate you continuing to investigate the barrage of spam we received. The deeper fix you mentioned, are you planning on adding that to the 1.7 task list or do you expect it to be in a later release?
* * *
As to the feature this topic is about, I’m still questioning your stance regarding proactively checking emails against recent registrations. You’ve mentioned multiple times in this topic that it is _critical_ to delete spammers as soon as possible. I have no issue with that, and have informed the rest of our moderators and staff about this. You’ve stated that doing so kicks in even more spam protections (IP & email blocks and the levenshtein check, for example).
My concern is what to do when the spam attack first happens _and there is no staff online_. I think it is unrealistic to assume that _every_ spam post will be caught by a filter of some kind, and similarly unrealistic that there will be staff online 24/7. Not checking for similar emails until staff intervention makes it easier for a spammer to keep spamming if they’ve gotten around the filters.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [1 באוקטובר, 2016, 6:19am UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/49 "2016-10-01T06:19:30Z")
I just saw this today and I am a bit stumped at how to protect
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [1 באוקטובר, 2016, 7:52am UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/50 "2016-10-01T07:52:56Z")
It is a catch 22, until the email has been definitively marked as a spammer it cannot be checked for anything. So step zero is to delete the spammers as spammers, then the emails can be vetted.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [1 באוקטובר, 2016, 9:58pm UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/51 "2016-10-01T21:58:55Z")
> [@codinghorror](#):
>
> until the email has been definitively marked as a spammer it cannot be checked for anything.
This is what I am trying to get an answer to: why is this the case? The email is there in the database, so I don’t think it is a technical issue - but I could be wrong…
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [3 באוקטובר, 2016, 9:53pm UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/52 "2016-10-03T21:53:40Z")
False positive rate vs ease of getting around it, would be my guess.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [7 בנובמבר, 2016, 11:08pm UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/53 "2016-11-07T23:08:13Z")
> [@codinghorror](#):
>
> we need a deeper fix so edits in the grace period go through the normal validation paths.
Any update on these “deeper fixes”? We’ve enabled “must approve first 2 posts” back when the attack happened, and while we haven’t seen any spam get caught, we’re hesitant to disable it until we know this fix is in.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [7 בנובמבר, 2016, 11:17pm UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/54 "2016-11-07T23:17:22Z")
Yeah we did a pretty awesome fix that stops TL0 from editing, this closed a pretty big hole.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [7 בנובמבר, 2016, 11:18pm UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/55 "2016-11-07T23:18:51Z")
Awesome, thanks! I’ll ask an Admin to remove the post approval for us.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [7 בנובמבר, 2016, 11:23pm UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/56 "2016-11-07T23:23:01Z")
Yeah and enable the “TL0 users can’t do edits” setting as well in your site settings.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [8 בנובמבר, 2016, 12:29am UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/57 "2016-11-08T00:29:50Z")
> [@codinghorror](#):
>
> enable the “TL0 users can’t do edits” setting
Just to check, are you referring to `min trust to edit post` set to `1`?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [8 בנובמבר, 2016, 12:30am UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/58 "2016-11-08T00:30:45Z")
Yes. Specifically it is the _grace period edits_ that are the problem, not editing per se, but this was the easier fast fix. Setting grace period for edits to zero would probably also work, but significantly impact all users..
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [8 בנובמבר, 2016, 12:32am UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/59 "2016-11-08T00:32:13Z")
Do you expect to eventually support setting the grace period for TL0 to a different value than TL1+?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [8 בנובמבר, 2016, 12:32am UTC](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858/60 "2016-11-08T00:32:25Z")
That is another good idea.
[Previous page](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858.md?page=2)
[Next page](https://meta.discourse.org/t/levenshtein-distance-spammer-emails-should-flag-accounts-that-are-similar-even-if-no-accounts-have-been-marked-as-spammers-yet/49858.md?page=4)