The ultimate slow burn spammer?

Stojan Tim

Participant
Joined
Jul 8, 2022
Messages
56
I thought I'd seen it all with spammers, but this is a new high/low. In early 2021 a user registered on my forum, using (with hindsight) a VPN to appear to come from my country.

They didn't post for over 6 months. When they did, it was an occasional one-liner, about a dozen, always in response to a post (never creating a thread) up until this week. I suspected something was amiss because some posts sounded too generic, but then they would post something roughly in tune with my niche. I almost spammed them early on, having a "gut feeling" but equally they could have been genuine. I also noted the lack of trying to post any actual links, spam, or filling out anything in their profile other than a local town as a location. I had to conclude they were a real person but maybe thick as two short planks and in any case a spammer would not take over a year to build up a profile.

Today they broke cover... quoting one of their own posts and then adding a spam link with some anchor text. I suspect they tried to go back to the original post from last month and edit it to add this link but could not due to my short edit window (hours), so quoted it and added a link in the hope it would not be noticed. But it was ;)

Looking at their IPs, all VPNs. If this is not a lesson in why unlimited edit time is a BAD idea, nothing is.

So... don't post for long enough to avoid a timed spam threshold... check. Post a dozen or so normal looking posts to evade a post count spam threshold... check. Use a VPN to appear in the right country... check. Don't post any links in posts or profile so as not to attract attention... check.
 

Stojan Tim

Participant
Joined
Jul 8, 2022
Messages
56
Actually... they did start a thread, a new member intro, saying they were interested in my niche. So add that to the list above.
 

Stojan Tim

Participant
Joined
Jul 8, 2022
Messages
56
Nothing at all at the time of registration. Only an IP for "Hydra Communications" which is noted as recent forum spam source but much later on.
 

Zero Numbers

Adherent
Joined
Sep 20, 2013
Messages
357
What type of stuff did the spammer post that was generic? Did the spammer ever try to get to know you or anyone?
 

Stojan Tim

Participant
Joined
Jul 8, 2022
Messages
56
"Thanks for sharing"
"Looks wonderful!"
"Looking forward to it"

Always short responses but sometimes with a passing reference to my niche (an analogy, if I was a motorbike forum, "Thanks for sharing. Wonderful bike."

Also done over such a long period, it's only looking at the user's posts in a list you see the wall of similar sounding, empty content. In the day-to-day traffic it's just another normal but short post.

I'm struggling to see the value of the time invested here by the spammer, unless they do this all day on hundreds of sites, so after a lead-in time of a year or so, you have a big portfolio of "deep" and potentially hard to find spam. Also this strategy is possibly more beneficial on sites that allow you to edit older content, that seems to be the key here.

Edit - In fact I just Googled the user name and they are active under the same name on multiple forums. On one of them where the post history is public, I see they have edited an older post to add an anchored spam link to a job site. Found another one too on a different forum. Editing old posts they have built up over time to avoid auto spam checks. 100% spam but maybe specific to an employee/SEO company working for that one site.

The scary thing is these sites have not noticed the spam, so it must be an effective strategy.
 
Top