Occasional weird spam posts by otherwise (seemingly) legitimate users?

Submitted ⁨⁨3⁩ ⁨weeks⁩ ago⁩ by ⁨grue@lemmy.world⁩ to ⁨fediverse@lemmy.world⁩

I’m noticing a pattern starting to develop in the community I mod (just barely – it’s only happened 3 times so far) where a user that posts a fairly large amount of relevant content occasionally posts weird spam with a title of alternating letter nonsense (e.g. “zazaz” or “sdsdsds”) and a link that goes to some random domain that serves nothing but a default 404 error (as in the domain is registered and there’s a server responding to requests, but there’s no content for it to serve).

I suppose it could just be bad behavior on the part of said users, but it feels more like a bug or their account getting hijacked or something. Anybody have any insight?

source

Comments

Sort:hotnew top

nulluser@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
I’ve been seeing these posts in various communities for at least a couple weeks. I’ve seen some communities ban the user, but then a different user starts doing it. No idea what’s going on or what the point is.

For those that haven’t seen these posts and want to watch for them (if just for curiosity), sort by “New” occasionally. They get downvoted and/or deleted by mods pretty quickly, so they’re not likely to show up in most other sorts.

source
asudox@lemmy.asudox.dev ⁨3⁩ ⁨weeks⁩ ago
I am not sure how a bug can change a users post to literal nonsense with URLs that direct you to some non functional website.

source
- grue@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  I don’t think a bug is “changing” a user’s post to nonsense; I think a bug/hack might be letting some bad actor impersonate legitimate users or something like that.
  
  source
  - asudox@lemmy.asudox.dev ⁨3⁩ ⁨weeks⁩ ago
    Oh ok.
    
    Though I don’t see how that is the case, unless the hacker is 5 years old.
    
    source
Mechanize@feddit.it ⁨3⁩ ⁨weeks⁩ ago
I’m not sure if you are referring to this, but I’ve noticed some people overriding their comments after around 24h they have posted them - probably running an automated script. I assume they are doing it for perceived privacy reasons.

source
- grue@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  No, these are posts that are gibberish spam from the beginning without having been edited. In fact, in two of the cases the post was later edited to remove the link and change the title from gibberish to “permanently deleted”.
  
  source
jordanlund@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
dwazou was particularly bad about posting a legitimate link, then editing it to nonsense after the fact. Nobody was quite sure what they were up to, but they caught bans for it from multiple communities.

lemmy.world/modlog?page=1&actionType=All&userId=1…

lemmy.world/modlog?page=1&actionType=All&userId=1…

source
alaphic@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
There’s literally one at the bottom of this thread guys

source
FundMECFSResearch@lemmy.blahaj.zone ⁨3⁩ ⁨weeks⁩ ago
Can you contact these users. Ask them if they posted that?

source
- grue@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  I wanted to find out if they were known to be bad actors or something like that first, before tipping them off that I was looking into it.
  
  source
Goretantath@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
Could be bot accounts that have people paid to use them them every once in a while to keep them looking legit. Either for training ai or propaganda.

source
catloaf@lemm.ee ⁨3⁩ ⁨weeks⁩ ago
Can you link some examples?

source
- grue@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  lemmy.world/modlog/3902, ctrl-f for “spam” or “rule 4”
  
  (ordered from newest to oldest)
  
  lemmy.world/post/30789291 by daniel_callahan @ jlai.lu
  
  lemmy.world/post/30245366 by dwazou @ jlai.lu
  
  lemmy.world/post/29941517 by dwazou @ lemm.ee
  
  I’ve also noticed that in the “dwazou” cases the post was later edited to remove the link and change the title to “permanently deleted”. The dwazou @ lemm.ee user account has apparently been deleted, but the other two accounts appear to still be active and posting legitimate content.
  
  Also, the community I mod isn’t the only one this is happening to. See also lemmy.world/post/30720233, for example.
  
  source
  - catloaf@lemm.ee ⁨3⁩ ⁨weeks⁩ ago
    I think “permanently deleted” is when a mod or admin deletes their content administratively.
    
    source
- schnurrito@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago
  I may have found one (coincidentally a few minutes after seeing this thread): discuss.tchncs.de/modlog?userId=20528183
  
  source
  - nokturne213@sopuli.xyz ⁨3⁩ ⁨weeks⁩ ago
    All the ones I have seen are from that same user. @daniel_callahan@jai.lu
    
    source
    -> View More Comments
Microw@lemm.ee ⁨3⁩ ⁨weeks⁩ ago
Maybe admins/app developers doing test posts?

source
- grue@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  I don’t think those accounts are admins of the instances they’re from. They could be alts, I suppose, but why would they use the same alt for both real interactions and test posts? And why would they be test-posting to real communities on other instances (especially without warning the mods first) instead of somewhere like !bot_test@lemmy.world ?
  
  source
  - catloaf@lemm.ee ⁨3⁩ ⁨weeks⁩ ago
    Hard to say just from what’s in the modlog. Maybe they’re editing a post instead of deleting it?
    
    source
Creddit@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
During one of the mass exodus events from Reddit to Lemmy, a lot of people started using these tools they would install to automatically scrub and obfuscate their Reddit comments and posts history. Often these tools would replace posts with random letters and even nonsense links because there was suspicion that outright deleted posts could be detected and then programmatically restored if Reddit really wanted to get that user content back.

I suspect these tools probably exist for Lemmy as well and you are seeing users with long comment histories use them because those also happen to be the users who have a lot of previous content to cover up/obfuscate to maintain/ensure their own privacy.

source
- grue@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  That’s not what’s happening here. The comments are like that from the beginning, not being edited to that state.
  
  source
TinyLittlePuni@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
I remember people using tools such as Greasemonkey to redact comments on Reddit using scripts to mass-replace the content of their comments with babble. If comments don’t get truly deleted when they are deleted or can be brought back up in some way, then editing comments to replace the content of them with babble is better. That’s my two coins anyway. I think something similar is happening here. Another factor could be that some instances might not federate comment deletions as well as they do with edits

source
- grue@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  That’s not what’s happening here. The comments are like that from the beginning, not being edited to that state.
  
  source
oeil@tarte.nuage-libre.fr ⁨3⁩ ⁨weeks⁩ ago
@snoopy@tarte.nuage-libre.fr

source