User:Pahunkat/Spambot log

Russian Casino



 * - in indonesian

Traditional English format
Possible that the -number suffixed and non-number suffixed are different variants? Unlikely given consistency of ones below








 * - multiple attempts to avoid detection
 * - multiple attempts to avoid detection
 * - multiple attempts to avoid detection
 * - multiple attempts to avoid detection
 * - multiple attempts to avoid detection
 * - multiple attempts to avoid detection
 * - multiple attempts to avoid detection
 * - multiple attempts to avoid detection
 * - multiple attempts to avoid detection
 * - multiple attempts to avoid detection
 * - multiple attempts to avoid detection
 * - multiple attempts to avoid detection

Modification of normal

 * - domain spammed by "normal" variant
 * - domain spammed by "normal" variant

Unsure
Above had userpage deleted before I could have a look

Possibly a NTSAMR 'new' configured wrongly?

Observations

 * Predominant variants are the emerging "new" spambot category which tends to be in English, followed by the more established casino userpage spambots which tend to be in russian.
 * Blacklisting links can help (some are caught by the blacklist), but the spammers will find different links once they are blacklisted
 * There are noticeable editing patterns and traits that may be helpful for solutions such as edit filters/bots to recognize such spam
 * There are noticeable attempts to avoid detection in some of the "new" categories using characters similar to the english alphabet (but which are different)
 * All spambots are being caught by some existing filter or another, however these filters produce too many false positives to be set to disallow.