Aftermath: a major spam breakout (and advice for reporting) RRS feed

  • General discussion

  • Been willing to get the attention from Forum users (including moderators) to be aware of what just happened today, because it was significant.

    I'll give out the key situation of the actual incident.

    Friday evening was just an excellent start of the weekend, so I would hop on my computer and do some activities all through the day. And some time later, when I do check the TechNet Forums, I would normally see the latest posts and answers from help-seeking users.

    But during this time, what appeared on the front page looked a bit strange because most of the text was not in English. In fact, there was a series of posts written only in Korean language, which didn't make sense because I was on en-US when those posts are supposed to belong to ko-KR. I even noticed email addresses posted on the initial threads' title, which isn't usually permitted on the Forums because it compromises the user's privacy.

    It was not until after a while I started to realize something...

    I've encountered spam posts!!!

    Shortly after realizing, I managed to report those posts to Microsoft in an attempt to remove the litter the spammer made. In addition to this, I warned him through replies that the posts he made were in violation of the Code of Conduct. This was an especially difficult process, as there were so many posts left by the spammer. As a result, while continuing to report more garbage I decided to seek attention from the Forum moderators so they can take action. At first it took time for them to remove the posts due to delays.

    The spammer also continued to post more garbage through sock puppet accounts; that is, alternate accounts used in an abusive manner. This created additional chaos over the TechNet Forums, hence quickly becoming significant. At first I started to think that the spammer's primary intent was to overload the servers' database, and/or to compromise the security of the Forums as well.

    The incident lasted through the night. Things remained hectic until then, when the moderators were already taking care of the situation. It was still a slow process, though. While I feel very lucky about this, that the situation was cleared, I still want to give out advice as to reporting inappropriate posts...

    If anyone notices anything unusual on the Forums, such as an off-topic post that contains off-topic external sites, or multiple posts hosting the same but similar content, this is considered spam, and you don't obviously want to read them because you don't know whether the links are safe or not. In the case you encounter a spam post, here's your best bet: it's the time to report it! When someone thinks the post they were reading was inappropriate, I would suggest they click on "Report as abuse" and select what they are concerning. Depending on the time, a forum administrator may take action based on the reason for reporting (deleting and editing posts are the most common).

    My advice should be that clear enough. Hopefully.

    • Moved by Dave PatrickMVP Saturday, May 18, 2019 1:19 PM
    • Edited by DanPinGF Saturday, May 18, 2019 5:11 PM moderator --> administrator
    Saturday, May 18, 2019 5:41 AM

All replies

  • The situation today is NOT unusual, except for some flakiness in the forums themselves. We always get hundreds of spam posts per day, especially on weekends.

    But the forum admins asked me to just report one post per spam user. Apparently they get lost if there are too many reports. If the spam remains after 1 or 2 hours, I report another by the spammer. But if all posts by the spammer have been reported, we have no more bullets to fire. The spam can then remain for days. See this Wiki:


    Unfortunately, keeping track of each unique spam user is not easy. I copy the profile activities page to a text file to help. I honestly am surprised all of this is still necessary after so many years. I have been reporting spam daily for about 4 years.

    Richard Mueller - MVP Enterprise Mobility (Identity and Access)

    Saturday, May 18, 2019 3:52 PM
  • Replying to spam posts is a waste of time. They don't read the replies, they don't even post their posts. Scripts do this. And they don't care how overloading this can be. The more the merrier for them, more spaces filled with their links, higher possibility someone will click on them. I also agree with Richard, that reporting just a spammer should be ok than every post. I don't know how moderating queue is setup in these forums. But in a few forums i have moderated i would be annoyed to get 1000 reports about one spammer account's posts, when 1 report is enough to remove that user and all of his content at once (if these forums can do this).

    P.S. have seen lots of such Korean spam during 2014-2016 on one forum. It stopped once we switched to other forum software. I guess their scripts were adjusted to work with particular vendor's software.

    Saturday, May 18, 2019 4:51 PM
  • When we report a post as abusive, the report goes to the forum admins. Only the forum admins, not moderators, can ban users. When the admins ban a user, all of their posts are deleted in bulk at once. We moderators are wasting our time if we delete spam.

    Richard Mueller - MVP Enterprise Mobility (Identity and Access)

    Saturday, May 18, 2019 5:00 PM
  • The front page seemed to be a bit buggy last night. Even though the spam posts were deleted, they still remained intact. In addition to this I wasn't getting any updates on the front page at all. It took until this day for this issue to resolve.
    Saturday, May 18, 2019 5:16 PM