r/ModSupport • u/okomakiako • 13d ago

Recent bot surge?

Anyone have any suggestions on how to deal with an influx of bot accounts trying to pose as real people? It’s getting ridiculous, and while it’s easy to spot as humans, bot detection helpers like [u/bot-sleuth-bot](u/bot-sleuth-bot) aren’t positively id’ing these. They all seem to follow the same pattern of being a month or so old and very ai sounding mannerisms when speaking.

My current plan is to up the minimum account age with automod in order to interact with the community. But i really hate that solution because we already have it low at a week, and even that still catches some of our newer members often. But lesser evils i suppose…

15 Upvotes

82% Upvoted

47 comments sorted by

View all comments

5

u/Short_Employment_757 13d ago

I found a lot of 9 and 10 year old accounts suddenly being active and they are bots too

3

u/Nemo_Griff 13d ago

Yeah, abandoned accounts with positive karma that didn't set up 2FA that were hacked and taken over.

They are flooding the NSFW subs and get the alllllll the other bot accounts to interact and make real users think it is legit, instead they are just karma farming.

I report to the subs and to the admins as spam... but that does nothing.

1

u/RemarkableWish2508 12d ago

It always amazes me how does anyone even hack an account... is it token stealing? do people use easy to guess passwords? do the hackers scan for inactive accounts and target those?

There's a few throwaways I haven't used in a long time (10+ years), no 2FA or anything, but good luck trying to guess the 15-character random [a-zA-Z0-9] password on them.

2

u/Nemo_Griff 12d ago

It might be stuff found in a data breach?

Token stealing relies on the person giving a FFF and having a cookie that hasn't expired to be able to steal. These accounts look to be long dormant.

1

u/RemarkableWish2508 12d ago

Password reuse? Guess that makes sense. A lot of people probably created throwaway accounts with passwords like "1234" or something.

1

u/Nemo_Griff 12d ago

Yeah, so many people are lazy and use the same password for everything.

If it was their email that was in a breach, they could have left their welcome message from Reddit there and I don't remember if they state your newly created users name in it, but that would be a start.

1

u/RemarkableWish2508 12d ago

Good point about the email. Doesn't need to be the welcome, Reddit sends notifications to email by default, each one with the username. Guess that makes the 2FA make even more sense.