Spam Profiles are getting my goat. Could we have better tools for mods to deal with profile spam?

Maybe SE simply shouldn't publicly show profiles for users that have no interaction at all on the site. Users that have never voted, posted or done anything at all are just noise in the user listings anyway. Of course the user itself should be able to see their own profile, but there is really no reason why anyone else would look at it.

Looking for this kind of spam profile is a huge time sink, and not really worth the effort. But leaving lots of this kind of spam visible is also not really a good option. Not showing these profiles at all publicly would mean they only waste a few bytes in the database, which is probably irrelevant. But it would mean there is no need for any moderators or CMs to waste time on this.

A further refinement to Ilmari Karonen's answer (which refines Mad Scientist's): make profiles of new accounts that haven't done anything visible only to logged-in users.

This does a few things:

• Keeps them out of Google. No 'noindex', no robots.txt -- Google just can't see it. That's gotta be more reliable.

• Keeps spammers from being able to send their employers a link to a public post so they can collect their bounties. (I've been told that spammers need to be able to prove they were successful.)

• Keeps the information visible to anybody on the site who might need to look at it. That's probably just moderators (for certain kinds of fraud investigations) and yes you could make an exception for moderators, but maybe having fewer exceptions is better.

• We already have some behaviors that change based on whether you're logged in (front-page view is different, "join" button, tour invitation), so there's logic to hook into.

This question focuses on the spammer profiles. Spammy names can still show up in the list of new users and the badge lists (Autobiographer in particular for this attack). I don't know what is reasonable to do for those exposures -- reasonable in terms of both UX and code complexity. We should identify all the places the names show up before deciding (is it just those two or are there more?).

As a subtle alternative to Mad Scientist's suggestion, we could simply add a noindex meta tag to the profile pages of users with less than some minimum amount (say, 5 or 10 points) of rep. This would keep those pages out of Google's index, and thus make them much less attractive as spam targets, without any really noticeable effects otherwise.

What this suggestion would not do is actually stop the creation of such spam profiles, or hide them in any way from normal users. But it does remove the incentive for that kind of spam, which should gradually reduce the amount of it that we'll get, as spammers notice that it's not working any more. And in the mean time, we'd at least be making the Internet a slightly better place by keeping spam out of search engine indexes.

These profiles are starting to spill into other sites as well.

Yesterday after this meta post was made, I hopped into the user search for RPG Stack Exchange, which I moderate, and looked for profiles which mentioned car insurance. I found two, and I destroyed them both.

Today I checked again and there were sixteen:

These have also been destroyed. The ones I checked into in further detail also had network accounts on Super User.

A moderator on Philosophy Stack Exchange has mentioned they are also deleting 6–10 per day.

This is a drop in the ocean to Super User's several thousand, but it makes me concerned that this may just be the tip of the iceberg, and that this spam might have the potential to become less a finely focused abuse of Super User, and more a network-wide oil spill.

I like several ideas above: hiding 1-rep profiles from listings, letting only the user themselves and moderators see those profiles and/or only logged-in users, making editing your profile a trivial 5-rep privilege, and telling Google not to index these. I'm posting this because I hope to suggest the rest of the network needs a stopgap and/or full solution as well.

I looked at a fair number of these car insurance profile pages and noted that they all seem to have the same phone number. I couldn't find anything interesting about that number in the phone spam database I looked at, so they may not be spamming cell phones also.

A google search on that phone number is a bit interesting. It seems to turn up a lot of spamming all over, not just SE.

It just occurred to me that this might be an attack by someone on the owner of that phone number, rather than against the site. It would probably be very effective, generating a lot of angry calls to the number. The history of the spam accounts may indicate otherwise, but the possibility should be considered.

Are we applying anti-spam filters to profile descriptions? That seems important.

I notice that that these all have a similar format, littered with non-ASCII characters, phone numbers, and long run-on sentences. We could block those.