Some analysis of the data in User:PeterL/Spammers.
Many of the earlier usernames are in the format FnameLnameXXX, eg EstherRich791. At this stage it was so predictable that these users would spam that they could be pre-emptively blocked, though no such event is recorded here.
However, during the period of the data collected this has changed. Two new formats have emerged: those in the style of GWesleyBradfordv, ie a FnameLname pattern as above but with a capital alphabetic character as a prefix and a lowercase alphabetic character as a suffix; and those such as Lamfond for which the only obvious pattern is the short length of the name, and that they are not recognisable as a real name unlike the above two.
The FnameLnameXXX spammer produces a lengthy spam-blogpost style consumer advic-y thing, which like most (if not all) spam postings make little grammatical sense. They do not use wiki markup beyond that required to produce external links. They spam by creating their userpage immediately after joining.
There is not enough data to determine the most common style of spam from such a spambot. Like the above, they use little wiki markup. However, there may be a delay between account creation and spamming.
Spambots with names such as Trygwor and Lamfond represent a significant departure from the other kinds of spammers previously encountered in this survey. They may spam several hours after account creation (more on that later), have a radically different username style, create pages that aren't their userpages and use significanly more markup, although they prefer html tags to the wiki style where they have the choice, for example when making a word bold they prefer to use the <strong> tag, but sometimes use a combination. Interestingly they seem to surround each word individually with the tags, producing passages such as "'''''Since 1995 we have a million <strong>auto</strong> <strong>loan</strong>." They all seem to advertising loans.
This change presents a few problems. Their usernames aren't predictable - you can't tell who is going to spam. For example, it is hard to tell from the names alone which out of Salmforb, Gelyene, Enitaseni and Cregas are spammers and which are known to be geniune users (at this stage, Salmforb has spammed, Enitaseni is real and the other two have no edits and are most likely sleepers. While formally an editor that made an edit almost immediately after account creation was probably a spambot, now the roles have reversed - it is increasingly likely as time goes by that a new user with no edits is a spambot sleeper.
While this has no effect at present on sysops' ability to speedily detect and delete spam and block the perpetrators, this does show that the controllers of the bots are capable of innovation and may yet rise to new heights of subtlety.
Surprisingly, only two BoNs have been caught spamming - 188.8.131.52 and 184.108.40.206. Both have behaved exactly like the FnameLnameXXX in those characteristics that are applicable to IP adresses, which could mean that the automated system that controls them did not wait long enough for the account creation to go through.
By far the most common block length is 3 months, the longest on the drop-down menu. The possibility of shorter blocks means that the approach used to gather this data - taken from the Special:BlockList page, which only lists extant blocks - may not include all blocks given. There has been only the one indefinite block recorded so far. On one occasion a spambot has been re-blocked for longer by another user. It is unknown as to whether any of the spambot types will continue spamming after their initial page creation - is blocking even necessary?
In all occasions the block has included "account creation disabled" and on almost none of them "autoblock disabled." "anonymous users only" and "cannot edit own talk page" are rarer, and the trifecta ("anonymous users only, account creation disabled, cannot edit own talk page") rarer still.
The following people are known to have made blocks of spambots during the period of data collection: