Hi, my name is Abe, and I'm an engineer at Facebook working on the team that prevents these kinds of scams from spreading on the site. As you suspect, we actual

Hi, my name is Abe, and I'm an engineer at Facebook working on the team that prevents these kinds of scams from spreading on the site. As you suspect, we actually do have a bunch of tools that detect attacks like this (and others), but they're not perfect, and you never really see when they work, only when they don't. In cases like this, you're right that there are often obvious content patterns. However, enforcing on or detecting those doesn't really scale, as they're trivial for the attacker to change. Instead, we try to focus on aspects of an attack that are much more expensive for the attacker to change. One component of our systems that detect this does involve looking at metadata about URLs, and running it through some machine learned classifiers (you're correct that simply using bit.ly is insufficient to stop us). Regardless, we've taken care of this particular instance of the attack and are always working to systematically improve our detection and mitigation systems. Let me know if you're interested in helping us out in this effort!