Does HN not just implement blacklists for URL submissions from certain domains / matching a regex pattern? I get that the showdead option is there so people can vouch for stuff but that would/should realistically never happen in this case. Can't more obvious spam just be deleted directly?
Also, how did HN become such a target for this? I would think that the audience here is generally savvy enough to avoid scams, and that having things linked here is not as beneficial for SEO as many other sites with UGC.
The (1) model sucks (AUC-ROC maybe 0.6), the (2) model is better (AUC maybe 0.7) but the (3) model got an AUC pushing 0.98 which seemed unreasonably high.
My mental model of "[dead]" was that it happens to articles that get popular but are about politics or some other bad subject. What I found though is that HN gets bursts of spam like the one you're experiencing and with the system I had (i) the same headline would show up [dead] a large number of times and (ii) the same headline would show up in the train, eval and test data sets so of course the system got an unreasonably high score for [dead]. That's how I learned that HN gets these spam waves.
But as to why HN is a target, you don't need a high percentage of hits to make it worth spamming. Scams are lucrative. If one in a million viewers actually follows the links and falls for the scam, that will more than cover costs of spamming links. So they will attack any site where it looks like there is any chance of getting through.
2) I think the dynamic auto-kill seems to be working the way that it is intended to.
3) The current rather prolific idiot may be trying to probe for weaknesses, but is burning rather a lot of sockpuppet accounts and not being smart about the probes... See (1).