Not if the site polices user-generated content.
It's fraud not spam, you never got to watch the fight after paying - https://ici.radio-canada.ca/recit-numerique/2140/adcenter-hy...
And 6 weeks ago it might have been ISIS spam or a link to a exe or phishing.
> and any site that accepts user-generated content is susceptible to it
This site doesn't have user-generated content/events/calendar, it's employee generated.
That's incorrect. There's a call to action to register to submit an event here:
https://www.gp.org/earth_day_to_may_day_events_calendar
That's how the spam got in.
Edit: here, I made one for you: https://www.gp.org/janon/aaron695_hello
Edit2: it's deleted, looks like someone is finally doing cleanup
They did the same with a 'job ad' on the hosts web site -
https://webcache.googleusercontent.com/search?q=cache:2Uw0_n...
Having been on their side it can sometimes be very difficult to mitigate without manual approval. This is not automated - it's done by humans and they adjust their patterns against any automatic mitigation attempts.