Tag: blogspam

Posted on
by

I recently stumbled across an archived mailing list post of mine from the days before spammers started targeting WordPress. Someone had remarked that their spam problem had disappeared when they switched from Movable Type to WordPress, and I responded:

Oh, they hit us WordPress users too, just not as often as MT. Having it automatically moderate comments with certain keywords or more than X number of links helps cut it down, and the ability to (a) see all the latest comments and (b) mass-delete comments reduces the pain of cleanup. But they do target WP blogs from time to time.

I tend to get a pair of comments sent to the moderation queue every few weeks (presumably they figure if the first two didn’t show up, they won’t waste their time with more), but just this morning I had to delete a spam comment that came in last night and didn’t trip the moderation rules. (One of those with the generic “I like your site” messages and the author’s URL being the spamvertized site.)

That was September 2004. How things have changed! All WordPress blogs come with Akismet as an anti-spam measure, but I still prefer to use Bad Behavior, which has blocked ~2900 hits to this site in the past week alone, and Spam Karma, which has collected over 17,000 comment spams.

And with all those counter-measures in place, I get a couple of comments landing in the moderation queue each week. And just this morning I had to delete a spam comment that came in last night and didn’t trip either layer of defense (it was a generic piece targeting keywords found in a post). The filters are just barely keeping pace with the increased volume.

Posted on
by

The blog spammers must be getting desperate. The only other explanation I can think of is courtesy (keeping offensive language out of the posts), and I just can’t ascribe that motive to them.

The latest attack on this site consists of randomly-generated alphanumeric strings. Name? ah87fdfbqpo3q9483fhc. Email? ahsdhufs@q98hf4i4whfcia487f.com. URL? augfagfwi7832hr732rh8732fcfiuh.example.com. (I assume they have a wildcard DNS set up for random subdomains.) Content? Try something like “ads78shafi7 uigiutgw87n srgn743fnufc42.” (I’m typing my own gibberish, just in case the plan is to search for particular strings and see which sites have actually posted.)

The “advantage” of this approach is that there is no content to filter. No references to pills, poker or porn, no common phrases, not even empty generic statements like “I really like you’re site” and “Your an idiot” with links tossed in. It’s just a bunch of meaningless letters and numbers and a link. After all, the link is all the spammer needs, to get that coveted PageRank.

Oh, about that link? Easily identifiable. SURBL-style lists eat them for breakfast, and Spam Karma has been snacking on these all morning. *chomp*

Posted on
by

*Sigh*. After a month of little-to-no comment spam, a pair of spam runs over the last two days led me to make some more changes yesterday. While working on those, I wondered why I hadn’t seen any trackback spam. And, wonder of wonders, the trackback spam started coming in today. Oddly, they were just random strings of letters, but they all pointed to the same random-letter website.

Well, last night’s discovery of WordPress: Combat Comment Spam should help matters. I’m considering adding Spam Karma to our arsenal.

Posted on
by

Yesterday morning, I remarked to Katie that it seemed odd that with the vast number of “zombie” computers infected with remote control programs via viruses, trojans, spyware, etc., their primary use so far has been sending spam. After 7-odd years of distributed computing projects ranging from demonstrating weaknesses in encryption schemes to searching for extra-terrestrial radio signals via SETI@Home, and reports that access to zombie nets is selling on the black market, you’d think someone out there would be trying to crack into the DoD or something. (That last link refers to phishing attacks, but the current form of phishing is very tightly coupled with spam.)

Last night I saw proof that zombies are at least branching out a little: they’re not just being used for email spam, but they’re also being used for comment spam. Starting around 8:30, someone started posting pairs of comments every 20-30 minutes. The content and links were identical each time, except for some random numbers in the (probably bogus) email and at the end of the body… but the IP address was different each time.

I caught it around 10:00, added “poker” to the list of moderation triggers, figured they’d give up when they saw their comments weren’t posting, and after another 3 pair (that’s not a legal hand, is it?) I just closed comments on the two posts.

Update 6pm: After a long afternoon dealing with server recovery issues, I checked my email and found about 40 “Please approve…” notices, starting around 1:45 and running all afternoon. All from the same blog spammer. A bit more aggressive than yesterday’s, because they hit a new post every time, but this batch all went straight into moderation. You’d think after you posted 20 comments and none of them showed up, you’d get the clue that it’s not worth posting 20 more…

Update 9am: I installed a plugin last night to block those comments from even reaching the moderation queue. Then laaate last night I noticed that it was screwing up comments with apostrophes, so I disabled it. The moderation notices started coming in immediately. 60 of them from around midnight to about 6am this morning. And none were ever displayed on the site. (Thank you, WordPress!)