The arms race continues in the Spam wars
posted by Kaimipono D. Wenger
We’re getting a new wave of spam comments like this one:
IP Address: 195.39.170.102
Name: Thomas Miller
Email Address: Alex@gmail.com
Comments:
Two thumbs up!!! thins that excited you at 14: http://www.panasonic.com , [a href="http://www.sun.com"]my parents didnt told me about it[/a] , [a href="http://www.apple.com" rel="itsok"]think that will make relief [/a]
What in the world is going on here? Are the spammers really shilling for Sun, Yahoo, and Panasonic?
Nope. The newest wave of comments is a sophisticated long-term attack by the smart big spammers. They are designed not to advertise for the mainstream sites in question, but rather to compromise the blacklists that are becoming more effective against spam.
Early blacklists were primitive creatures, easy to outwit. They consisted of lists of banned sites. Add poker.com to the blacklist, and the spammer just spams a mirror site or redirect at poker1.com. Add poker1.com to the list, and the spammer moves to poker2.com. And so forth. URLs are cheap; spammers buy up dozens or hundreds of new site names each week.
The most current blacklists, however, combine old-fashioned blacklisting with more sophisticated algorithms and analysis. As a result, they are very good at keeping out the spam. Over at Times and Seasons, we just installed the Akismet plugin (a Wordpress spam blocker) and the results have been dazzling. In the past week, Akismet has caught 836 spam comments, as well as 2 false positives (which spent a few hours in jail before being let out). No spam at all got through.
Smart spammers see the writing on the wall. Widespread use of new blacklists would destroy them. In response, spammers are deploying a secondary attack designed to cripple the defenses. Using their spam-bots, they place hundreds of comments like the one listed above. All of these include links to legitimate sites, but bear all of the other hallmarks of spam.
These comments are a funny sort of trojan horse. They are designed to be easily and readily flagged as spam; however their links are to popular and legitimate sites. Spammers do this so that popular legitimate sites will be added to the blacklists, corrupting them. If the blacklists are full of mainstream sites, and kill comments that use links to apple.com or yahoo.com, then bloggers will stop using the blacklists. And they will once again be easy prey for the spammers.
November 7, 2005 at 2:38 pm
Posted in: Technology
Print This Post
Responses (5)
Paul Gowder - November 8, 2005 at 9:36 am
Question is: will Yahoo, Sun, etc. sue the aforementioned big spammers until their eyes bleed for trademark dilution? Lets hope!
SEO Speedwagon - November 28, 2005 at 4:42 pm
Comment Spam the Wagon? ITSOK with Me
Some very ineffective spammers have recently begun hitting blogs with a new link attribute called itsok. A closer look reveals these spammers aren’t dumb – they’re just thinking long-term.
Schwallex - December 15, 2005 at 8:48 am
Well, Paul, I don’t think so.
They’ve been spamming us with Viagra, Rolex and cheap MS Office and Adobe products for years now. And yet, neither Pfizer, nor Rolex, nor Adobe, not even Microsoft have ever sued a single spammer for copyright infringement.
The same companies that readily sue people who use pirated products don’t care a shit about people that send out zillions of spam mails offering the very same pirated products for sale.
That takes hypocrisy to an entire new level. And it annoys the hell out of me.
Doesn’t Rolex realize that each time I have to delete a piece of Rolex replica spam I’m actually being trained to hate them a little bit more? And after a couple of months, I’m turning into a Pavlovian dog: whenever I see those five letters “Rolex”, I instantly become annoyed, sad, aggressive and wanna kill someone.
How come Rolex, Louis Vuitton, Pfizer, Microsoft &Co. don’t get it that third-party spam does their image just as much harm as first-party unsolicited emails would?
GearHack - December 26, 2005 at 2:41 pm
itsok spam
I don’t buy this theory. Why? Because I have found that the spammers determines when the admins are away from online work and spams during those times. For example, they spam during the wee-hours of the night. They always check to see when their spam g…
WaltDe - August 31, 2006 at 2:20 pm
Keep up the great work on your blog. Best wishes WaltDe
Comments are closed for this entry.