This is the boldest fucking spammer I have ever seen. Browsing spam comments caught by Akismet, this message added to a regular spam comment caught my eye:
to: Admin – If You want to delete your site from our spam list, please visit this site for instructions: removeurl.********.com
The comment itself included a bible quote paired with some pretty obscene statements. A nice try, Mr./Ms. Spammer but I do not think visiting your site would make much sense.
Tags: Akismet, internet, spam
I have noticed a spam scam these last couple of days which is disguised as job announcements. The most annoying part is that Akismet seems to let those comments through. The reason for them being able to fool Akismet may be that the comments are targeting fairly recent posts and their bot seems to be clever enough to include key words that loosely match with words in my posts.
Most of the spam comments are in English but I have also seen a couple in German. The URL of the alleged commenter is yahoo.com which is a certain sign that somebody is building search engine visibility to a site to be launched soon. In other words, a traditional spam scam is being prepared.
A WHOIS query placed one of the comments in Malaysia but that does not need to mean anything because the botnet probably consists of infected computers of innocent people. When do people learn to protect their computers?
A massive spam attack has been in progress for the last 24 hours or so. As usual, Akismet has caught the most entries but has also unfortunately let through quite a lot of them. Comments passing the filter arrive in series of three or four. The contents in each of them are similar: the usual “compliments” for a good site and an invitation to visit theirs. Oddly enough, no links are included.
This suggestion to the WordPress.com team is to be considered as freedback, i.e. free and constructive feedback. I can also be used for the benefit of anybody hosting their WordPress blog in own server. The suggestion is to ban the following IP’s:
188.8.131.52, 184.108.40.206, 220.127.116.11,18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52, 184.108.40.206, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52 and 184.108.40.206.
Please hurry because they keep coming in as I type.
Edit: Also IP 220.127.116.11 belongs to these spammers.
I just discovered a funny bug with WordPress and Akismet. As I was trying to post a comment in response to a reader’s comment, it did not appear in the post. The comment had a hyperlink in it. I checked out and detected that Akismet had caught my own comment as spam. I posted it while logged in.
It is naturally fine that Akismet is in the alert to keep spam out of my blogs. However, it is not likely that I would be spamming my own blog. Of course a blog is by definition spam in the good sense of the word so the owner of a blog should by all means be allowed to spam their own blog as much as they want to.
Akismet is letting quite a lot of obvious spam comments through to moderating queue today which brings a little unnecessary additional work. Unfortunately the WordPress.com support is closed for the weekend. I would not want to question that the great team has deserved their days off work but it would make my weekend better if somebody could black list a number of IPs.
Browsing the harvest of Akismet is sometimes interesting. The amount of comments caught is too large to allow each of them to be judged individually. While I would not want to purge a comment that has been caught accidentally, I must admit that I frequently press the “delete all” button without browsing through all the comments.
Sometimes it is not easy to judge whether a comment or a trackback is legitimate or just sophisticated spam. I had one such trackback today. The blog post linking to me actually exists. It looks like a legitimate quote. The source is properly mentioned and there is a proper link to my post.
Not all of my post has been reproduced. Together with the link and source reference I would not have a problem if I were convinced that the post was written by another blogger of flesh and blood. On the contrary, I would be happy to have been linked to.
But a closer look at the “blog” concerned made me think otherwise. It turns out that every single post in that “blog” consists of one identical sentence:
I found this article very interesting and would like to include it in my blog.
The standard sentence is then followed by a per se legitimate quote, source reference and link to the quoted post. This “blogging concept” makes one wonder if there is any human input at all involved in the process of producing those posts. Or is it rather a spider harvesting tags and producing those quotes and links?
Needless to say, of course, that all of those posts are topped by ads. So somebody is definitely cashing on contents written by real bloggers. Who might that be? And would they care to share some of the revenue with the original authors?
I am sorry if I have mistaken. But at least for the time being, I am not going to release the comment.
Edit: An IP WHOIS query would point at Germany while a WHOIS query of the blog’s domain returns a registrant, administrative, technical and billing contact in Russia: Elitum ltd., Alexander Petrov, Leninsky avenue, 32, ap. 34, Saint-Petersburg.
This srtongly suggests that it is another sophisticated method to disguise spam as legitimate links and a shameless way of exploiting blog contents. I do not suppose sending my bank contact information to Mr. Petrov for a payment would give a desired result.
Tags: kim jong-il, north korea
Akismet caught a comment which was almost legitimate. In July after the first North Korean nuke test I published a post condemning the North Korean government and their dictator Kim Jong-Il. Today Akismet stopped the following comment to that post:
Now that’s a Surprise! Kim Jong Il actually apologized for North Korea for conducting nuclear testing?!! He said he didn’t have plans to test anymore. Something just doesn’t sound right about that one.
I would have released the comment and argued back, had the comment author’s “blog link” not been pointing at a porn site (which I am neither linking to nor naming). Apparently, some spammers have started to harvest blog posts with specific current content and fabricate “related” spam comments.
A nice try but I did not buy it.
Andre wirtes about his recent problems with referer spam. He has had enough of the stuff these last days to make him turn off the feature of latest referers in his side bar. He also wonders what would be the point of having that spam link to domains that do not exist.
I tried to post a comment to his post. The comment did not go through, though. Which is more than understandable because Akismet is a bit sensitive with comments that explicitely discuss the topic of spam. On top of that, my comment had a link in it which would have made it appear that much more suspicious. (Yes, Andre, I did remember not to enter the link in HTML )
In accordance with my earlier practice, I just post that excluded comment here:
I have occasionally massive waves of referer spam in my Manila sites. Each Manila site has a stats/referers page with those links. Pets (who is the admin of the server) has managed to block most of them, I am happy to say.
I have occasionally seen all forms of spam (mail, comments, trackbacks, referers, guestbook etc) to non existing domains. I read somewhere a theory about it but can not locate it at the moment. It would be something with building up Google rankings to future sites. I’ll try to locate the article later on.
I just hope I am going to keep that promise in mind and actually find the article. Hope is the last thing to be lost.
Funny as it may be, it looks like some of the regular spammers have moved from this blog to my Swedish blog. Which means that my Swedish blog is finally receiving some hits, albeit just by spam robots. Almost nobody actually reads it.
This does not make a difference for the visibility of those junk comments. Akismet blocks practically all of them.
As I wrote yesterday, a lot of spam comments, in fact most of them, that Akismet catches are produced by one particular Ukraine placed spammer. A Google search on NetcatHosting, the provider behind IP 18.104.22.168 shows that this IP has a notorious record of spamming.
If I were running the WordPress in my own server (which I may well be doing in the future if my host will change their mind about allowing MySQL) I would have banned the IP 22.214.171.124 in my .htaccess file for a long time ago. As my blog is currently being hosted by WordPress.com I am delivering this as a constructive suggestion, i.e. freedbacking, to the WordPress team: please ban that IP. It will very likely have a healthy effect to the server capacity, baring in mind the huge amount of spam this IP produces.
Another frequent spammer, operating from New Hampton, Iowa, is IP 126.96.36.199.
My Akismet caught 37 spam comments during the last 24 hours. That is perhaps a little less than average these last weeks. Not one of them passed through the filter.
Today’s honorary citation goes to Ukraine. IP 188.8.131.52 posted about 20 of those 37 comments. The same spammer has been detected here for a long time and noted of their frequent contributions.
So now that you know you have been noticed, would you please give up? For your information, it takes me exactly one (1) click to delete all of those spam comments. So why bother?
Also for your information, I do not need a penis enlarger.
Edit: As could be reasonably assumed, I am far from the only blogger that this particular spammer keeps visiting. Michael in Australia has also noticed them.
As anybody connected with blogging would know, the blogosphere is experiencing a heavy wave of spam. Akismet is doing a good job filtering it off the blog posts and considering the extensive amount of spam comments, it is a small wonder that so few of them get through.
One such comment did, however, just slip through to my blog. As I took a look at the filtered comments (currently 227 of them received during the last four days), I noticed several comments with the same IP address 184.108.40.206. A WHOIS query points at an establishment in Shah alam, Selangor, Malaysia calling themselves Universiti Teknologi MARA.
I do not know if this so called technical university actually does conduct some kind of academical studies. In their web site they claim to be a “World Class University”. I wonder if they actually mean a World Class Spammer.
I have had this blog for less than five months. During that time the Akismet spam catcher has stopped 87 spam comments, of which only one or two have turned out to be legitimate entries in a closer scrutany. 57 of those comments were entered during the last 48 hours.
Interestingly, most of these latest spam entries were targeted to this post. It is a controversial post and it is being read almost every day. But it is by far not the most read post in this blog. That title goes without opposition to this post.
I wonder if other WordPress blogs have experienced this exceptionally high spamming activity this weekend or if it was just me. Obviously, there is a spider somewhere (oh yes, I have some of the IP’s left but I do not think I will bother to search the source) that has been busy these couple of days. It would be interesting to know how they choose the posts to attack. Could it be random or maybe they track somehow the posts that are linked much or receive a lot of hits?
I am glad to have Akismet as a part of WordPress. As I wrote here, I have been out of the web most of this weekend. Without Akismet, the blog would have been turned into a spam comment farm. And instead of writing this post, I would be manually deleting all of those 57 comments right now.
- tinyurl.com/bndjtma Talent on koju tulnud 1 week ago
- Käes. RT @kaurkender: sass henno raamat tasuta siin: minaolinsiin.ee 2 weeks ago
- Äkki peibutuspart? uudised.err.ee/index.php?0627… 2 weeks ago
- tinyurl.com/c9h9ptq Kajo ei pelkää kaivaa verta nenästään 2 weeks ago
- Jõuluvana tuleb külla RT @estofennia: Suomen lähetystössä avoimet ovet lauantaina. fb.me/xYFnvjdU 2 weeks ago
- How to avoid huge ships and other amazon reviews
- The Independent should be ashamed of itself/Ich bin ein Berliner
- Weekly Address: Giving Thanks to Our Fallen Heroes this Memorial Day
- Facebook: A Swiss Army Knife is good but a Tool Set is better
- Connecticut Leads the Way on Protecting Children
- First Lady Michelle Obama: "I want to urge you guys to keep on working hard every single day."
- More than Half of Doctors Now Use Electronic Health Records Thanks to Administration Policies
- Weekly Wrap Up: “You Will Not Travel That Path Alone”
- President Obama Delivers the Commencement Address at the U.S. Naval Academy
- This Memorial Day: A Simple Act of Kindness
- Touko Mettinen (Pakinaperjantai 24.5.2013)
- Lautta rantain, helvetti valoillaan
- Kaavoihin kangistuneet (3): liian yksityiskohtainen kaavoitus
- Autoilija antoi jalankulkijalle tietä Itä-Espoossa
- Valokuvatorstain 288. haaste: video (Lissie - Everywhere I go)
- Mikä olisi paras keino nuorisotyöttömyyden torjumisen tehostamiseksi?
- Special delivery Tiinalle
- Kaupunkisuunnittelulautakunnan lista 28.5.2013