JCooney.NET

Joseph Cooney's Weblog

NAVIGATION - SEARCH

"Good Work, Nice Web Paqe" (sic) - is this spammers trying stuff out?

Occasionally I get weird comments on my weblog like this one which says “z03a26c291bbe9a3144dc3ca36012f866z Good work, nice webpaqe“. It doesn't link to any URLs, well - no real ones, so I don't think its the usual page-rank spam junk which I get bombarded with. Is this a spammer “trying some stuff out” when my spam blocker knocks them back? Thanks to the incorrect spelling of “page” this one is highly googleable, returning about 38K hits on a variety of sites. Another variation seems to be ones like these here which say things like “zb1d232a62f41a9bfbb50aeaad8ece73cz Nice design, good work !“. Anybody have any thoughts about this?

Comments (6) -

Maybe someone is using it to send a very short encoded message.  The preceding text is always the same length and starts and ends with a z, eg. z861c150a0cd496c8355284d0904c611fz, za92bc1c4dd1b127b113e52826b6f644cz, z960e07760d59938b953f5385b994dd72z.  Or maybe several need to be combined to form part of a larger message.  Okay maybe I'm getting a little carried away Smile ...  It most likely is some wally testing out his spam tool.

I love the idea that those strings form part of some kind of encoded message. Luckily my tin-foil hat prevents them from reading my thoughts through the screen. I'll let you all know if I discover any secret messages...

Is it another language? e.g. if I write ??? here, what shows up?

Hmm... guess it's probably not another language!

So 'z',32 characters,'z' ...  I suppose that's a pretty solid way to put a filter into place.



I had gotten a number of these with the "Nice design, good work !", but am now getting just the "Nice design, good work !", without the 34 characters of rubbish ...



I have a different idea, consider this scenario:



1) Spammer posts a 'marker' on your blog, with no links and a 'nice' comment.

2) Spammer subsequently comes back to your blog and checks if that post (with the unique marker), made on date X is still visible (ala: hasn't been moderated as spam).

3) If the post has been moderated, move onto the next blog. If it hasn't been moderated, he knows you've got lose security on your blog and its about to be open season.



If I were a spammer, I would be working out more efficient methods to get a higher submission to existence ratio. A spammer only has x many hours per day to deliver as many 'effective' spams as he can. If he stupidly chooses to drop a single spam comment, into every post on every blog - without knowing that they will exist in a months time - he is burning up the hours in the day for wasted spam. On the flip side, if he drops a single comment into a single post and subsequently comes back to check for its existence - he suddenly knows that every subsequent spam to that site is likely to exist in the future.



To be an effective spammer, its all about getting the spam to exist into the future. If you post it and it just gets deleted, then your spam was useless.



I'd call it 'smart spamming' and if the spammers aren't doing this already, they are wasting their own time, their clients and ours.



Al.

Comments are closed