Spam chongqing

Honeypot Wiki Down

2008-12-16T10:30:00.006-06:00

My host disabled my account due to performance issues with my MySQL queries. I presumed it had to be the wiki so I took it partially down. It was actually probably my backup job that was causing the problem though, I set it up when the wiki was small. My honeypot wiki's database is now 2.16 GB of data. I hadn't cleaned the wiki in a very long time (almost two years it seems). All that spam can take up a lot of space, but I don't see how it could be that huge.

I haven't taken the time to analyze or do anything with the data. If anyone wants it, let me know. It should be pretty much clean from actual data, the wiki never had much real content. I have 363 users (nearly all spammers) and it looks like 73,863 revisions. It has been collecting spam from January 2006 to December 2008 and should be useful for something. I hate to have it down so I will probably start over with a new database, I am sure the spammers won't mind starting over.

The Many Anna Kravcovas

2008-02-14T19:47:00.005-06:00

Its been a long time since I posted here. I still do some antispam stuff, but not nearly like I used to. I still report spammers when I see them of course, but as you can guess from this post, my current hobby is photography. Much more fun than endlessly fighting spammers.

I am sure it will be gone soon since Flickr is pretty responsive to spam reports, but I ran across a spammer hitting photo pages. "She" left two identical comments today on a friend's photo from two different Flickr accounts. If not for that stupid mistake, I might not have noticed. The comment does not link to her webpage, you must retype the URL so it can sneak past spam filters.

Anna.Kravcova.447.
Anna.Kravcova.549.

Those two accounts will probably be removed soon since I reported the spam, but you can see a seemingly already removed but cached copy of the same spam on the mobile version of Flickr from 4 weeks ago from Ann.Kravcova.1988. Or on a republished Flickr page by Ann.Kravcova.2008 here. The spam is gone from the actual Flickr page there too.

Her comments:

Good photo! ;) I want meet you! See my photos here gumble.110mb.com

Of course, a Google search shows a few more.

Searching for gumble.110mb.com lead me to this photo where, Anna 475 and 476 posted three comments at the same time. Here is another where AnnaKravcova posted. Google currently shows 39 other hits on Flickr, but Google's estimate for the search is 1,500 results. I wonder if that many have been removed already, Google's estimate usually isn't that far off.

And another Google of Ann.Kravcova shows a bunch more. In January, Ann 1986 (who is no longer on Flickr) posted:

Cool photo! I want to meet you :) See my photos here: annkravc.h17.ru

Both sites were Anna says she has her photos just show her one photo and a link to a dating service to "meet beautiful Russian Ladies interested in getting in touch with overseas Men."

Update Feb 15: Thanks to Travis, I found a whole lot more Annas. He found 101 a few hours ago, now there are 88. So Flickr is getting a few of them.

And here is Anna's Facebook page.

First CAN-SPAM Conviction

2007-01-18T23:53:00.000-06:00

The Mercury News has an article on a spammer facing up to 101 years. He was found guilty of phishing spam (thanks to the CAN-SPAM act), wire fraud, and a bunch of other stuff. Sounds like he got off easy.

Honeypot Cleaning

2007-01-16T02:59:00.003-06:00

Its been a long time since I cleaned out my spam trap wiki. The main page is not even usable anymore. It and one other page have reached two megabytes. Even if everyone was on high speed internet, that is not good for a start page.

The last time I cleaned the wiki was August 5. For a small infrequently used wiki that amount of time is not really that unusual. Back in August I had to clean 27 pages. This time it looks like I cleaned 36 pages. You really must use some kind of spam protection if you want a usable wiki. Spammers created some really stupid pages, my favorite is:
Guestbook Spam Collection/mw/mw/wiki/Talk:Guestbook Spam Collection/wiki/Talk:Guestbook Spam Collection/mw/mw/wiki/Talk:Guestbook Spam Collection/mw/index.php

Spam on my Google Spam page started off slow, only five spams for nearly four months, then near the end of November someone from 81.177.14.26 started hammering my wiki. Up until November 22, that IP address had hit me six times; after that it hit various pages 336 times until January 15.

(hist) Google Spam (2,098,046 bytes)
(hist) Main Page (2,097,958 bytes)
(hist) Guestbook Spammers/mw/index.php (1,227,992 bytes)
(hist) Guestbook Spam Collection (78,014 bytes)
(hist) My spam blacklist (38,568 bytes)
(hist) Spam (32,691 bytes)
(hist) First Spam (28,572 bytes)
(hist) Spam Caught Here (27,533 bytes)
(hist) Test (27,023 bytes)
(hist) Interesting Searches (24,794 bytes)

Main Page (7,851 views)
CSS Hidden Spam (3,010 views)
Wiki Spam Collection (2,598 views)
Test (2,449 views)
Guestbook Spam Collection (2,419 views)
Google Spam (1,870 views)
My spam blacklist (1,273 views)
Suggestions (1,173 views)
Spam Caught Here (753 views)
First Spam (742 views)

5 Things You Didn't Know About JoeChongq

2006-12-19T18:21:00.000-06:00

Spamhuntress tagged me in the ongoing blog tag meme. Not being a big fan of meme's I am upping the ante (perhapses in an attempt to kill it off). Rather than just a simple five unknown facts about you, I say they must all rhyme. Here are mine:

1. I have a frog.
2. I do not have a dog.
3. I do not drink eggnog.
4. This site was my first blog.
5. I live in a city without smog.

For assistance, see rhymer.com. You will need it Manni, John, and Dirk. You have been tagged. Oh, and anyone else reading this, your tagged too. >;-p

Email Harvesters

2006-10-21T14:10:00.000-05:00

Tasty Research has a post about some interesting data from Project Honey Pot. He describes two different types of email harvesters, hucksters and fraudsters, and how they differ in their spamming styles.

\81 Spim

2006-10-11T04:06:00.000-05:00

I don't get on instant message services very often, but I have had accounts on the big ones for years. Because I am not online all the time I am able to avoid most Spim. But today when I logged in with Miranda, I got a spam IM on my Yahoo account. If you look at the source of the message, the URL is written as:

h\81t\81t\81p://chat-detectives.c\81o\81\m

While that isn't a clickable link, it likely would get through some spim filters. And if displayed as intended, it would be easy to retype. Luckily copying it doesn't result in a good URL in either IE or Firefox. I was able to see the extra characters (as boxes) but I assume they disappear if you use the official client.

Here is today's spim by chatdetectives.com_ab43 as I assume is meant to appear:

THIS IS A GREAT SITE! http://chat-detectives.com

And just about 30 days ago I got this from chat_detectives_agent_yrm:

Ever wondered what your significant other does online when you aren't around? Would they flirt with other people or even cheat if given the right opportunity? Mine did... Wanna find out just how faithful they would be in the face of temptation? http://chat-detectives.com

It does appear hidden in Firefox, but not in IE.

This certainly isn't news to those following spim, but to me these two instant message spams make up a large percentage of the spim I have ever received. I wonder what other forms of spam \81 could be used in.

Forum Spam with Images

2006-10-09T14:25:00.000-05:00

I was just visiting The Extensions Mirror and found two interesting posts on their forum. I assume both will be gone pretty soon, but for now they are:

In case they are cleaned by the time you read this you can also see the movie post here. The car post can be seen here as well. All these were posted in the last few days by "carpost."

The movie spam use lots of movie review text which is usually meant to add to the page's relevancy in linking to the spammer's site with topical text. The movie one "borrows" images and bandwidth from several places which aren't connected to the spammer such as AllPosters.com. With the poor quality of the post and over abundance of topical text stolen from blogcritics.org and rollingstone.com's reviews of one of the movies the images correspond to, I must conclude that he is mainly attempting to trick search engines.

The second post gets its car image from the site linked in the forum spam and does not borrow its text (a long list of keywords) from elsewhere. Since I saw this one first, it made me wonder if the spammer was using the image as a traffic gauge. Incoming referrers can already tell him how many people came from the sites he spammed (hopefully none), but image views would also tell him how many people actually looked at his posts. With this he could determine which spams were more successful on humans and fine tune his future spams. But since the other does not really fit that use and the quality of the posts is not likely to draw humans, that conclusion doesn't make a lot of sense.

So why the images then? I can think of several other possible reasons:

Images with file names relevant to the post could add to the relevance of the links to his page. That is ruled out since the file names are totally random.

Images in the post may disguise it from moderators looking to delete spam. That could be a motivation, but wouldn't be very successful since the rest of the post is so spammy.

He is after human hits and by sprucing up his posts he hopes to get more visitors. A possibility, but not likely since other than images the posts are clearly targeted at spiders.

He doesn't really know what he is doing and is attempting to target both search engines and humans with the same spam. Likely.

Visiting the car site, car-post.net, you will see it consists a forum and a blog. The forum is full of what looks like forum spam posted by carpost, morgan richh (familiar names), meedia4, and denzel89. But since it is his own site and he put it there I guess we can't call it spam. The blog however has little content, but what it does have is "repurposed" from autoblog.com that was formerly copyrighted by Weblogs, Inc. and is now somehow under the Creative Commons Attribution license.

The movie site, snaph4.com, is totally different. It is an intro page to Fast Movie Downloads and links to fastmoviedownloads.com which has the same exact content. For further connection between sites (and in case the "mirrors" above disappear), you can see the movie site spam in the car site's forum.

The whois info does not seem to indicate any connection between sites. I did find it unusual that the IP address snaph4.com is hosted on has 3,856 other sites on it though.

A bit of Googling for the less familiar names I found above lead me to a more examples of their posting habits that go back to at least late August using one or both of those names. Here are a small number of them:

Keira Knightley forum

HPC.net Forums

The DJ Cafe

bettyslist.com

Computer slow? Scan and clean your pc online.. 100% FREE

Digging through those, I ran across some apartment pages hosted on the car site which at the bottom say "website designed by ®snap4.com". Not that we really needed more proof of connection between them. Most if not all of the posts contained images and often the posts mixed topics, movies, cars, and housing.

Spammers Don't Like Anti-Spammers

2006-09-12T17:22:00.000-05:00

Spammers don't like us. Shocking? We are hurting these poor business men pushing illegal pills, penis enlargers, porn, etc. We are depriving them of being able to feed their families (and buy fancy cars) because they can't find any real jobs. I guess if you put it that way, we should all quit and let them continue their attempt to ruin the internet.

Anyway, to read a bunch of Russian spammers crying about how they are doing nothing wrong and we should leave them alone, check out the comments on Spamhuntress' KLIK Media GmbH registrar post. Currently 64 comments in four days and growing fast.

Update: Spamhuntress has posted some commentary on the reason some spammers don't see what they are doing as wrong. She says it is cultural differences. They don't see screwing Americans and other westerners as wrong because we are all so rich. I agree that is a reason behind a lot of spam, but certainly not all. There are plenty of slimy western spammers out to get rich at the expense of others as well, they are just jerks.

What's That User-Agent

2006-09-08T00:47:00.000-05:00

I found an odd User Agent in my site stats and attempted to look it up. It was EchO! and it was eating up a lot of bandwidth for a bot. It doesn't seem to be a very common bot so Google wasn't a lot of help, but a few results down I found a List of User-Agents. They didn't really have much info on EchO! so I kept looking and found User Agent Database, The Web Robots Database and finally Bots vs Browsers. None of which even listed it, but do look like useful repositories.

I found it odd that I could not find the User-Agent in my log file, but assumed I must be doing something wrong. The only "echo" I found in my logs was BonEcho, the development code name for Firefox 2.0, which are mostly my own hits. A bit more investigation lead me to realize the bot AWStats was reporting as EchO! was me. No wonder it was taking up so much bandwidth and not accessing robots.txt. My server is using an older version of AWStats which was released before Mozilla started using the BonEcho name, I presume that is not a problem in newer releases.

Phishing Victim and Response

2006-09-01T20:15:00.000-05:00

The wife of the owner of DreamHost.com fell for an email phishing scam recently. It wasn't a particular clevar scam and she knew to be careful but getting money back from the IRS was too much of a draw. This just goes to show you how vulnerable people are to phishing. You don't have to be stupid to fall for them. The really interesting part of the article though is what he did after finding this out.

Secure Browzar

2006-09-01T20:00:00.000-05:00

There is a long post about how this browser may not be all that it seems. It was touted as having no install and that it did not save information from visited websites. According to that post, digg comments, another post and another, it is a simple IE wrapper and appears to do little to improve privacy against a knowledgable user. It became really popular all the sudden this week and if this is true a lot of people could be installing it and getting a false sense of security. It may be effective against casual snooping, but it isn't going to protect your browsing habits from the FBI or your hacker friend.

Clearly people really want privacy and security, but Firefox already offers built in options to do that. Plus for even more privacy you can get Portable Firefox and/or the Stealther extension.

I have not tried Browzar to confirm this for myself, but if you do you should know what you are getting or not getting. As one of the above posts said, this could be just a mistake or a few bugs and future versions will work as advertised, but for now it doesn't appear to be as good as it sounds.

Update: BBC News did a story pointing out that many believe Browzar to be adware and that it doesn't work. In it, the developers respond that it is not adware and that they want to fix anywhere the browser is leaving behind traces.

Tripod Phishing

2006-08-28T19:27:00.000-05:00

F-Secure has a post pointing out that Tripod isn't doing a good job preventing obvious phishing sites from being hosted on their free service. Now if this were a small free hosting service it would not be a big surprise, but Tripod has been around for many years. I used to even have a site there long enough ago I hardly remember it.

Still a small number phishing sites isn't that unbelievable (of course there could be plenty others Google didn't index). Clearly if they were doing nothing they would be full of these scam pages. But from Google's cache, the dates on the current three I saw are the 17th, 22nd, and 24th. That is up to eight business (12 total) days to catch the earliest of them and all three are still up. See them in Google while you can.

I checked out some of the competition (MSN, Yahoo, Geocities, GooglePages, and Blogspot) using similar searches.

Of those searches, I found only one other page. The lucky host was Blogspot, though this wasn't nearly as bad as the others. It was only a splog not a phishing site and they have already removed the account.

F-Secure has a poll asking, "Should free hosting companies try to detect Phishing sites hosted on their servers?" The answer is clear to me. If the free hosts don't do it they will quickly be known for not caring and be over run with scam sites. Hosting that much garbage certainly won't make their business look very professional. Out of the first about 1000 responses, currently almost 90% agree with me that it is the free hosts responsibility to at least try.

Wikipedia Fix

2006-08-23T16:53:00.000-05:00

Ars Technica has an article about an experimental feature the German Wikipedia is trying out to reduce "vandalism, edit wars, and misinformation." Edits won't go live until approved by a logged in user with "a certain level of time and experience."

That is a very good solution to those problems and will give articles some stability and hopefully credibility. But it will severely limit editors if they must wait for their changes to appear. It will also put a burden on those who must approve the edits when there are multiple conflicting versions of the page to merge.

Spam Cartoons

2006-08-23T14:07:00.000-05:00

The stupid and often random subjects used by email spammers are often funny, but Spamusement makes them even funnier with "poorly-drawn cartoons" illustrating them. Some of my favorites:

Spyware Fight

2006-08-23T05:06:00.000-05:00

In a pretty innovative attempt to prevent users from ending up with spyware infestations, Google started popup warnings when you attempt to visit a site known to distribute malware. This is built right into their search results rather than relying on a toolbar or extension.

That might be old (early August) news for those who keep up on search engine news, but what surprises me is I have not yet seen it in action and I do visit slimy sites quite frequently in my tracking down spam. I wonder if they decided to take it offline to rethink it.

A visit to StopBadware.org which maintains the malware database shows an example of one of the sites in their list, ThemeXP.org. Yet in Google's search results there is no popup, just google ThemeXP. Does that mean the warning popup is offline?

I have also yet to see Firefox 2.0 beta warn me of a Web Forgery with its new anti-phishing technology. I have even followed clearly deceptive links in bank phishing emails and not seen the warning. It is based on Google's Safe Browsing extension if you want to try it out before Firefox 2.0 is released.

What I have been using that is working pretty well is McAfee SiteAdvisor. It is available for both Firefox and IE for free. It advises you of the status of the site you are visiting by color coding its button. It also puts indicator icons on search results (Google, Yahoo and MSN) so you know before you even click (even on ads). When you hover the icons it gives you a brief summary of why the site got its rating. This service not only warns you about malware, it warns you when a site is likely to spam you if you sign up, I really like that.

Of course, there are privacy issues to think about when you add this protection to your browser. For the best protection, every URL you visit gets transmitted to the database provider. With Safe Browsing and Firefox 2.0's anti-phishing there are local checking options which provide some protection, but I would rather the best protection I can get.

Update: In early August, a Mozilla representative pointed out that 2.0's phishing filter isn't working yet. So I guess I shouldn't have uninstalled Safe Browsing yet. This post says you now get Safe Browsing as part of Google Toolbar. He also suggests you try OpenDNS, which reportedly corrects obviously mistyped URLs and warns about possible phishing sites.

Update 2: I found an example of Google's warning popup still working from another blog. Maybe StopBadware.org removed TweakXP from the list and just haven't updated the site with a better example.

Finding A New Host

2006-08-20T18:55:00.000-05:00

Less than a month ago the entire server my site was hosted on was hacked. Supposedly that vulnerability was fixed. Well someone must have it out for that particular server because it was hit again last night.

So far I haven't found another host, but this is just getting insane so I am seriously looking now. Even if I don't find the best, it will still be a huge improvement. I have not heard from support yet, but the backup I have access to is again full of the hacked files. Thankfully this time I backed up everything earlier this month after learning the hard way last time.

On reason I haven't moved yet is I have done some looking around and there just isn't much reliable information out there. Most of what I find is self promotional, splogs, questionable review sites, or other people looking for a host. There are a number of good looking host review sites, but much of the info looks like taken from the host's page or submitted by them. I would much rather find a blogger who has tried several hosts and strongly recommends it. But thanks to splogs and reblogs those are impossible to find.

GoDaddy was high on my list mostly because I couldn't find anything that offered what I want. It sounds great and has really low prices, but is apparently is insanely oversold and has little support.

I finally decided on BlueHost.com partly because of the CEO's blog in which he admits they have had bad service lately and what they are doing to fix it. The price is reasonable though it isn't nearly as cheep as the $20 a year I paid before, but you do get what you pay for and I will have a lot more features to play with. The company has been around since 1996 so in terms of internet years that is like forever. Overall customers seem to be relatively happy, unlike with my previous host after they were sold. Hopefully I made a good choice. I will let you know how it turns out.

Hacked Server

2006-08-05T03:03:00.000-05:00

Parts of my playground site, chongqed.info (not the more important chongqed.org), have been down since July 26 or 27. I am finally mostly through recovering and reinstalling things (I think). I was away from home when I got the email that the entire server had been compromised. According to my host it was due to a bug in Fantastico Application Installer which allowed a hacker to replace all the index pages on everyone's accounts with some anti-war propaganda.

The root page of my site that listed antispam RSS feeds headlines is gone thanks to my host having just backed up the hacked files before realizing anything was wrong and me not being able to find my offline copy. Maybe I will see if I can set it up again some day, but for now I am happy I finally got everything else mostly back to normal. If you want a great host, be sure not to choose mine. It is dirt cheep at $25 a year, but you get what you pay for.

All the wiki spam I have been collecting on the honeypot wiki is fine. Since the site has been down for about a week and a half I decided it was a good time to clean up the spam and start fresh. I reverted or blanked a total of 27 different pages. At least 10 of those were talk pages spammers created. Here are the pages with the top numbers of revisions (very few of those are reverts):

I would like to do some more detailed analysis of the spamming patterns (knowing me I won't get around to it), but from those numbers at least one thing is clear. Spammers like the main page a lot. That makes the suggestion to lock your main page sound like a really good one. Most of the time your main page is going to be pretty static anyway.

Forum Spam Lists

2006-07-21T18:35:00.000-05:00

I hate signing up to forums. There are a number of sites I visit regularly and read their forums, but never sign up even if I have something useful to say. I hate giving out my email address, even throw away addresses because then I still have to remember what I used and the password.

I am also always a bit worried about the site selling members' email addresses or accidently letting them leak. Well it looks like the latter has recently been happening with Invision Power Boards though it is certainly only the latest to be compromised.

I first heard about this at one of those forums I read but don't sign up for, someone noticed they were getting spam at a site specific address used only at that forum. He isn't the only one.

At Neowin, a hacker setup the site to download some Windows exploits when visited with IE. It was that malfomed .WMF file exploit from a while back which would only hit unpatched Windows system, but surely there are still plenty of those.

It seems Invision already has a fix for this, but of course no one keeps up on security patches. They also have a new version that includes this fix and now has a virus scanner built in.

Disney Spam

2006-07-10T16:31:00.000-05:00

Today I found someone upset that Disney.com referrer spammed him. If true, that would be very shocking and upsetting. But it is very unlikely that Disney or anyone associated with them did the spamming. Most likely, it was a spammer testing out his new software. I have seen such spams for sites such as Google, CNN, Disney, and Wikipedia. Often a few days after these test spams you may get the actual spam following a similar pattern.

The purpose of web spam is to get more visitors, more ad impressions, and/or to improve the site's ranking in search engines. Disney as well as the other large sites I mentioned already have very high PageRank and tons of traffic so a few more links would mean little to them.

Of course, this is still spam and you should take the necessary measures to block it. But you can't blame these big corporations for what some mentally challenged spammer is doing to test his software or your defenses.

Spammers also sometimes spam for antispam sites such as chongqed.org, spamhuntress.com, or even a journalist who writes about spam. But these are for revenge and hurting our image rather than testing. This really doesn't make sense though. Few people that check the sites are going to mistake us for spammers. And the links only add to our PageRank.

Spamhuntress DDoS

2006-07-03T19:35:00.000-05:00

Just a quick note for those that might be worried that Ann's SpamHuntress site is down. She didn't quit, and she wasn't shutdown. She is being hit by a Denial of Service by some stupid spammer and should be back soon even more determined to hunt down such idiots.

Update: The site is back online now.

Illegal Linking

2006-06-16T17:35:00.000-05:00

I just heard about this article in The Seattle Times on Slashdot. It is very scary. Washington state is going after sites that link to, contain discussion promoting, and/or advertisements for online gambling.

Going after places that promote online gambling, which is illegal in the United States doesn't sound like a bad idea, you aren't allowed to promote other illegal activities. But the quotes in the article imply that just linking to gambling sites may be illegal. The director of the state's gambling commission suggested that The Seattle Times stop publishing a poker how-to column which lists the URL of the column's author which is an online casino run offshore.

Just linking to something that is illegal is certainly pushing it too far and can't possibly be actually illegal. If just linking to a gambling site is illegal Microsoft would be in trouble since they are in Washington, they run MSN Search which not only links to online gambling sites in the results, but it displays advertisements for online casinos. That certainly looks like promoting to me.

It seems Microsoft might already be aware of this and attempting to work around it since they don't display any ads when you search for "online gambling" though some of the top results of that search are are online casinos. But assuming they are trying, they missed "internet gambling" which displays ads for lots of gambling sites:

In related news, not long ago Washington passed a law to make online gambling "a Class C felony, equivalent under the law to possessing child pornography, threatening the governor or torturing an animal." Of course there is an exception for wagering on horse racing online through certain companies. How is one form of gambling online ok, but not others?

Of course, this isn't the first time linking to something illegal has come up. Chilling Effects has a FAQ about linking.

Google Bug

2006-05-26T02:27:00.000-05:00

Does this look strange to anyone? Clicking the link doesn't get you anywhere. Since when do URLs start with a %20? That is a space. It was the only site in the results with this error.

Radiant Extra Condensed font - preview & download
Radiant Extra Condensed font. SearchFreeFonts.com has the best selection of downloadable, design quality, True Type and PostScript fonts for Mac and ...
%20www.searchfreefonts.com/font/radiant-extra-condensed.htm - 7k -

Web Spam Detector

2006-05-24T17:33:00.000-05:00

I just read about a Search engine spam detector on Search Engine Watch. The idea behind the site is "To persuade webmasters and SEO to think." If an independent italian software developer can on his own create a simple tool capable of detecting these techniques, just think what search engines can do or are already doing.

I didn't see an overall rating of the website it scanned, I guess you have to study the individual results. My blog isn't very spammy according to this test, a while back I removed some of the more spammy looking parts. It didn't like the antispam CSS rules I posted here. It called them unnatural text. It also detected unnatural text in a spam email I posted recently.

Kind of makes me wish I had time to do something like this myself. But I already have too many unfinished spam research projects going.

Nigerian Scammer Article

2006-05-24T13:02:00.000-05:00

CNN has a story on internet scammers in Lagos, Nigeria. The main subject of the article is a 14 year old boy who gets paid for scamming people. His boss takes 60% of the revenue, uses another 20% to pay off law enforcement and teachers, and still leaves plenty for the teenage boy to be the main support for "his family and legions of relatives."

He and many others like him, do their work out of internet cafes. The cafe mentioned in the article has a sign on the door that starts, "WE DO NOT TOLERATE SCAMS IN THIS PLACE." The article calls that sign is a joke, obtaining things by trickery is a national pastime.

Bad Behavior 2 Alphas

2006-05-03T18:37:00.000-05:00

Michael has released Alpha 4 of BadBehavior 2. I have not tested it, but from his post it sounds like a major improvement. He is again ahead of the spammers. And he now supports MediaWiki without the hack that used to be required. He is expecially interested in testing by MediaWiki users since actual support for it was just added. I would give it a shot, but the only MediaWiki I run is my honeypot. I may still give it a try anyway for a few days just to see, but I wouldn't want to run a clean wiki. Spam attracts Spam, and in the case of a honeypot, that is exactly what I want.

Even though I don't use it, I am a big supporter of BadBehavior. It clearly can't always stop all spam, but other than disabling all user submitted content on your site, nothing will. As long as he is able to keep just a tiny bit ahead of spammers, it will make their job harder, and make ours easier.

ScamFly AntiScam Forum

2006-05-03T03:15:00.000-05:00

Yesterday I got a comment on my FBI email scam post. As you know when I get really good comments, I must share them as new posts:

There are so many west coast wellness scam online these days. I see it even where i live in Florida. I did come across a forum though that i can post about west coast wellness scam and its free. Here is the url http://www.scamfly.com/forum/

Posted by ChignikLake_561769 at 5/02/2006 10:17:53 AM

What an interesting idea. Lets look into it further. This blogger who left the comment had only 4 profile views when I checked shortly after the comment arrived. The domain was registered on May 1st for only one year with RegisterFly and their whois info protection service. They are building up content fast. There were 13 non default forums with a total of 56 posts when I visited. All the posts were by the forum's single registered user, admin.

An example of one of the posts in the site's forum:

Bedford to fight senior citizen fraud - Lynchburg News and Advance

Bedford to fight senior citizen fraudLynchburg News and Advance, VA - Apr 29, 2006... â€œSenior citizens are targeted,â€ Wheeler said. â€œThey tend to be a lot more vulnerable to the door-to-door and the telemarketing scams.â€. ...

Check out the link on that top line, it looks like a link direct from Google News's RSS feed. The funny characters in the post, are common on badly parsed/formed RSS feeds, as is as its truncated length.

The main site says they provide free blog hosting where you can "Tell your story" on your "I've been scammed" blog. What a nice guy, there just aren't enough free blog providers out there. Currently the only active blog listed is titled "affiliates" and has a couple posts on "VITAL HEALTH CARE PRODUCTS." There is one more blog named "pits," but so far it only has the default welcome post and Google Ads. Oddly, both blogs use the same Google Ad Client ID.

From the Features page, I discovered why the IDs match:

We offer this free blog service for a number of reasons. You will notice that on our free hosting platform we have a small Google adsense ad unit on the blog. This is a small way to help us cover bandwidth costs.

The logo in the upper left corner of the main site gives away some more info. It says ClubBlogs.com, but does not link to it. There are a couple other mentions of that domain, but no links. Going there yesterday gave this message along with some spamdexing looking content:

We are certain you will be delighted with the fruits of our online test which has sourced good file about to mail you to. An essential strategic assistance that cyberspace organizations obtain over non-net based organizations is that they can constitute changes when changes are demanded.

Detailed test all over the net resulted in this location about and capture the best sites from all those available for you to visit. Our web location is yet expanding so we have not much managed to comprehend volumes of support, however what we have done so far is researched the too best sites on the net. Our web location is yet expanding so we have not much managed to provide lots of file, however what we have done so far is researched the too best

Today the site looks totally different and that text is gone, it is an actual WordPress blog now.

Another site mentioned on ScamFly, but not linked was blogsilla.com. Today it contained this text with a somewhat similar layout to yesterday's clubblogs site:

We are certain you will be delighted with the fruits of our online test which has sourced good file about wikipedia to mail you to. An essential strategic assistance that cyberspace wikipedia organizations obtain over non-net based wikipedia organizations is that they can constitute changes when changes are demanded.

Our wikipedia website is too advanced so we have not much managed to assistance lots of content, however what we have done so far is researched the too best wikipedia sites on the net.

Locating essential and good wikipedia requires a considerably extent of skill. So we came up with this website. As online commerce continues to grow wikipedia.

Don't forget to check out blogsilla's sitemap. They have pages on lots of varied topics including: wikipedia, mesothelioma, health care, Titleist, and Diablo 2. But each page is basically the same with no actual topical content. It just inserts the page's keyword into the above text (where it says wikipedia).

Through domaintools.com, I discovered a related site with a design similar to today's clubblog design, 106th-park.com. The whois info even says "Visit: http://clubblogs.com." Wow, I didn't know you could advertise your other sites in your whois info.

So getting back to scamfly.com, is it just a case of spamdexing or a legitimate site designed to help scam victims? I will leave the conclusion to the reader.

SpamOrHam.org

2006-05-02T21:29:00.000-05:00

John Graham-Cumming, the inventor of POPFile, has a new project called SpamOrHam. He is attempting to improve spam filter testing by verifying (or correcting) the accuracy of one of the few large sources of real world test emails, the TREC 2005 Public Spam Corpus. The more accuratly classified the test data is, the more accuratly spam filters can be tested, which hopefully will lead to better filters. To do this, he needs volunteers to visit the site and classify a few messages. If enough people participate, the corpus could be done in no time.

The Public Spam Corpus is a body of email collected from a large corporation during the process of a legal trial. Normally it is hard to get such a real world collection of email due to privacy issues, etc. But thanks to the legal system, this is a collection of mail from 150 recipients in the company containing business and personal emails as well as spam. After a few messages you will understand more about the source and the types of business they deal with. This was a major company that was covered heavily in the news recently. It is a bit voyeruistic reading some of these emails (though I have seen no juicy details). I found it rather addictive.

Apparently this project is such a good idea that within just two days of its launch, it has already seen hacking attempts which due to John's planning ahead were already being prevented, partly through a CAPTCHA and logging.

Update: Looks like John has made some improvements. Now you get feedback after each classification based on what the automated classification of the email was. It also keeps a running total of your classifications, possible errors and those where you and the filter agreed. I am trying to recover a hard drive in Knoppix right now and had some free time while it copies, so I just did 200 emails. I disagreed with the filter or was unsure 13 times. Considering many of those I couldn't decide, looks like the corpus is pretty well filtered.

Unhiding CSS Hidden Spam

2006-04-20T15:56:00.000-05:00

Those of you that visit my HoneyPot wiki with a Mozilla ~~or Konqueror~~ based browser may notice a change in the display of the spam it collects. CSSHiddenSpam is not hidden anymore. An example can be seen here. Of course, I already have shown how to block CSS Hidden Spam but for those who for some reason don't want to prevent it in the first place (like me), we can at least make it visible for easy removal (or study).

To do it, add the following to the end of your MediaWiki default skin (probably Monobook) at least. For each skin you want to add this to, look in your MediaWiki directory under skins and edit the main.css in the skin's directory.

/* Show CSSHiddenSpam so it can be easily removed - by JoeChongq */
.ns-0 * #bodyContent *[style*="none"], .ns-0 * #bodyContent *[style*="auto"], .ns-0 * #bodyContent *[style*="hidden"],
.ns-1 * #bodyContent *[style*="none"], .ns-1 * #bodyContent *[style*="auto"], .ns-1 * #bodyContent *[style*="hidden"],
.ns-2 * #bodyContent *[style*="none"], .ns-2 * #bodyContent *[style*="auto"], .ns-2 * #bodyContent *[style*="hidden"],
.ns-3 * #bodyContent *[style*="none"], .ns-3 * #bodyContent *[style*="auto"], .ns-3 * #bodyContent *[style*="hidden"],
.ns-4 * #bodyContent *[style*="none"], .ns-4 * #bodyContent *[style*="auto"], .ns-4 * #bodyContent *[style*="hidden"],
.ns-5 * #bodyContent *[style*="none"], .ns-5 * #bodyContent *[style*="auto"], .ns-5 * #bodyContent *[style*="hidden"],
.ns-6 * #bodyContent *[style*="none"], .ns-6 * #bodyContent *[style*="auto"], .ns-6 * #bodyContent *[style*="hidden"],
.ns-7 * #bodyContent *[style*="none"], .ns-7 * #bodyContent *[style*="auto"], .ns-7 * #bodyContent *[style*="hidden"],
.ns-8 * #bodyContent *[style*="none"], .ns-8 * #bodyContent *[style*="auto"], .ns-8 * #bodyContent *[style*="hidden"],
.ns-9 * #bodyContent *[style*="none"], .ns-9 * #bodyContent *[style*="auto"], .ns-9 * #bodyContent *[style*="hidden"],
.ns-10 * #bodyContent *[style*="none"], .ns-10 * #bodyContent *[style*="auto"], .ns-10 * #bodyContent *[style*="hidden"],
.ns-11 * #bodyContent *[style*="none"], .ns-11 * #bodyContent *[style*="auto"], .ns-11 * #bodyContent *[style*="hidden"],
.ns-12 * #bodyContent *[style*="none"], .ns-12 * #bodyContent *[style*="auto"], .ns-12 * #bodyContent *[style*="hidden"],
.ns-13 * #bodyContent *[style*="none"], .ns-13 * #bodyContent *[style*="auto"], .ns-13 * #bodyContent *[style*="hidden"],
.ns-14 * #bodyContent *[style*="none"], .ns-14 * #bodyContent *[style*="auto"], .ns-14 * #bodyContent *[style*="hidden"],
.ns-15 * #bodyContent *[style*="none"], .ns-15 * #bodyContent *[style*="auto"], .ns-15 * #bodyContent *[style*="hidden"] {
 display: block !important;
 overflow: visible !important;
 height: auto !important;
 visibility: visible !important;
 border: 3px solid red;
}
.ns-0 * #bodyContent *[style*="none"]:before, .ns-0 * #bodyContent *[style*="auto"]:before, .ns-0 * #bodyContent *[style*="hidden"]:before,
.ns-1 * #bodyContent *[style*="none"]:before, .ns-1 * #bodyContent *[style*="auto"]:before, .ns-1 * #bodyContent *[style*="hidden"]:before,
.ns-2 * #bodyContent *[style*="none"]:before, .ns-2 * #bodyContent *[style*="auto"]:before, .ns-2 * #bodyContent *[style*="hidden"]:before,
.ns-3 * #bodyContent *[style*="none"]:before, .ns-3 * #bodyContent *[style*="auto"]:before, .ns-3 * #bodyContent *[style*="hidden"]:before,
.ns-4 * #bodyContent *[style*="none"]:before, .ns-4 * #bodyContent *[style*="auto"]:before, .ns-4 * #bodyContent *[style*="hidden"]:before,
.ns-5 * #bodyContent *[style*="none"]:before, .ns-5 * #bodyContent *[style*="auto"]:before, .ns-5 * #bodyContent *[style*="hidden"]:before,
.ns-6 * #bodyContent *[style*="none"]:before, .ns-6 * #bodyContent *[style*="auto"]:before, .ns-6 * #bodyContent *[style*="hidden"]:before,
.ns-7 * #bodyContent *[style*="none"]:before, .ns-7 * #bodyContent *[style*="auto"]:before, .ns-7 * #bodyContent *[style*="hidden"]:before,
.ns-8 * #bodyContent *[style*="none"]:before, .ns-8 * #bodyContent *[style*="auto"]:before, .ns-8 * #bodyContent *[style*="hidden"]:before,
.ns-9 * #bodyContent *[style*="none"]:before, .ns-9 * #bodyContent *[style*="auto"]:before, .ns-9 * #bodyContent *[style*="hidden"]:before,
.ns-10 * #bodyContent *[style*="none"]:before, .ns-10 * #bodyContent *[style*="auto"]:before, .ns-10 * #bodyContent *[style*="hidden"]:before,
.ns-11 * #bodyContent *[style*="none"]:before, .ns-11 * #bodyContent *[style*="auto"]:before, .ns-11 * #bodyContent *[style*="hidden"]:before,
.ns-12 * #bodyContent *[style*="none"]:before, .ns-12 * #bodyContent *[style*="auto"]:before, .ns-12 * #bodyContent *[style*="hidden"]:before,
.ns-13 * #bodyContent *[style*="none"]:before, .ns-13 * #bodyContent *[style*="auto"]:before, .ns-13 * #bodyContent *[style*="hidden"]:before,
.ns-14 * #bodyContent *[style*="none"]:before, .ns-14 * #bodyContent *[style*="auto"]:before, .ns-14 * #bodyContent *[style*="hidden"]:before,
.ns-15 * #bodyContent *[style*="none"]:before, .ns-15 * #bodyContent *[style*="auto"]:before, .ns-15 * #bodyContent *[style*="hidden"]:before {
 content:"This section may be spam.";
 font-weight: bold;
 color: black;
 background: pink;
}

For those with other browsers, here is what it looks like in Firefox:

Update: I added handling of more hiding methods and fixed a bug the styles caused on the wiki Preferences page. Sadly, the bug fix means Konqueror (at least version 3.2) no longer displays the hidden spam.

In addition to adding the overflow handling, Halz pointed out that if allowed, wiki users can have their own sytles. See my exmple user style. By default this is not available, but if the site admin adds $wgAllowUserCss = true; to the wiki's LocalSettings.php, each user can customize the skin. See more about this in the MediaWiki documentation.

Let me know if you run into any other bugs or come up with improvements.

Update 2: Turns out the last bug fix makes this only works on regular wiki pages. I had limited the rule to ns-0, but there are 16 name spaces for pages that allow user content. Spam on pages like talk, help, help talk, user, user talk, catagory, etc. would have remained hidden. To unhide spam for all namespaces and not cause other problems, it requires a lot more selectors.

If the wikis you frequent don't allow user style pages, you can put these rules in your own browser. Check out UserContent.css for Firefox. You might also want to look into site specific styles, but likely these rules would be unusual enough not to trigger on non MediaWiki sites.

Solution for (Some) Gmail Outages

2006-03-27T14:04:00.000-06:00

A couple days ago CNET did an article on users having problems accessing Gmail for long periods. Gmail has become so important to many of us that is not acceptable. I have had some trouble occasionally but usually hitting reload a few times very quickly and/or Ctrl+Reload (override cache) will fix it. I just got another one and this time the usual fix didn't solve the problem.

My problem doesn't appear to be a problem on Google's end. I think it is a problem with the browser's cache (in my case Firefox). If the browser keeps attempting to load corrupted versions of the Gmail pages it will never get in. Using IE or Opera on the same computer and I can login and read email fine. It also works in Firefox on my laptop fine (on the same network). Once I cleared the cache I can get into Gmail fine again.

I have seen similar with Yahoo Mail a while back. A friend just could not log on from her computer, but on mine she had no problem. Yahoo just kept asking for her password again and again as if it was confirming it after a time of inactivity. It wasn't saying the password was wrong, it just kept wanting confirmation. I cleared the cache and the problem went away. But it took a long time to realize that was the problem. She was using IE so this is not a browser specific problem. And it is not a Gmail specific problem either.

So the solution (for at least some cases) if you can't get into Gmail is to clear your browser's cache. For help on clearing your browser's cache, see this page at The PC Doctor.

Update: Looks like the reason Ctrl+Reload didn't work is because the override cache button combination is Shift+Reload instead. You can also use Ctrl+Shift+R if you don't want to use the mouse. That might solve the problem, but since I don't have the problem anymore I can't test it.

Update 2: I knew my solution was too simple to fix everyone's problem. It had been a couple days since I carefully read the article. Clearly there are much bigger issues going with Gmail. But the cache problem is surely the cause of some user's complaints. Whatever else is going on, Google needs to fix it very soon.

Uselessness of Nofollow

2006-03-17T05:00:00.000-06:00

I ran across yet another post on the uselessness of rel="nofollow". It is clear spammers are too stupid and lazy to care if your site uses nofollow. And some forms of link spam aren't targeting search engines anyway. But does that mean nofollow is not doing any good? Not at all. I still think in the long run, nofollow will have some effect on comment spam. But I finally realized what nofollow is doing for us now.

Exactly what it was intended to do, tell the search engines which links not to give weight to. So while your blog might not be seeing any direct impact from using nofollow (as in less comment spams), you are seeing the results when you use search engines. Just think of all those spam links that the search engines are able to throw out when ranking search results. There are other webspam methods to increase links to spammers' sites (like splogs), but just think how bad search relevancy would be if engines were still counting splogs and comment spam.

I kind of wonder if nofollow was ever intended to do anything more? The inventors should have known enough about spammers to know they are to stupid and lazy to look for nofollow tags (or any kind of antispam measure). Was it just marketed as a solution to comment spam so it would be quickly adopted? If so, it was a huge mistake since clearly it has not had much impact on preventing comment spam. It is just more ammunition for the anti-nofollow people.

You have to see the bigger picture. An individual site by itself is insignificant compared to the web as a whole. Nofollow may not help your site directly by stopping spam, but by making search engines work better, it helps everyone (except the spammers who try their best to fill search engines with junk). Users are better be able to find what they want (which could include your site) instead of having to dig through piles of spammer garbage.

Nofollow is working!

Whitelist Spam

2006-03-16T19:05:00.000-06:00

This was a rather sneaky spam, it attempts to make you believe you have been added to the sender's email whitelist. It really doesn't look like spam at all. Since I have been rather lazy lately on the chongqing front, it was suspicious that I got added to anyone's whitelist though. I haven't sent any emails recently.

Received: (qmail 14080 invoked by uid 60000); 17 Mar 2006 00:09:57 -0000
Delivered-To: chongqed.org-joe@chongqed.org
Received: (qmail 14078 invoked from network); 17 Mar 2006 00:09:56 -0000
Received: from c-24-18-54-168.hsd1.wa.comcast.net (HELO LocalHost) (24.18.54.168)
  by h2247.serverkompetenz.net with SMTP; 17 Mar 2006 00:09:56 -0000
Message-ID: 
From: nicholas@seaton.biz
To: joe@chongqed.org
Subject: YOUR EMAIL ADDRESS HAS BEEN ADDED TO MY WHITE LIST
Date: Thu, 16 Mar 2006 16:18:08 -0700

I, the sender of this message, have explicit activated the option in All-in-One SECRETMAKER to inform you with this @WL notification email about the following:

My emails are managed by the Spam Fighter from All-in-One SECRETMAKER. Your email address has been added to my Spam Fighter White List.  Adding your address to the White List ensures that I will always receive email you send to me.

All-in-One SECRETMAKER is a powerful and smart freeware which includes Spam Fighter, Pop-Up Blocker, Banner Blocker, Privacy Protector, Cookie Eraser, Worm Hunter, History Cleaner, Intruder Blocker protect from SPYWARE, TRACKWARE and other harmful programs and more.   WWW.SECRETMAKER.COM

A bit of Googling for nicholas@seaton.biz quickly told me my suspicions were right.

Activity Update

2006-03-16T03:54:00.000-06:00

I discovered that my blacklist mirror has been not working for a while. Not sure what happened, the subdomain just wasn't in the site config anymore, but it is back now.

Lately additions to the list have really slowed as has our wiki and my blog. Most of the other spam fighters I hang out with seem to be less active too. I brought this up among some of them and one suggested something like no news is good news. Could it be that web spammers aren't being as aggressive/stupid anymore? Or maybe Google's antispam measures have finally caught up with them. The only alternative I can think of is we have all been extra busy/lazy at the same time.

Even the idiots who keep spamming this blog have slowed again. I haven't actually compared over the long term but in the last 13 days I have only got 16 comment spams. But the first three days of March had 20 spams themselves. So I am pretty thankful for only 16 since then.

I know web spammers are still out there, while the rest of us have been less active on webspam, SplogFighter has been hammering away at splogs.

I have also been running a few experiments. The most interesting and only one that actually has been working was to see what would happen if I stopped cleaning spam from my honeypot wiki. I am still analyzing the data, but it is interesting so far. As it happens though, just before I decided to end the experiment and clean the spam it totally stopped. That makes me think it was all the work of one spammer, he must have refreshed his victim list. I guess it was a good time to stop the experiment since my only participant quit. I will try to get a post up on this soon.

More on Free iPods

2006-03-16T03:04:00.000-06:00

Almost exactly a year ago I made a short post linking to a Free iPod article at SFGate. Today I read on Wired News that the New York Attorney General has a victory against an e-mail marketing giant that bought one of these shady lists collected by offering free iPods and other stuff in exchange for lots of personal info. The company has "agreed to a $1.1 million fine for knowingly buying marketing lists from companies with privacy policies that promised not to sell or transfer the lists to a third party."

.htaccess

2006-02-26T17:00:00.000-06:00

A lot of sites recommend blocking spammers with .htaccess. For those who want to get more out of the file than just blocking certain spammers, see this .htaccess tweaking article.

PRStorm For Sale Again

2006-02-21T14:28:00.000-06:00

After Steve bought PRStorm in October, he told Michael Pollitt, "I hate spam and never intentionally will distribute any spam." Now that he has made tons of money off of distributing spam, he is making good on his "get rid of the PRStorm site very soon" plan. Though not by shutting it down, he is selling it on eBay again.

Regex Spam Fighting

2006-02-02T05:00:00.000-06:00

If you are fighting wiki spam, you likely have found regular expressions are a common method to block spam. They are of course useful for a lot more than just blocking URLs. You can find regexs in a lot of places. But for this post I am sticking to antispam uses.

John Walling uses keyword blocking. I worry about false positives with this method, but if careful with your regexs and you think about the keywords carefully hopefully that won't be a frequent problem. For example, blocking cialis also blocks specialist. But there are words like tramadol or hydrocodone that aren't likely to be necessary unless you are running a medical wiki.

You can also block spam based on patterns commonly found in spam. This is used in blocking CSS Hidden Spam. This doesn't catch all spam, but it will catch all spam using this technique whether or not any keyword or URL would have caught it.

Well, the main purpose of this post was to let you know about Regular-Expressions.info's regex tutorial. I saw lots of stuff there I didn't realize was possible. Regular expressions are very powerful tools and you don't need a lot of experience to take advantage of some simple rules. The more people that can come up with their own spam blocking methods the worse off spammers will be. No single method (except locking down your wiki) is going to solve the problem.

IE7 Beta 2 Preview Review

2006-02-01T02:59:00.000-06:00

Yesterday Microsoft released a public preview beta of Internet Explorer 7. It is nice and simple, but everything has moved and it is a very non-standard UI. I have never used Netscape 8, but the new layout reminds me a lot of the screenshots of NS 8 I have seen.

Every major browser I have tried has the stop and reload buttons next to the forward and back buttons. They make sense there. Things that are going to be used frequently should be in a single place that is easy to find. In this beta of IE 7 the reload button and the stop button shift over to the end of the URL bar. But that isn't the edge of the screen, there you have a dropdown search like Opera and Firefox. That is a good place for the search bar, but makes hitting the reload and stop buttons awkward. What is convenient about this placement is the Go button that I always disable finally has a place that doesn't bother me, before a page is loaded it takes the place of the reload button.

The thing that is most strange is the menu bar being missing. It really isn't any loss since everything in there can be accessed by the new buttons, but they are going to take a lot of getting used to. They also take up a lot of the tab bar. There is an option for a classic menu, but by placing it below the URL bar I just can't stand it.

I like that when you hover a tab you not only see the page title, but the address. But I think they need to truncate the address at some point. There is room since it can display from one side of the screen to the other, but addresses with lots of parameters looks bad taking up the entire width of the screen and likely get truncated anyway if they are that long.

I also like the new floating Favorite, Feed, History sidebar. That is a big improvement for screen realestate. Often I see users with that bar open all the time to either History or Favorites even in Firefox. Now that it collapses when you are done it is much nicer. It can be pinned open like before, but this is a great default.

They have added a Phishing Filter similar to the Google Safe Browsing extension for Firefox. I don't really know how well either works, I don't normally stumble into phishing pages so I have yet to see the Google extension warn me of anything except their test page. But in theory this is a great improvement that hopefully will make people less likely to fall for scams. But will these filters make people more likely to fall for scams that sneak through? I would say yes, except that most people that would fall for these attacks now don't know what to look for and would have been fooled anyway. So some protection is better than none.

I found a few rendering bugs without really trying:

Borders in Gmail are a bit messed up some of the time, but that is minor and sometimes goes away.

Logos on MediaWiki wikis are not displayed.

Menu tabs on POPFile’s default skin are really messed up, showing only one to a few letters per tab. Resizing the window fixes that usually till you load the next page so hopefully that will be fixed.

Any heavy tab user knows at a certain point in Firefox, tabs just can't get any smaller and are shoved off the edge of the screen. Currently with FF they are no longer reachable through the tab bar. IE will hit that overflow point sooner because some of the tab bar area is taken up with the toolbar buttons. MS seems to have come up with a solution that I haven't seen mentioned at Mozilla. They shrink the edge tabs and use them as a kind of scroll button. Click an edge tab and you switch to that tab and the bar shifts. That is an interesting way of doing it, but not great for power users. And what other kind of users are likely to have that many tabs on purpose? The problem is not simple though, Firefox developers are currently working on figuring out a good way to allow users to access those spill over tabs.

I like the way IE handles the tab close button. They only show it on the active tab and it is grey until you hover your cursor over it so it is not distracting. I never used the close button at the end of the tab bar in Firefox anyway, I always middle click (or double click) and middle clicking also works in IE 7. Firefox developers are experimenting with tab close buttons too, I hope they take a good look at what MS did.

Next is feature already in IE that I just realized, the right click context menu has a big improvement for inexperienced mouse users over Firefox. I have watched older people who just can't get the difference between right and left mouse buttons. By right clicking in Firefox and blindly choosing the first option you open a new window for every link clicked. That makes the back button useless and ends up using a ton of memory. IE's first option opens in the current window/tab. I and many others would probably not like if FF changed the context menu, but the usability improvements that would be for some users would be worth it.

There apparently have been a bunch of CSS fixes which is good. This should really help cross browser site design, but I am sure we will still have to work around many things and of course still support IE 6 for a good while. The best page rendering fix I noticed was that PNG alpha transparency finally works without any hacks. I don't normally use IE so it is hard to tell, but it seemed faster. It certainly was faster than Firefox.

When programs all start coming up with unique interface layouts, users are going to suffer. It may be true that usability tests show the new interface is easier to use, but if every program comes up with their own better way, users will be constantly confused how things are organized. Firefox developers need to keep this in mind too. So far they mostly have made good decisions, but now with what Microsoft has done and their constant strive for a simpler browser I fear they will head in this direction too.

Update: Ted Drake has a post with a bit more detail of the CSS improvements. He also points out that you should realize what you are doing if you install this beta. You are replacing IE 6. Assuming nothing goes horribly wrong, you should be able to uninstall it if necessary. But this is a beta version and you never know.

Update March 27: The second public preview was released recently and all the specific page layout issues I mentioned above are solved. But I did notice another issue with MediaWiki, the login bar at the top of the page is not placed correctly, normally it is on the right, with IE7 it is on the left under the site logo. Since this release is supposed to be layout complete, I guess MediaWiki developers will have to work around this minor problem.

TinyURL AdSense Links

2006-01-27T01:15:00.000-06:00

Today in Gmail's RSS/Ad bar, I noticed an ad with a tinyurl.com link. That seems odd to me. Why wouldn't you just use your domain? Some Googling seems to point to affiliate marketing. Apparently most Pay Per Click programs don't allow affiliate codes in links. So by using a redirect URL service you can sneak your affilitate code in. This allows those that don't have a site to participate in affiliate programs.

The URL the ad points to is:
tinyurl.com/bem8r

That redirects to:
www.webtrafficmarketing.com/?hop=netman114

Now, for the topic of the ad, "Email Over 2 Million." That text looks very spammy, but according to the site, it is a double opt-in list and has never recieved a spam complaint. I have no reason to believe otherwise and I am not saying the tinyurl ad link is webspam. I just find it really odd that obvious redirect links are allowed in AdSense. You can't get much more obvious than tinyurl.com.

I don't like redirect services like this in the first place. I admit they are useful to shorten long links that would wrap in email or Usenet posts. Sometimes that may be necessary. But when you click one you have no idea where you are going to be taken. You could end up at something like Goatse.cx or a site that installs malware. And what happens if the service goes out of business? All those links would be no good.

Comment Spam Report

2006-01-21T18:48:00.000-06:00

At the end of last year I posted that it looked like comment spam on Blogspot had slowed down. It was getting to be pretty reasonable (taking into account blogspot spammers are idiots).

Well, thanks to 92 comment spams by one idiot and a few other persistant spammers, I am now up to 528 comment spams. That is an additional 172 spams since December 28. Not counting the idiot, that is still 80 new comment spams in 24 days.

I guess it was just the holidays slowing them down.

Blogger Backlinks Spam

2006-01-21T17:16:00.000-06:00

When Blogger introduced a javascript powered "Links to this post" feature I thought that was a pretty well spam proof. Backlink would only show if they appear in Google's blog search, eliminating fake trackbacks. And they only appear for users, not search engines. There is no PageRank benifit from javascript powered backlinks. So either this spammer is stupid or he is just after hits.

I discovered this Laptop Review spammer while reading a post at the Official Google Blog. The links back to the Google post are included in two of his three post tags: "gateway, nx860, laptop." The first two both link to different posts at Google's blog as do some of his other posts.

Getting a backlink on a popular Google blog post can get you a bunch of hits, but it helps when the topic is similar. I link to them often when a new antispam feature is announced, the more relevant my post title is the more hits I get. A post on Gmail's new delete button and a post on health aren't at all related to laptop reviews. I also sometimes get a few hits by Google employees though the official blog backlinks, that doesn't seem like the correct audience for spamming.

It doesn't look like a splog at first glance, but you will see that the posts are reposted from other sources without attribution or link to the original source. Compare:

"ThinkPads to support Cingular 3G technology"
the review
at ZDNet

"Sony VAIO FE-Series"
the review
Sony's press release

"Dell Introduces XPS Renegade"
the review
at PCMag

This review blog is clearly not the usual splog, it appears to have human input in the posting of articles since occasionally there is a sentance or two added before the "borrowed" copy. Whatever it is, this blogger needs check out Plagiarism Today.

The site links back to Gadioc.com quite often including the footer and sidebar of the page. That site's content is very similar, but it links back to the original post (at least some of the time).

Too Many Dashes

2006-01-12T21:23:00.000-06:00

Some spammer is really going nuts with comment spamming my blog. For the last four hours I have been getting the same comment spam over and over with only the link keywords changed. At this point, of the twenty-seven different posts Martyn has been spamming, most have two spams and many have three or more. I get a new one about once every minute for a while, then a break, then they start all over again.

Does this URL look non-spammy to anyone? I don't think I have ever seen that many dashes in one domain name:

diet-pills-phentermine-pill-buy-cheap-online.com

Not that their spam is hard to find in Google, but I thought I would provide a copy here:

Hi there, I was searching for information on the recent task force findings but seemed unsure of the status of HHS and DEA regulations addressing the very issues that they were reviewing, if you can shed any light on this please post at my blog. I see how I found your blog when I was searching for online discount pharmacy and online discount pharmacy related information, please remember to post at my blog if you feel you can add. Thanks for the read
Kind regards
Martin

Posted by martyn at 1/12/2006 04:34:23 PM

This is a marketing affiliate of Health Solutions Network (mpllc.net). Their affiliate terms have a "Zero Tolerance Spam Policy" which clearly includes all form of link spamming:

"Affiliate may NOT promote by means of Spam. For the purposes of this agreement 'Spam' is defined as one or more commercial or noncommercial unsolicited electronic messages."

I emailed mpllc.net after the first hour of the attack, but since it is late I doubt I will get a response till tomorrow morning. I will certainly let you know how it goes. Affiliates damaging people's sites like this make legitimate companies look bad. If you run an affiliate program, be very careful so you don't get a bad name yourself.

Update Jan 15: No response from mpllc.net yet, but the spamming did eventually stop. It continued until 6:12 AM the next day. That is over 10 hours of spamming the same blog with nearly identical comments. In the end there were 92 comment spams spread across 31 posts.

Update May 15: As you can see from the comment below, I finally got a response. Tony said he missed my email (or maybe it got filtered as spam). Either way, the affiliate account is gone now. He said they regularly search the web for affiliates who are breaking the rules. That's how he found my post. Now anybody directed to his order form from this spammer's account will see the message "Suspended for blog spamming."

Update July 10: Just a short following up. The spammer site still exists of course, but now is just a redirect to a spamdexing search site. The resulting site is at oingo.com, which is run by Applied Semantics, and now owned by Google. It is nice to see Google expanding its spamdexing business.

Spammer Wannabe

2006-01-10T13:17:00.000-06:00

There is a spammer who is now calling me a Warlord. Since I am involved with the war on spam that really doesn't surprise me. What surprises me is how scared of chongqed.org he is, all of our sites made his antispammer blacklist.

For those who read here or Ann's blog, you can probably figure out who I am talking about. He doesn't believe he is a blackhat spammer because it is all shades of grey anyway. I have decided not even to nofollow link to him anymore, he is just trying to make a name for himself among other spammers.

He says my sidebar of spammy keywords is violating Google's guidelines. You are they "grey hat" spammer, what do you care about guidelines? Since my blog discuses spammers and their keywords and how stupid you spammers are, it is not off topic for me to use those same keywords.

He also calls my blog a doorway. Clearly he is an expert spammer to identify a blog as a doorway. If this is a doorway how do I convince people to read it? You will also notice there are no ads or affiliate links anywhere on our chongqed sites. We aren't doing this for the money, there is none and it takes up a good deal of our time. We are doing this because spammers are wreaking the internet and must be stopped.

He is now likely to whine that this is another personal attack against him. Call it whatever you want. He is a spammer, what do you expect them to say?

Email Comment Spam

2006-01-09T19:57:00.000-06:00

I got an unusual comment spam tonight. There was no link, but an email address. So clearly this spammer is aiming at people rather than search engines, right? Well, not quite.

I'm very sorry to post this in your comments section but I like your blog and think you may have a good chance of getting listed at our blog directory, "High Class Blogs."

Contact me at ethan@highclassblogs.com if you are interested.

Ethan Potter

Posted by Anonymous at 1/09/2006 06:40:28 PM

According to the site, HighClassBlogs.com is a "Non Profit Blog Directory." They even have "reviewers" and require approval for entries they receive. They have to be sure you link back to them. That is how their spam works, they spam you to get you to voluntary link to them.

Some of their categories sure look non-spammy:

Blackjack	Fantasy Basketball	Loans
Airline Tickets	Fantasy Football	Medicine
Blogging	Fantasy Sports	Online Gambling
Blue Book	Football	Online Shopping
Celebrity	Football Betting	Salaries
Celebrity Oops	Football Picks	Sales
Christian	Foreclosures	Search Engine Optimization
Christian Dating	Gambling	Sex Sites
College Basketball	Game-Online	Shopping
College Football	Harley Davidson Motorcycles	Small Business
Computer Desks	Home Business	Texas Hold 'em Poker
Credit Reports	Home Equity Loan	Work At Home
Extreme	Home Improvement
Fantasy Baseball	Home Loans

They also do email spam apparently.

Update: During the time I was writing my (Feb 7) comment below, the site owner put up a notice that they have received complaints and instructed their volunteers to stop leaving these comment spams on blogs. I am happy to see that, but we will have to wait and see if it really stops.

Iframes in Yahoo Groups

2005-12-29T01:53:00.000-06:00

SpamHuntress wrote about this problem yesterday. She found that Yahoo allows iframe tags inserted into Yahoo Groups by an administrator.

Since originally posting, we have been working on showing it was also possible to insert an iframe from a user submitted message, not only administrator inserted code. Here are my examples showing the iframe vulnerability in a message posted by a user by email and from the Groups interface.

This is not a new problem. Some people believe the real weakness lies with internet browsers. In a way it does, but then you could say the real vulnerability is the existance of the iframe tag itself. But iframes when used properly can be useful. They aren't really necessary for website design, but they aren't going away. If you use AdSense you are probably using iframes and don't even know it. Do you want to tell Google they can't use iframes anymore? The real solution is to filter user submitted content. That doesn't prevent all malicious uses of iframes, but what spammers and scammers do on their own site is a different problem.

Similar iframe vulnerabilities can be found in other forum software, but Yahoo is a large service that I think can give users a false sense of security. They may believe they are on a trusted site while under the yahoo.com domain. Yahoo should do whatever they can to protect their users. They do prevent javascript from being run from a message so they clearly understand that user content can be dangerous. They just missed this one. Hopefully they fix it soon.

Most Spammed Posts

2005-12-28T14:13:00.000-06:00

Comment spam on Blogspot appears to be improving. 356 (since November 4) up from 303 comment spams 35 days ago is not bad. That is an average of only 1.5 spams a day for over a month. It is still hard to tell if this is due to the holidays, Blogger cooking something up, or finally spammers getting smart. Since SpamHuntress says spam has increased on her blog, things are looking good for Blogspot users.

It also seems that Blogger has fixed the moderation hole. I haven't had any spam slip though moderation in a long time.

And I am not required to approve my own comments to my blog anymore which is nice. I always thought that was a bit stupid.

I am sure you are all eager to see how my posts are scoring in the most spammed game. There has been a rise in casino spam lately so my posts on that topic have really jumped ahead. I am limiting the results to those with 8 points or above, last time it was five but there were a bunch of players that suddenly reached that level and the table got to big.

+7	22	Casino Online On-Line Spam (part 2)	7/07/2004
+1	20	Lots of Comments	11/05/2005
	16	Google's Spamdexing Service	10/08/2005
+5	12	Casino-Online-On-Line Spam	7/06/2004
+4	12	Casino Online On-Line (part 3)	7/08/2004
+1	11	How Not To Fix The Blogspot Issue	10/26/2005
+1	10	New Spam Fighters	8/30/2005
	8	More about BeTheDealer	7/08/2004
	8	BeTheDealer and DirectedMarket	7/08/2004

Gmail Spam Recipes

2005-12-28T14:07:00.000-06:00

If you have turned off your Web Clip bar in Gmail you are missing out.

You know they show Web Clips (RSS feeds), Sponsored Links, and Gmail Tips. But did you know they also post Spam Recipies?

Each time I see one I find it funny since the reason they are targeting me with them is because so much of my email is either tagged [Spam] or discussing spam. Well today I discovered they get a lot more frequent when I open my Spam folder. Pretty much every thing in the web clip bar was a spam recipie.

My favorite is Spam Fajitas. But there are lots of others to choose from: Spam Skillet Casserole, Vineyard Spam Salad, Savory Spam Crescents, Spam Primavera, Creamy Spam Broccoli Casserole, Spam Hashbrown Bake, Ginger Spam Salad, and Spam Breakfast Burritos.

I am sure Hormel would be happy to know they are getting lots of exposure in Gmail, but if I were them, I would ask not to show SPAM recipies in the spam folder.

chongqed.org Fixed

2005-12-28T13:17:00.000-06:00

Manni got the DNS issues worked out and now things should be back to normal.

I am going to keep my mirror blacklist going just in case, but it is best if you use the one on the main site. It is more up to date since mine updates from it a few times a day.

chongqed.org DNS Issues

2005-12-27T09:52:00.000-06:00

Manni announced on our WikiForum that chongqed.org was back and fully operational on the 23rd. Someone forgot to tell my DNS server because I still can't access it normally. It seems that due to some setup issues only one of the three name servers chongqed uses has our subdomain records right. So if you are lucky enough that your query is served by one of those two, you can't reach our subdomains. We are narrowing down the name server problem though and hopefully will have it fixed real soon.

But the good news is that chongqed.org is working again so even if you can't reach it, my mirror blacklist is now being updated again. So far today I have added probably at least ten different spammers with lots of domains. I plan to work to add more than we have been lately to make up for the blacklist being down for so long.

New chongqed Wiki

2005-12-26T13:21:00.000-06:00

For anyone else going through chongqed wiki withdrawal, we now have another one to hold us over till Manni gets the main one fixed. I set it up mostly as a way to experiment with MediaWiki, but plan to use it as a spam collecting honeypot of course. So to avoid confusion I will be calling it our honeypot wiki.

I have been trying out the MediaWiki antispam features; there are more than I realized. But I have only been able to make one of them work so far. It is an important one though.

$wgSpamRegex allows you to ban whatever you want. On our wiki it was suggested by PForret to use it to block CSS Hidden Spam. His rule blocked div tags which worked since that is what spammers are using for now, but they could use many other tags. That means we should concentrate on the style attribute instead.

My rule blocks tags with style attributes that could be used to hide spam:

$wgSpamRegex = "/\<.*style.*?(display|position|overflow|visibility|height)\s*:.*?>/i";

I think that covers everything except font-size and color, but those aren't the best for hiding spam and are more likely to be useful for nonspam purposes than the others. If I am missing any others let me know.

More powerful rules and discussion at the honeypot wiki.

AdSense for Typos

2005-12-20T18:47:00.000-06:00

In October I posted about Google's spamdexing service. I then found a post at 90% Crud saying basically the same thing way back in January 2004.

Now SearchEngineWatch has a similar post calling for reform of the AdSense For Domains program. This article concentrates mostly on typo domains which are against Google's AdSense policy. There seems to be no problem with typos when using Google's DomainPark (spamdexing) service.

chongqed.org Server Troubles

2005-12-20T10:10:00.000-06:00

Well, several days ago I posted that chongqed.org was in the process of moving and not working right, things have only improved a little since then. My email is now working again. And Manni is closer to figuring out what is going on.

Since we have been down I have setup a mirror of the latest copy of the blacklist I have (December 6, but not a lot had been added since then) in case anyone needs it. And I have set up a cron job to update the mirror daily once the site gets working again. You can add that address as a backup location. I don't have the bandwidth the main site has though so use the main one when possible.

I am also working on some content for chongqed.info. For now it is just a bunch of antispam RSS feeds I like. I will be expanding it, but not yet sure with what. I have been thinking about setting up a honeypot wiki. Spammers are learning not to mess with chongqed.org's wiki, will they be smart enough to avoid chongqed.info? I doubt it.

Safer Browsing

2005-12-16T06:49:00.000-06:00

Firefox is safer than Internet Explorer, but it could be better. Here are a couple extensions to do that. Both require Firefox 1.5, but you should be upgrading to that anyway.

Google has just released Safe Browsing, a Firefox extension that will warn you when you are on a suspected phishing or spoofing site. It sounds like it can do some of this based on "advanced algorithms" that look at the page content, but I am not sure how successful that will be. But if you turn on Enhanced Protection, the extension will query Google's blacklist. Even with the blacklist it still missed a clear eBay spoofing site in my test.

Another way to make browsing a little safer is FormFox. When you hover the cursor over a form submit button a tooltip popup will tell you the address the form will be submitted to. And if the form is not being submitted to the same address the page comes from, it will also warn you. It seems to warn sometimes when it shouldn't though, but seeing the submit address is the important part.

Since Google's Enhanced Protection sends the URL you visit to Google for checking, it is a minor privacy issue, but that is why it is not turned on by default. It is no more loss of privacy than if you use a PageRank utility. And I think it is far better to send a little data to Google about your browsing than being tricked into sending your registration data to a scammer. You still have to be careful of course, but any help is better than none. It sounds like Internet Explorer 7 is going to have something similar, but that is still months away.

I hope they keep up on this blacklist better than they have on their tools in the antisplog war. With Microsoft going to have a similar function for IE, and Google being a big backer of Mozilla I would think they will have to keep it up to date. I wonder if this extension will be the basis of similar protection built into Firefox 2.0.

For now, Google's extension is only available for users in the United States. Their FAQ says this is due to licensing issues and they are working on it.

chongqed.org Server Move

2005-12-15T19:39:00.000-06:00

Manni has been in the process of moving chongqed.org to a new server. It is finally going through now so if you find you can't access chongqed.org or our subdomains it should be fixed soon. Right now I can access the main domain, but not the wiki which is kind of annoying since that is where most stuff happens.

Gmail Adds RSS Feeds

2005-12-09T14:43:00.000-06:00

Today Gmail added an RSS feed headline to the top of the inbox in Gmail. Apparently some people already had it for a while, so I guess it came out of testing today. It is kind of interesting I guess. I found some interesting articles from its news sources I would not likely have seen otherwise. But really, it a very sneaky way to get users to view and maybe click on text ads. Occasionally they aren't "Web Clips," they are "Sponsored Links." They are clearly marked, but I found myself looking at them more than I look at the sidebar of targeted ads in Gmail's message views. Good job on that Google.

It comes with some default feed sources and you can select from a bunch of other major news and entertianment sites. You can also add custom feeds. I think I will stick to Google Lens for most of my feed reading. But for news and entertainment sites that I normally wouldn't read I think it will be interesting.

AdSense Extortion

2005-12-03T15:21:00.000-06:00

Dirk has a post about AdSense Extortion from a news article on heise.de (in German). It looks like this scammer was slowly increasing the AdSense revenue for the bloggers' sites through click fraud. He then requested half their AdSense income or he would increase the click fraud so much Google would notice and suspend the blogger's account. If you are a victim of this or any other AdSense extortion attempt notify Google.

Gmail Adds AntiVirus Scanning

2005-12-01T15:28:00.000-06:00

This is good news.

Well, actually it is very surprising now that I think about it. Why didn't we already have it!!! Gmail has been running in beta for over a year now. Did Google not think antivirus was a priority? I know that by labeling it a beta they can get away with whatever they want, but no antivirus is just stupid. I always assumed they had scanned my email for viruses. I am sure I am not the only one.

Up till now they just blocked sending any executable. That solved part of the problem, but that didn't block macro viruses in documents. And it was pretty annoying when you wanted to send an executable, even inside a zip file.

Update: There are some complaints about this new feature discussed in this article at Computerworld.

The first one, which at first seems unimportant is that scanning can't be turned off. The article explains why that could be a problem for some people. Of course, it is a worse problem for virus writers so I don't have a big problem with it. Do other major mail providers allow you to turn off virus scanning?

Second problem is pretty annoying, they aren't going to quit blocking executables. For the average email user that is not a problem and will help prevent spreading unknown viruses. But it is really annoying for me and many others.

The last big complaint is that Google isn't saying what antivirus technology they are using. Assuming they have not created their own scanner, people want to know what vendor they are using. I am interested in knowing too, but it doesn't make any difference. Each different implementation may have weaknesses, but how does knowing solve anything? You should already have your own antivirus scanner that you are happy with.

The War on Splogs

2005-11-30T14:32:00.000-06:00

Plagiarism Today has another great splog article, Losing the War on Splogging?. In it he discusses many things I have mentioned here and some new stuff that I completely agree with.

I especially liked the part comparing splogs to email spam. I have been wanting to post on that subject for a couple days so I am glad Plagiarism Today brought it up. With email spam you can setup your own filters, there are commercial filtering services, and ISPs usually at least try to filter email spam. Splogs are different, if they aren't filtered by their hosts, all that is left is to filter them out at the search engines. Client filters just won't work against splogs.

Since we know not all hosts are going to deal with splogs properly, that only leaves search engines to solve the problem. If they don't, search results are just going to get less and less useful. Plagiarism Today says if this problem continues to grow it will be the end of the blogosphere. It could be far worse than that, at some point people will just stop using search engines because they can't ever find what they want.

That would be the end of the internet as a useful resource of information. Portal sites with their own content would become necessities. AOL, Yahoo, and MSN would really benefit out of that situation. Google does have a lot of services, but no real portal like the others. They would be playing catch up.

We would also likely see growth of the human edited directories like Yahoo started off as. Dmoz currently is the only large human edited directory I know of. It is a good supplement to search results, but it is not a replacement for traditional search engines. Inclusion requests often are handled very slow if at all. There is too much potential for abuse with volunteer editors. I have already read about corruption including spammers sneaking their way into being categories editors.

Not indexing any blogs in regular search results might seem like a solution, but is it really? Sploggers have gotten attached to this "business model." They will just expand to other webspam methods which will continue to fill search engines with garbage.

I don't think we are loosing the war on splogs yet, but with Google apparently dropping out of the battle we are headed that way fast. I hope they wake up. When you are the biggest search engine, it is your duty to help clean up the internet. No one else can.

Is Google Slacking?

2005-11-30T13:04:00.000-06:00

We already know they stopped deleting splogs on Blogspot. Now it looks like the little monitoring they did on AdSense may have stopped too. I first read about the AdSense change at SearchEngineWatch. And from their article read SearchViews.

I have no direct experience with AdSense, but this looks like a big problem for advertisers. Is this designed to raise the price of ads so Google can make more money? I doubt to, but that may be the end result. Which will also result in AdSense becomming no more popular than any other ad service.

I wonder how this affects SplogFighter's remaining method of fighting sploggers by going after AdSense violations.

Update: Google replied to SEW that humans are still part of the review process. Seems like it is a smaller part than it used to be.

Matt's SEO Mistakes

2005-11-28T17:15:00.000-06:00

Matt Cutts went on a posting spree lately. If you don't know why that is important enough to deserve a blog post then you clearly are not into SEO. He is a top antispam guy at Google. If you are running a website you should know about him.

His recent posts have mostly been on search engine optimization mistakes people make while setting up or marketing their sites:

Nearly Hidden Text
Spam Email Guarantees
Believing All Emails
Software Mistakes

And still on the posting spree and certainly related,
Sketchy Testimonials.

Update: A related post at SearchEngineWatch, On SEO Myths & Getting The Balance Right.

Best Search Engine Study

2005-11-28T16:52:00.000-06:00

We know how spammy Google can be for some searches, but according to a blind study they do provide the best results. Not very surprising; the others are full of spam. What is surprising is that their lead isn't very big.

The study is being limiting to only the top three results from the main three engines (Google, Yahoo, MSN), but you can't really list them all and expect people to carefully evaluate the results of each engine. I presume that for most general (non-sex/drug) keywords you aren't going to run into much spam in the top three results so I guess they are mostly measuring relevancy rather than least spamminess, but they do go together.

There certainly are some flaws in the study. There is no way to vote a tie. And as some people suggest in the comments, by limiting to only the big three engines they are missing out on possibly better results (yeah right, there is a reason they are the big three). But when you run your own version you can set it up better. ;-)

You can participate in the ongoing study by choosing the best results for a search term you provide. You only get one official vote (monthly?) but can try it as many times as you want.

In my first run at the blind test I chose the Google results, but all three were pretty good and two only differed by one link. This was for a normal keyword that is not highly competitive.

My second try was for tramdol. Guess what I got. That is right, they all sucked. It was hard to decide, but after looking at each page I decided on the slightly less spammy of the three. In case you are wondering how non spammy the results were, here are the winners:

New to tramdol
Buy Tramdol 20% OFF - Drugs.MD - FREE Consulta ...
Tramadol

And finally I gave lolita a try. I really got far better results than I expected. No porn or spamdexing pages in the top three results from any engine. I chose this one on informational quality of results assuming I wanted information on the book or movie.

Two were pretty good, giving both movie and book information, but one of those listed three IMDB and Amazon pages. How they got three results for two different pages doesn't look good to me. The third included a young girl picture site; they were clothed and from what I saw not in revealing clothes, but still. It also returned a site for a bar named Lolita, which was not what I was looking for.

This time the winner was Yahoo, only because of the duplicate IMDB page and commercial bias of Google's top results. By process of elimination I am sure you have already guessed who returned the more questionable results, MSN.

I kind of figured when I saw it, but a manual Google search for lolita confirmed it. Due to Google's stacking of related pages from the same site (which in this case were identical with slightly different URLs) we got the odd looking results. I really don't know how you are supposed to handle that case in a study any better though. In a study I worked on a couple years ago we did the same thing, we determined that you just have to include everything otherwise it is not comparable to the other engines. They included it as one of the ten results on the page so we looked at it as a separate result.

Customized Comment Spam

2005-11-28T13:39:00.000-06:00

Wow. This one is pretty good. The spam is customized by including the title of the post being spammed. Seems pretty well targeted too, too bad they didn't realize why I was talking about online casinos.

Hi There Blogger
I was looking for information related to online casinos and found you blog.
Your Casino Online On-Line Spam (part 2) has excellent online casinos information however not exactly what i was looking for.
Fantastic blog, keep up the great work.
Regards

online casinos , video poker

Posted by casinos at 11/28/2005 12:50:59 PM

Emphasis added to show post title.

Splogs as Plagiarism

2005-11-27T03:46:00.000-06:00

I found a very interesting site in the fight against splogs. The main focus is on plagiarism and copyright infringement, but since that makes up most splog content there are some good feed scraper specific articles there like, Splogs: Plagiarism En Masse.

And they explain how to add a copyright notice footer to the bottom of posts on your blog's feed. Recently I added a tracking image to my feed. It wasn't setup for copyright purposes, but for identification and will be useful for tracking down spammers who illegally "syndicate" my posts. Ann quickly discovered the tracker and posted her support. You can read how to do it for Blogger in my first comment on that post.

Advice for Comment Spamming

2005-11-23T23:25:00.000-06:00

Why waste time thinking of text to try to make your spam look real. This isn't like email spam, you aren't trying to trick readers into thinking it is real mail. Either it works instantly or it is held for moderation in which it has little chance of surviving. On most blogs there is no automated spam filtering and when there is it is usually only based on URLs. There really is no need to fill up the comment with stupid text. One spammer seems to have figured that out. I just got a spam comment where the entire comment was five short linked key phrases each on one line.

I also wonder why spammers keep hitting the same sites over and over within a short period. That makes their spam more obvious and annoying. People might hate spammers less if they weren't so destructive. I certainly wouldn't, but regular people don't care about spam when it is not a major problem for them.

You would also think they would do some checking to see if their spam sticks. If not what is the point in continuing to spam a site. By taking a little bit of program time to check you can rule out sites that are a waste to spam. Then you can concentrate on spamming sites that will display your spam.

I hate giving spammers useful advice, but this would help everyone including the spammers. If spammers weren't so annoying people would be less likely to delete link spam.

Even if you follow these ideas, I and other spam fighters are still going to go after you if you are a spammer. Don't think this is a way to get off the hook. You know what you are doing is wrong and destructive. The only way spam fighters are going to leave you alone is if you stop spamming.

Update: Rathamahata has some comments on this post from an SEO point of view. He explains why spammers use junk text, it is supposed to trick search engines. I really have doubts that it really helps much since if search engines are looking at adjacent words for link quality they should easily be able to detect that a comment has a subject totally out of place with the rest of the page. Such as Tramdol, penis enlargement, or horney lolitas on a blog about some teenager's school and boyfriend problems.

He also doesn't get the second part of my post. By reducing the insane amount of spam overall there is less need to use throw away campaigns. If spam is not so annoying fewer people would do anything about it. That would make spamming more successful for the long term. Since about the beginning of the month I have had over 300 comment spams on this blog. Blogspot uses nofollow on comments and my blog uses comment moderation. Why continue spamming entire domains where there is no PageRank benefit?

He says that as long as the spammer earns more than it costs they don't care. How much does spam really cost? Near nothing. You can get cheap domains or free subdomains. Spamming software is cheap even if you can't write it yourself. If it wasn't so cheap why would there be so many spammers trying to get rich quick doing it?

Update 2: Read about a group of "Ethical Spammers." Fits in quite nicely with this post though the term is certainly an oxymoron.

Status of the Splogosphere

2005-11-23T10:48:00.000-06:00

SpamFighter has a disappointing post on his work at reporting splogs to Blogger for deletion. He was doing really well for a good while with several thousand per week being deleted. Now he is getting NO results.

He also discusses the changes in splog form since Blogger got serious about spam. He says many sploggers are creating throw away splogs that are never updated again. Maybe Google is happy enough with the slow down that they aren't worried about deleting them anymore.

Spam is not something that can be ignored so I hope Blogger doesn't think they are doing a good enough job with their prevention methods. If you are getting a free list of splogs from a reliable source why not use it? I understand that they can't just trust all splog submissions they get without checking, but after the first ten thousand or so verified splogs you would think they would learn to trust a reporter and put higher weight on his reports.

What I really wonder is how come SplogFighter can do such a good job identifying spam blogs. With all the resources of Google behind them, shouldn't Blogger already be finding and removing these splogs? There shouldn't be any easy splogs left for an outsider to find with automated tools. They should be down to the tough ones that require manual inspection.

Luckily deleting splogs on blogspot is not the only method SpamFighter uses, he also goes after AdSense so still has ways of getting at the spammers. Spammers are often clearly violating AdSense rules so attacking them this way should work on many spammers as long as they keep using AdSense.

Slashdot: Browser Security

2005-11-22T16:43:00.000-06:00

Slashdot has an article on the developers of the major web browsers getting together to work out ways to make users more secure no matter what browser they use. Sounds good to me. I am glad they are all cooperating.

Delete My Spam

2005-11-22T16:07:00.000-06:00

I found some interesting posts over at DeleteMySpam.com on splogs and current spammer themes.

Also interesting was the top ten spam words for July he linked to, seems like spammers don't know how to read.

He also has a post on the effects of buying spamvertised products, and not just the ones you usually hear about. Would someone who spams be ethical enough not to scam buyers?

Comment Spam Scores

2005-11-22T15:16:00.000-06:00

Since turning on comment moderation (November 4) I have now reached 303 comment spams, not counting the few that slipped though the moderation hole. Lately it seems to have been slowing down a bit. It certainly isn't anywhere near stopped yet, but it isn't quite so bad.

Could just be because it is nearing end of semester. Could be due to Thanksgiving this Thursday in the US. Maybe spammers are learning spamming blogspot isn't so easy anymore and they are moving on; probably not since most are dumber than rocks and will never figure that out. Hopefully the lull is due to something new Blogger setup silently, but I doubt it.

They seem to come in waves, but at least for now it is better than the 30+ I was getting on the 14th and 15th and the 20+ on the 9th and 11th. Weekends are normally slow and Tuesday is far from over so maybe I am jumping to conclusions. But I thought I would share the current scores for those posts with 5 or more spams. As you can see there is no apparent pattern to which posts get hit most:

19	Lots of Comments	11/05/2005
16	Google's Spamdexing Service	10/08/2005
15	Casino Online On-Line Spam (part 2)	7/07/2004
10	How Not To Fix The Blogspot Issue	10/26/2005
9	New Spam Fighters	8/30/2005
8	More about BeTheDealer	7/08/2004
8	BeTheDealer and DirectedMarket	7/08/2004
8	Casino Online On-Line (part 3)	7/08/2004
7	Leaving Blogger	10/20/2005
7	Redirect Splogs	9/01/2005
7	Back to the Future II	4/09/2005
7	BTD, Cyprus, and DirectedMarket	7/13/2005
7	Casino-Online-On-Line Spam	7/06/2004
6	Surfing with the Enemy	12/06/2004
6	Nigritude Ultramarine Nuts	6/03/2004
5	Chongqed at O'Reilly	12/03/2004

FBI Email Scam

2005-11-22T14:20:00.000-06:00

There is an email virus going around in emails claiming to be from the FBI. It warns that they have monitored you accessing illegal websites and requires you to answer questions in the attached document. That certainly isn't the way the FBI would go after people, but I am sure it will scare a lot of people into opening the attachment. I hope they have good antivirus software.

See the FBI's press release.

Update: I have also heard that this comes in a CIA version. And here is something pretty similar pretending to be from the BKA (German equivalent of the FBI) with some analysis of the social engineering tactics being used.

Spammer Gets Six Years

2005-11-17T13:59:00.000-06:00

Not directly for spamming, but related to his spamming/scamming business. He was found guilty of fraudulent trading, concealing criminal property, death threats, threats to destroy or damage property, and blackmail.

BBC
ZDNet UK

Antispam Journalist

2005-11-17T13:40:00.000-06:00

Michael Pollitt has been busy with some new splog articles:

Splog wars
Cashing in on Fake Blogs

And because of his articles on PRStorm, a spammer is now planning to use it to spam for Michael's site to prove that it works. Pretty stupid. The spammer just doesn't get it. Of course PRStorm works. We know it works but it is evil and hurts its victims. And once Google finds out, the spammer's sites are going to be removed from Google's index and have their AdSense accounts revoked.

Spammers have done the same or similar to chongqed, SpamHuntress, and other spam fighters.

Interesting Comments

2005-11-17T12:32:00.000-06:00

I got two interesting comments by a spammer recently. In with all the comment spams they were hard to find since they were made anonymously as is much of the spam. They were made on November 10 and I didn't notice them until the 15th. Here are the posts they appear on:

Lots of Comments
Advanced Wiki Spam

Another interesting set was spam telling the truth about what it is:

Nice blog, oop's did I lie? really I didn't even read your blog, To be perfectly honest I have no intention of reading your blog I am only interested in promoting my website, Is this bad? I don't think so , If anything just bad manners. Did you know that without **advertising** you have little chance of selling anything. **advertising**

Posted by Dan at 11/15/2005 05:47:24 PM

I got 12 of that one in 5 minutes on new and old posts. Just bad manners? Well, at least he admits that much. Most spammers try to explain how it doesn't hurt anything or that it actually helps the sites they spam.

Moderation Hole

2005-11-15T01:20:00.000-06:00

Not supprisingly, Google has yet another flawed antispam system. Remember that moderation solution to comment spam they implemented a short while back. Since my last post, I have received about 200 more comments, few if any are legitimate (I haven't checked them all yet).

The problem is about five of them somehow skipped the comment approval system. Out of 200 that is a tiny number, but if this is an exploitable hole rather than just an intermittent bug, the number could greatly increase as spammers catch on.

When first discovered only days after being was implemented, I hoped this was just a momentary bug with Blogger while they were updating. They had just created this feature so I was willing to give them the benefit of the doubt, but it appears this was not a short term problem whatever it is.

I got no moderation email for these few spam comments, so I could not have accidentally approved them. I was also no where near a computer at the times they were posted.

The most recent spammer that appears to have bypassed the system is Doer. Tonight I had four comments by him. Only the fourth was held by the moderation system. Gordon left the same spam comment twice a couple hours before Doer. Those two were properly held for approval.

Their spam:

Hello, just visited your blog, it's informative. I also have a website related togoogle adsense software. So make sure you visit and hope it's useful.

So, is this a hole or an intermittent bug? I have no idea, only Google and Blogger would know and I doubt they would even admit a problem exists. Either way I hope they fix it fast.

Lots of Comments

2005-11-05T10:45:00.000-06:00

It has been less than 20 hours since I turned off Word Verification and turned on Comment Modification. In that time I have had 21 really meaningful comments. Isn't it nice that so many blogger users would visit my blog and comment. The comments are so good I thought I should share them here on the main page:

Texas Seo Expert left a comment on "PF Wiki Passworded":

Very informative blog. I really liked your posts. Please give my website a look if you are interested in small business seo. I hope you find it very useful.

11/05/2005 09:19:30 AM

Texas Seo Expert left a comment on "hukuki.net: Turkish Legal Resources Spammer":

Very informative blog. I really liked your posts. Please give my website a look if you are interested in design engine optimization search. I hope you find it very useful.

11/05/2005 09:14:16 AM

Texas Seo Expert left a comment on "New Spam Fighters":

I like blogs about ppc search engine web marketing. If you are interested in web design related topics such as ppc search engine web marketing

11/05/2005 08:47:46 AM

lovetips2006 left a comment on "Google's Spamdexing Service":

I enjoyed reading your blog. There is a lot of useful information about turnkey website in it. We offer Turnkey Websites and Reliable Hosting. We also provide a blogging service that will help your site get indexed fast and keep the search engines visiting your site. Click here for more information about turnkey website.
Thank you

TWP Admin

11/04/2005 05:21:11 PM

TWPAdmin left a comment on "Google's Spamdexing Service":

I enjoyed reading your blog. There is a lot of useful information about cheap web hosting in it. We offer Turnkey Websites and Reliable Hosting. We also provide a blogging service that will help your site get indexed fast and keep the search engines visiting your site. Click here for more information about cheap web hosting.

Thank you
TWP Admin

11/04/2005 10:23:59 PM

Brian left a comment on "Google's Spamdexing Service":

Hey, you have a great blog here! I'm definitely going to bookmark you!

I have a design design design promotion site site site site tutorial web web web web websiteownerworld.com site/blog. It pretty much covers design design design promotion site site site site tutorial web web web web websiteownerworld.com related stuff.

Come and check it out if you get time :-)

11/05/2005 08:27:15 AM

Texas Seo Expert left a comment on "What is chongqing?":

I like blogs about engine houston optimization search. If you are interested in web design related topics such as engine houston optimization search

11/05/2005 08:23:08 AM

Brian left a comment on "How Not To Fix The Blogspot Issue":

Hey, you have a great blog here! I'm definitely going to bookmark you!

I have a prestonswebhosting.com promotion promotion site web web web site/blog. It pretty much covers prestonswebhosting.com promotion promotion site web web web related stuff.

Come and check it out if you get time :-)

11/05/2005 07:52:53 AM

Texas Seo Expert left a comment on "Wired: Googling the Bottom Line":

Very informative blog. I really liked your posts. Please give my website a look if you are interested in engine optimization placement search. I hope you find it very useful.

11/05/2005 06:44:19 AM

Texas Seo Expert left a comment on "Casino Online On-Line Spam (part 2)":

I like blogs about engine international optimization search. If you are interested in web design related topics such as engine international optimization search

11/05/2005 04:17:00 AM

Pat Martin left a comment on "Email from Hakdata":

Bravo for a well versed post. If you would like to market your blog visit my website for free training on topics such as custom web design and custom web design

11/05/2005 04:14:20 AM

Brian left a comment on "Surfing with the Enemy":

Hey, you have a great blog here! I'm definitely going to bookmark you!

I have a exchange free script traffic site/blog. It pretty much covers exchange free script traffic related stuff.

Come and check it out if you get time :-)

11/05/2005 03:31:11 AM

Brian left a comment on "Nigritude Ultramarine Nuts":

Hey, you have a great blog here! I'm definitely going to bookmark you!

I have a traffic script site/blog. It pretty much covers traffic script related stuff.

Come and check it out if you get time :-)

11/05/2005 01:35:46 AM

Infactahost.com left a comment on "WikiBlackList Blog Stolen":

Hey, you have a great blog here! I'm definitely going to bookmark you!

I have a banner exchange joke surfparrot.com site/blog. It pretty much covers banner exchange joke surfparrot.com related stuff.

Come and check it out if you get time :-)

11/05/2005 01:29:53 AM

Infactahost.com left a comment on "Redirect Splogs":

Hey, you have a great blog here! I'm definitely going to bookmark you!

I have a immediately increase site traffic web site/blog. It pretty much covers immediately increase site traffic web related stuff.

Come and check it out if you get time :-)

11/05/2005 01:21:50 AM

Anonymous left a comment on "Surfing with the Enemy":

GROW IT YOURSELF!

11/05/2005 12:27:04 AM

Greg left a comment on "Nigritude Flag Burning Watch":

Hi, I was searching blogs and came onto your fantastic blog.

I have a niche site. It pretty much covers how make money with auto redirecting methods and example

marketing.

Keep it up. I'll check back later, I'm sure.

11/04/2005 10:28:48 PM

clicking4man left a comment on "Leaving Blogger":

I enjoyed reading your blog. There is a lot of useful information about seo in it. We offer Turnkey Websites and Reliable Hosting. We also provide a blogging service that will help your site get indexed fast and keep the search engines visiting your site. Click here for more information about seo.

Thank you
TWP Admin

11/04/2005 05:25:20 PM

lovetips2006 left a comment on "Leaving Blogger":

I enjoyed reading your blog. There is a lot of useful information about blog service in it. We offer Turnkey Websites and Reliable Hosting. We also provide a blogging service that will help your site get indexed fast and keep the search engines visiting your site. Click here for more information about blog service.

Thank you
TWP Admin

11/04/2005 10:26:09 PM

Anonymous left a comment on "Back to the Future II":

Get your website seen use our internet advertising web site promotion tools to get the word out and take the work out of promotion. Resale rights available. Starting at only $6.99 get 1000's of links to your website http://www.BLGen.net

11/04/2005 09:15:59 PM

Anonymous left a comment on "Wired: Googling the Bottom Line":

Get your website seen use our internet advertising web site promotion tools to get the word out and take the work out of promotion. Resale rights available. Starting at only $6.99 get 1000's of links to your website http://www.BLGen.net

11/04/2005 09:10:08 PM

Anonymous left a comment on "Nigritude Ultramarine Nuts":

Get your website seen use our dedicated promotion server site web tools to get the word out and take the work out of promotion. Resale rights available. Starting at only $6.99 get 1000's of links to your website http://www.BLGen.net

11/04/2005 06:13:41 PM

Anonymous left a comment on "Nigritude Flag Burning Watch":

Get your website seen use our free web site promotion tools to get the word out and take the work out of promotion. Resale rights available. Starting at only $6.99 get 1000's of links to your website http://www.BLGen.net

11/04/2005 06:13:22 PM

Anonymous left a comment on "SFGate: Free iPod -- um, not really":

You can sign up for free ipods here!!

http://premiumipods.freepay.com/?r=21556777

11/04/2005 05:32:33 PM

Bunch of Stuff

2005-11-04T16:37:00.000-06:00

Manni tried to use Google's Blog Search for finding something other than splogs and discovered it's not easy. Mainly what I use it for is finding splogs or new posts about splogs so I had never tried a product related search.

I recently ran across a post about "over advertising" that most sploggers probably missed. It is actually a good read for real bloggers too, especially those who have more ads than content on their blog. And related to that, common mistakes with AdSense.

Tips on writing content might help improve your blog posts. If sploggers were actually writing their own content rather than stealing it, this might help them too.

IslandDave and Keith recently discovered that sploggers are now using that makepovertyhistory.org banner to make their blogs look more legit and block Blogspot's Flag as Objectionable button. Luckily since flagging is basically useless, it isn't hurting anything.

I found this one pretty funny. Not only is it a legitimate poker blog (I didn't think such a thing could exist), he posted about a content thief that is mad that his content is stolen.

Not really what I usually post, but this link appeared in my referrers just now thanks to the Next Blog ring and I had to share it; Hummer Overfloweth.

And finally some interesting search referrers to my blog lately:

how to find editable wiki pages seo spam
automatic wiki spam
addentry spam
free prstorm
prstorm review
spam free sucking girls
pokerbots how they work
spam university
javascript, spam

Blogspot Adds Comment Moderation

2005-11-04T16:16:00.000-06:00

Finally!!!

Blogger Buzz says:

"We've just introduced a frequently-asked for feature, comment moderation. By using this feature, you can approve or reject what would-be commenters are looking to post before it goes live on your blog."

I turned on Comment Moderation and turned off Word Verification for comments on my blog and will see how things go. As we have seen, Word Verification seems buggy, not to mention annoying and inaccessible to visually impaired users. Depending on how bad comment spams get, I may leave it this way. I can more easily catch spammers without polluting my blog comments.

I wonder how many bugs this improvement will introduce.

Update: In the two hours since posting this, I already have five spam comments on posts going back all the way to mid 2004. I assumed spammers were mostly hitting recent posts these days, but I guess not. The online interface for moderating is ok, but not great, you can't tell what post the comment was made on. But you can easily deal with multiple comments at once which is nice. And the email version looks pretty good.

Sony Uses Rootkit For Copy Protection

2005-11-01T00:17:00.000-06:00

Mark of Sysinternals posted one of the scariest Halloween true stories I have ever read. Sony is now installing rootkits on Windows to prevent copying of their CDs.

For those that don't know, a rootkit is software installed at a very low level that allows it to be hidden from the operating system so it can't be removed normally. This is just insane. This is the kind of stuff malware, trojans, and viruses do, not gigantic multinational corporations.

Lucky the little music I get now comes mostly from iTunes. Seems to me that this move will only push the end of CDs. We know the music industry doesn't like that idea, what are they thinking?

Update: Sony has released a "Service Pack" to remove it. They say it is "not malicious and does not compromise security," but how can they be sure it doesn't open up some security hole. Even though it can now be removed this is still wrong.

Update 2: Turns out it was a security problem, it could be used by viruses and other malicious software to hide from scans. Sony halted production of these CDs and a few days later said they would recall them.

Update 3: Sony is now being hit with a bunch of class action suits. Someone setup a blog at sonysuit.com so people can keep up to date on them. And it turns out that a small bit of tape in the right place will prevent the DRM program from being installed.

CAPTCHA Bugs

2005-10-26T15:52:00.000-05:00

I have not experienced the Word Verification CAPTCHA for posting yet, but in commenting I have seen it plenty of times. I don't have any trouble reading the text, but I am still getting them wrong way too often lately. I am not the only one, Diane commented at fightsplog.com that she is having trouble too.

CAPTCHAs certainly aren't all that clear on purpose. They have to distort the text to attempt to defeat automated programs from solving them and allowing the spam through. It is assumed that humans (as long as they aren't visually impaired, which is an even worse problem) should be able to do a better job reading the distorted letters than a computer. Most of the time that is correct, but obviously not always.

I think making the image bigger might be of some help. Maybe get rid of some of the less clear fonts. I have been experimenting with some just now and I can't seem to find one that I can't solve, but this morning I was having trouble. Maybe it wasn't an unclear text problem but a software problem and Blogger fixed it.

Since it is so easy for a human to fail the test, how can they really stop spammers? Some of the images are far easier to solve than others. If a spammer program just keeps trying it will get a simple one it can solve. Hopefully it is enough of a deterrent to make spammers go somewhere else, but it is not fool proof and spammers can be stubborn.

So here are some examples from Blogger's Word Verification. How readable are they?

Anyway, why call it Word Verification? They aren't words.

Another problem with the new system it that bloggers who use external software like w.blogger or BlogJet to post can't post if their blog requires a CAPTCHA. That is something that I am sure will be worked out. The software designers will probably need to give a way for users to see and solve the CAPTCHA. I know people are annoyed by this, but spammers use software to spam so they can't just continue the way things were. Blogger is working on ways for you to become verified after solving the CAPTCHA a number of and likely some other criteria. Be patient. The splog problem on Blogspot was so bad solving it had to be a priority.

Update: Some of the problem with external posting software seems to be a bug that is already being worked on. See the BlogJet blog.

Update 2: Blogger Buzz has some info on what they are doing to fix the external blog editor problems.

How Not To Fix The Blogspot Issue

2005-10-26T04:42:00.000-05:00

Mitch Ratcliffe is promoting solving the splog problem by doing enough AdSense click fraud on blogspot splogs that Goolge takes some action. It seems to me that Google is taking action. I guess Mitch thinks since they haven't instantly solved the problem they aren't doing anything. Google is far from solving the problem, but they are doing something.

Mitch's plan relies on a bunch of people going to splogs and clicking on their ads as a "political action." To Mitch it is not click fraud since it is not their own sites. Not many agree on that. But anyway, it is not going to go very far. Most people not smart enough to realize it is click fraud will be too lazy to take part in any combined effort to punish a tiny portion of sploggers by giving them more ad revenue.

The rest of this post is in reply to Mitch's comments on Toivo's post at FightSplog.com. It got so long I decided to make it a post on its own.

As Toivo mentioned, Mitch appears to be confusing splogs with comment and trackback spam. If you are going to come out with THE solution to spam on the internet you should know what you are talking about and be clear.

Mitch says he want Google to fix Blogspot's spam problem. Blogspot's problem is fake blogs (splogs) setup by spammers to increase the PageRank of their actual sites. Yet Mitch also says:

"Fully 40 percent of my traffic each day is sploggers trying to post to my site—because I restrict the number of comments and trackbacks every few minutes much of the time even the sploggers get shut out, but so do legitimate commenters and trackbacks."

Comment spam and trackback spam don't automatically mean splogs or sploggers. Some sploggers may also send out trackbacks and comment spam, but that is not the real problem of splogs. The problem is splogs are filling up search results with garbage or stolen content making it hard to find what you are looking for. Since splogs are not intended to get good PageRank there is little need to comment spam for them. Splogs are the spam, designed to increase the PageRank of the spammer's main site just like comment spam tries to do.

Splogs are just a new form of spamdexing which has been around for many years and Google is constantly improving their algorithms to filter it out. The problem is that just because Google cleans them out of its index doesn't make them go away. In the case of splogs at Blogspot, Google can actually delete them. But there is nothing stopping spammers from creating splogs on other free hosts or their own sites. It is just convenient for now to create them on Blogspot. Spammers have been creating fake content pages for years. The reason people outside the antispam community finally took notice recently is because a few big name bloggers noticed that their content was being stolen and used for the fake content of splogs.

Most splogs have AdSense ads, but that is just because it is convenient and might make a bit of money from a few human visitors that run across the splog. Any revenue they make from it is nearly 100% profit, so why not? But AdSense is not the point of splogs and if AdSense didn't exist splogs still would with or without advertising from some other company.

Mitch isn't seeing the bigger picture though. ~~Google is making money off of every splog that had AdSense on it, if they shutdown a splog and don't give the spammer the money, where does that money go?~~ What is worse than the AdSense problem, all these splogs and other junk pages are filling the internet with junk. Google is getting good at weeding out that junk from their search results. It is a never ending battle though since spammers keep adapting. Google's competition is much further behind. If users get tired of the spam filled results of other engines that is good for Google. Google has little incentive to actually solve the internet wide splog problem.

But they couldn't solve it even if they wanted to. Google could shutdown AdSense right now and it would have no effect on splogs, comment spam, trackback spam, or referrer spam. Google could also stop using PageRank or any other link based ranking and it would have no effect on web spam either. As long as search engines exist web spam will exist. Other than using their algorithms to filter out sites that are spam there is nothing more Google can do (outside of cleaning up Blogspot).

PRStorm and Google

2005-10-23T17:40:00.000-05:00

And made an interesting discovery since lately our interest in PRStorm/Reffy, one of the worst referrer spam programs around, has been renewed. Michael Pollitt got some info about the new owner. He says he didn't know what he was buying. I still find that hard to believe. Ann has her own comments on the situation.

So while investigating Ann ran across one of Google's many dirty secrets. This one being that even a domain that is removed from Google's search index for being a horrible spammer can buy AdSense ads. This is just one more bit of evidence that Google either looks the other way or isn't trying very hard to stop spammers.

But that is nothing compared to Google's AdSense spamdexing service where they provide the spam for you.

It seems Google's motto has changed to "Don't be evil (unless it makes lots of money)."

Advanced Wiki Spam

2005-10-22T22:09:00.000-05:00

Today the chongqed wiki had the first big spam attack in a long time. Actually I had even been missing the small time spammers attempts until yesterday.

RichardP and I both noticed the spam attack about the same time. As I went to lock the wiki, he set WikiMinion cleaning. Turns out all I blocked was WikiMinion, the spammer had already moved on.

When I got around to looking at the attack more carefully I realized this spammer's program is more advanced than usual. Most of the pages spammed were newly created by him. But he was not just making up random page names or using his own keywords like most wiki spammers do. Every new page name he used was on topic for our wiki.

The secret is that each of those page names had been linked to from one of our pages. Some were spelling mistakes, many are just automatic CamelCase links, others were links expecting to later become pages but never did. He had to have crawled a large portion of the site to come up with all these page names.

When I first saw only a couple edits at the top of the page and the new page names seemed on topic I briefly wondered if we had a new contributor. Scrolling down a bit solved that quickly. That is kind of sneaky, but not really effective especially since he over did it (22 spams). It would only work on an abandoned wiki where you can makeup any page names you want. So good job on making spamming advances in an area that doesn't matter.

But the spamming software and its designer were also pretty stupid. He thought he was being smart by hiding his edits by making another edit (from a different IP address) blanking the page while logged in as if he was a legit user cleaning up the spam. Pretty sneaky if it wasn't so retarded, apparently he missed the spammer classes on meta nofollow, noindex. Older revisions don't show up in search engines and thus do spammers no good on modern wikis.

And he also is trying to hide his spam with the CSSHiddenSpam trick which doesn't work on our kind of wiki.

Here is the spam (including tabs):


 <div id="wikitikitavi" style="overflow:auto; height: 1px; ">
 [[http://WTHP1.coolhost.biz] [WTHPD1]]
 [http://WTHP2.coolhost.biz  WTHPD2]
 [[http://WTHP3.coolhost.biz | WTHPD3]]
 [http://WTHP4.coolhost.biz | WTHPD4]
 [WTHPD5 | http://WTHP5.coolhost.biz]
 [[http://WTHP6.coolhost.biz WTHPD6]]
 </div>

As you can see, he also has missed the concept of keywords. But I needed something for the database and WTHP doesn't seem that important of a keyword. So looking at his site I choose to chongq him for DVD.

I am glad he hit us because now he is in our blacklist where he belongs. According to Google, there are already 151,000 pages that have "coolhost.biz" on them. He has been busy.

If this is advanced wiki spam, I say keep up the good work idiots!

Email Scammers

2005-10-21T14:21:00.000-05:00

I found on Slashdot an article about some Nigerian 419 email scammers at the LA Times titled "I Will Eat Your Dollars."

In other Nigerian news, InformationWeek reports Nigeria To Outlaw E-Mail Spamming. I am sure that will solve the problem.

Blogger Hacks

2005-10-21T00:19:00.000-05:00

BlogFresh is just full of great stuff, especially their series on Blogger hacks.

Blogger Templates has a bunch of new Template designs for use with Blogger. And in their sidebar they have a few good hacks to improve your blog like the ability to Edit Comments and show a Previous Post link.

Browservulsel has lots of useful hacks, especially if you are a Greasemonkey user.

This one isn't a hack, but you probably don't know about it. You can now get backlinks for your blog. They are done with Javascript and come from Google's Blog Search so the usual fake trackback and referrer spam won't be a problem. See Blogger's page on using them.

Halloween Music

2005-10-20T16:30:00.000-05:00

For years I had looked for good spooky music for Halloween. Most of the stuff you find in stores has too many odd sound effects or is Monster Mash type stuff. I just want creepy background music.

A few years ago I finally found one I liked and have been using every year since. It is called Pumpkinland. Now there are two sequels. From the samples of the sequels I think I still like the first one best, but the others are good too.

The title track of the first CD is my favorite. It and Creature often alternate most of Halloween night. Pumpkinland 2 and Creep from the second CD sound pretty good too so I think I am going to have to order that so I can have a bit more variation.

The other tracks on the first two are good, but not quite what I am looking for. The third CD is heading further away from what I want, but it might be just what you are looking for.

You can hear all the samples at 13th Track Halloween Radio.

Leaving Blogger

2005-10-20T16:05:00.000-05:00

I am not leaving, but that is what some of those affected by yesterday's Word Verification (CAPTCHA) problems have been saying. So what? Blogger isn't really going to be hurt if a few of you stop using their FREE service. This was a bug that was fixed relatively quickly. Get over it.

Blogger may not be the best blog host, but it is a pretty good one. It has its problems, but what service doesn't? Hosting your own blog would always give you far more control and options since you can have many choices of blog software. But then you have to worry about upgrades and constant referrer spam attacks. And it isn't free. Hosting your own blog is a good thing for many people, but it is not for everyone.

Some complaints have said that Google is worse than Microsoft. Microsoft has done far worst to its customers. Not being able to blog for a day is much less critical than missing your email which Hotmail occasionally has trouble with, sometimes for longer periods than this. No online service is working 100% of the time and bug free.

If you are getting a CAPTCHA before posting, Blogger is not censoring you or saying you are running a splog. They know some innocent blogs are getting them and are working to reduce the number affected. The system is automated and will never be perfect. That is why they use the CAPTCHA rather than just blocking the posting. Read my post from yesterday that mentions some reasons why your blog might have this problem and possibly ways to work around them.

While I don't like CAPTCHAs because they are annoying and inaccessable to the visually impared, this is a good thing for the Blogger service. I don't want to have my blog on a service that is so full of splogs that no one takes anyone here seriously. If Blogger didn't start doing something radical that would happen real soon. This was a good step in reducing the problem, but I hope they have a lot more planned because Blogger's splog problem is far from solved.

Blogger has posted more information on their fix here.

Blogger Bugs Me

2005-10-19T13:39:00.000-05:00

There are a few things that have bugged me about blogger for a long time. And this post isn't even about all their poor spam prevention.

First and most stupid, why can't they add a couple words to the spell checker dictionary. Words like Google, Blogger, Blogspot, and even blog keep coming up as misspelled. The Learn button seems to do nothing, I have hit it quite a few times on those words.

The second one is more annoying for readers of my blog. Sometimes, for no reason, my blogs Atom feed switches to the short version. I would rather let readers read the whole posts in their feed reader. Just republishing again usually fixes that, but I can only fix it if I notice.

Third is, the frequency publishing my blog posts comes up with an error. How hard is it to update some files? Republish Entire Blog is even worse. That often doesn't work on the first, second, or third try. My blog isn't even really that big. I can't imagine how much trouble those with tons of posts must have.

And how about fixing the Manage Posts page for Firefox. At least 80% of the time I go to that page it loads ok and then the blue Edit buttons grows to take up most of each row. That is not very usable. You can only read a word or two from the post's title. How am I supposed to manage anything that way. Sometimes if I refresh the page enough it will work right eventually.

And last, I guess is kind of spam related. Allow us to delete multiple comments easier. If a spammer or wacko comment bombs me I want be able to wipe them out in one quick action. The current method is ok for deleting one or two comments, but when you have 50 comments across multiple posts it would be a pain to cleanup.

Ok, so that wasn't the last one. How about preventing people from comment bombing? It shouldn't be hard to tell something is wrong when someone is posting more than a couple comments in short period.

Wow, this post just keeps going. How about a way to mark comments as spam and help prevent other blogspot users from being spammed by the same comment? That seems like something technology borrowed from Gmail might be able to accomplish.

CAPTCHA Trouble

2005-10-19T00:04:00.000-05:00

This is a test of the emergency blogcast system. This is only a test. In the event of a real emergency you would not be able to post to your blog.

Oh wait, it seems we are in a splog emergency, maybe this is not a test. Some people aren't able to post to their blogs. There seems to be trouble with Blogger's new splog solution. Splogger, oops, I mean Blogger, decided that for blogs it thinks are sploggy it will pop up a CAPTCHA (Word Verification) before allowing the blog owner to post. Now maybe that isn't such a bad idea if you can live with the fact that CAPTCHAs are not accessible to the visually impaired, but there seems to be a bug.

A number of people have posted in SplogFighter's comments that even once they have entered the correct word they still can't post to their blog. Some of those blogs look awful spammy to me, but the CAPTCHAs should work.

Anyway, didn't Blogger say yesterday that CAPTCHAs were not the answer?

I can think of a few ways blogs can be used that would look quite spammy. Some use a separate blog as a place to dump interesting links rather than their main blog. Some entire blogs are mostly links and a couple comments about them. That can look pretty spammy especially if you link to the same sites over and over. In that case your blog may look spammy to whatever method they are using to detect spam, including human review. Hopefully any humans Blogger has in the review process are at least as experienced identifying splogs as us antispammers, but who knows.

My suggestion is to do something to make your blog stand out from the splogs. Take a look at some splogs and you will notice what characteristics your blog shares with them. Perhaps like mine, you have a sidebar full of junk linking to a small number of sites. It could also be the overloading of AdSense. If you have more ads than content you probably are running a splog, or at least it looks like you are.

Well, since my blog has many spammy characteristics, lets see if I can post this without seeing a CAPTCHA.

Update: I was lucky, no CAPTCHA.

Update 2: Blogger has updated the post announcing this new feature admitting there is trouble for some users. They plan to have a fix shortly.

Update 3: It appears it is fixed now.

Comment Spam

2005-10-18T08:52:00.000-05:00

Since I post a lot of links to FightSplog I wanted to point out something since some visitors to that blog are concerned by the amount of comment spams. He purposely does not clean spam from his comments.

I don't either, but I use Blogger's Word Verification CAPTCHA that cuts down on most spam. He doesn't believe using them. I think they are bad too, but I would rather not have my comments overloaded with garbage.

Spamming antispam blogs is pretty stupid and we like to point that out by example. Any spammer who is expecting PageRank from comment spamming Blogspot has no clue what they are doing. Blogspot uses nofollow tags on links in comments.

But of course, spammer stupidity was an expected limitation of nofollow's usefulness. I was excited when it was first announced, but quickly realized it wasn't really going to solve anything. Spammers are too stupid and lazy to care.

But for a normal blog you should not leave spam comments even though they aren't benifiting the spammer. Spam attracts spam, so if you don't clean the little you get now you are going to get a lot later.

Blogger: On Spam

2005-10-18T08:21:00.000-05:00

Blogger has solved the splog problem! They posted to their blog about splogs. Now they can move on to ignoring them again.

Basically it says, yeah its a problem and we will see if we can do something about it, but its not our fault. And just like most spam friendly hosts, they emphasise that "even if spam were completely solved on Blog*Spot, there would still be a problem." So what? Do your part! Being the top search engine and a major blog host, that part should be pretty big.

Well, their post did list one thing they are actually doing, they are now going to be offering a list of deleted subdomains, which has been asked for by many. But isn't the solution to prevent them from being created in the first place?

FightSplog has some comments which at least for the moment the top post linked to in that post's "Links to this post."

Chris Pirillo also made it to that list with his 10 suggestions for Google. But don't forget FightSplog made some of the same ones last month.

Update: This post made it to the top of that list for a bit too. So looking at the list more carefully, it is done using Javascript and some server side stuff. They are just backlinks, nothing special. I assumed there would be more people who posted about this "announcement" so the list would be longer if it was just backlinks, but apparently not at the time I read it.

Anyway, this method of listing backlinks is interesting. It should be relatively spam proof since the backlinks come from Google's Blog Search. It is available for all Blogspot users, you just have to turn it on.

WP-TEMPLATEOFTHE.N SITTINGBOURNE

2005-10-17T20:06:00.000-05:00

Yesterday I noticed an odd charge on my credit card bill. It was listed as WP-TEMPLATEOFTHE.N SITTINGBOURNE for $8.27. After a little Googling, the only hit I found lead me to a few other people that got the same charge.

One of them figured out that there is a company that sells "web design templates" that goes by the name "Template Of The Net" located in Sittingbourne, Kent. And it just happens that you can get 2,000+ Templates for $8.27.

I did not buy a web template and have never heard of Template Of The Net before. Anyone that knows me would be able to tell that I don't need to buy a template to build a webpage.

I do use my credit card online, but mostly only at large trustworty sites. About a month before this charge I did purchace a screen saver online from a smaller company that I don't know much about. I am not accusing the screen saver company (that is why I didn't name them), but wondering if any others who have had this problem also bought a screen saver recently. The site looks totally legit and has lots of users and a forum run by fans on a seperate site so I may be barking up the wrong tree. But other than that I don't have a clue.

I use Firefox and am careful what I download so I don't believe it is was from spyware. I don't run SpyBot often because I never find anything on my machine, but just in case I ran it just now. Guess what, nothing.

I also used that credit card at a couple of cheep motels a bit further back. Could be an employee got the numbers back then.

Watch your credit card bills, even for small charges. My credit card company took the charge off my account with no problems. And I canceled the card right away. From now on I am only using my other very low limit card on websites I don't know enough about.

Splog Sunday

2005-10-17T18:26:00.000-05:00

SplogFighter has another great post on the splog situation. It seems the reason we are suddenly hearing from lots of high profile bloggers is because of one spammer who went nuts creating splogs and spamming on Sunday. According to SpamFighter, that spammer alone created three times the usual daily number of splogs in one day.

IceRocket vs. Google Splogs

2005-10-17T11:06:00.000-05:00

Thanks to Google's (almost non-existant) efforts to stop spam on Blogspot.com, IceRocket has temporarily stopped indexing blogs on Blogspot. Last night Mark Cuban said this is because some spammer just started using a script that "could easily turn into 10s of THOUSANDS of blogs pinging out millions of posts!" It seems that Blogger should be able to easily filter these out before being created.

Isn't it nice to have your blog on a service so full of crap.

I ran across this news from FightSplog.com. He also points out that major bloggers are getting after Google for the splog problem again. Splog news seemed to die down for a bit and then so did Google's minimal efforts to prevent them. So now people are noticing the huge splog problem again.

The other FightSplog, like me, is a victim of being hosted on Blogspot. He has been reporting tons of splogs to Google and has some observations. Google does not appear to be removing splogs on their own anymore. They will usually clean them if someone sends in a report or maybe if enough people flag a splog. But if they have any tools to find and remove splogs they aren't working.

After saying some bad stuff about Blogspot, Chirs Pirillo of Lockergnome actually got a response from Google. Somehow he expects we will see results on this real soon.

But as I have posted about before, why would Google want to solve the splog problem anyway. All they need to do is not rank them high in their search index and let all the other search engines deal with them. Any search engine that can't handle the huge amount of spamdexing crap will drive away users. And where they will go for searches next, to the biggest supporter of splogs, Google.

Update 5:20pm: It seems that IceRocket's block of Blogspot didn't last very long. This post is now in IceRocket's index. I think they should have left it on for a bit. Google/Blogspot's splog problem needs more publicity.

FBI Raids Spammer

2005-10-16T17:05:00.000-05:00

Slashdot posted that the FBI raided the home of a spam king and seized equipment. It appears the warrant is based on the CAN-SPAM act. Maybe it isn't as useless as it seemed. But Ralsky's lawyer claims he complied with laws and they have never been interpreted by any courts. A good ruling here could really give CAN-SPAM some backbone. It will never stop spam, but at least it restricts what spammers can do legally.

If you read the Slashdot comments you will see why spam is such a big problem. About half the comments are supportive of this. But the other half is for any number of reasons not against spammers. Some think that think the FBI is wasting its time going after just one spammer. Others think that they shouldn't be going after spammers at all.

Then there are those who whine that it is the buyer's fault for supporting the spammers. That is true, but we know that isn't going to stop. The return on spam is already very low, but since sending spam is so cheap even a few sales can make a profit. Blaming the buyers is not going to solve anything. I wish they would be smart enough not to, but it isn't their fault they are stupid.

Some even think there is nothing wrong with spam. One said he doesn't get much spam at all but admitted he uses two spam filters. Just because you don't see it doesn't mean you aren't getting it. It is a waste of bandwidth and a waste of time for those who don't have good spam filters.

If half the audience of Slashdot thinks spam is not a real problem, how is it ever going to be solved? These are the more technology literate people that should be able to see the problem.

Spyware Illegal Trespass

2005-10-14T18:06:00.000-05:00

USA Today has a story about about laws finally catching up with spyware:

"A federal trial court in Chicago has ruled recently that the ancient legal doctrine of trespass to chattels (meaning trespass to personal property) applies to the interference caused to home computers by spyware. Information technology has advanced at warp speed with the law struggling to keep up, and this is an example of a court needing to use historical legal theories to grapple with new and previously unforeseen contexts in Cyberspace."

Read the rest at USA Today.

Hopefully laws against link spam will be next. I doubt it will stop the spam since the wonderful CAN-SPAM act was useless for stopping email spam, but at least then spammers won't be able to keep claiming their crap is not clearly illegal.

Google's Spamdexing Service

2005-10-08T11:17:00.000-05:00

You would think Google is fighting spam any way possible. Well, as Splog Fighter has pointed out, that may not be true. They appear to only fight spam really hard when it isn't making them lots of money.

The worst example of this is their AdSense for domains service. There they will set you up with the usual spamdexing ad page to "maximize revenue on parked pages." Their page even shows you a nice example screen shot of the spamdexing page they will provide. It looks just like the small (or fake) search engines many spammers setup.

The requirements for the service include that your parked domain must get at least 750,000 page views per month. Seems like that should be an oxymoron, parked domain and 750,000 page views just can't go together right? Well apparently they do for the "over 3 million domain names" powered by Google's spamdexing service.

Google has little incentive to fix the spam problem which we now know they support in multiple ways. They just have to deal with better than the other search engines. That way people will get tired of spam filled search results and turn to the only alternative, the Google monopoly.

I admit, I like Google and many of their services, but I think their "Don't be evil" motto may be slipping. How can running a spamdexing service not be evil? How can supporting spammers with AdSense not be evil? And isn't promoting domain parking evil in the first place?

I don't think that Google is going to stop their spamdexing service any time soon, but people should know about it. Most of their revenue comes from ads and it seems likely a large portion of that is generated by spammers. The only chance this will go away is if advertisers realize too many of their ad impressions are comming from junk pages. I wouldn't want to advertise a legitimate business on a junk parked page full of ads. The problem is many people don't understand that these kind of pages are junk.

I have to thank Ralph for pointing out the parked domain service in the comments on Splog Fighter's recommendations for Google.

Now, if my blog disappears suddenly, you know what probably happened. I doubt Google would do it, but just in case, chongqed.org would let you know where I end up.

AntiSpam Splog

2005-10-08T01:55:00.000-05:00

Through Blogshares I ran across a new incomming link to my blog. The name was BlogSpam which I didn't recognize so I figured someone new getting into the fight.

There were lots of antispam and blog related posts. But as I got further down the page some of the posts looked a little odd. By the time I found the link to me I knew what was going on. This antispam blog was built by grabing posts from real spam fighter's RSS feeds.

Going back to the top to flag it I noticed the subtitle of the blog, "I set this blog up to prove that automatically created blogs DON'T have to be useless." Other than to "prove" that, I don't see any purpose of the blog. No sites appeared to be linked to an unusual number of times. I guess that avoids the splog definition. But just because it is not posting spam doesn't mean it is not useless.

So, do I think there are really any legitimate blog syndication sites? Not really. I can think of one or two more established antispam syndication sites that are more legitimate than this almost splog. But I could do without them. I guess they help get the posts seen by more people, but viewers can be confused where the posts really come from.

But in those cases the authors give permission to the syndicating site. This BlogSpam site does not ask for permission to steal people's posts.

Online Serenity Preview

2005-10-07T20:29:00.000-05:00

For those I haven't yet convinced to go see Serenity, you can now watch the first nine minutes online. It is a very interesting opening, but it is more traditional Sci-Fi than the rest of Serenity. It doesn't get you into the grity Firefly universe which is what I like, but it sets up the rest of the movie really well.

Yahoo Movies currently ranks Serenity as the number one movie in theaters.

Go see Serenity this weekend!

More Serenity

2005-10-03T19:56:00.000-05:00

I saw Serenity again Sunday. I can't believe how good this movie is. The friend I went with didn't know anything about Firefly and hadn't paid attention to the previews. I didn't tell him I knew anything about it already. I wanted to see his reaction not having any preconceived ideas; a movie based on a canceled TV series wouldn't normally be a good sign. He really liked it.

I didn't realize how good the space action was until the second time I saw it. The camera movement especially during the battle is amazing. It really gets you into the action. I knew it was good before, but to keep me on the edge of my seat the second time it was really good. It is very exciting.

For the opening weekend Serenity didn't do great in overall box office, but per screen it did better than the number one movie. It just wasn't on a lot of screens. It has gotten a lot of good reviews.

I hope to see it again soon.