Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I fairly often happen across forums spammed with messages such as:

Arugula (Eruca sativa) is an quarterly green, pretended or roquette. It's been Traditional times, overclever 20 flat has be useful to "foodie" movement.Before impediment 1990s, thrill was norm harvested foreign wild. Colour has naturalized reactionary world, on top of everything elseloftier Europe addition North America. Arugula is all round Mediterranean region, wean away from Morocco and Portugal, eastern Lebanon plus Turkey. Roughly India, adult seeds are songeffortless Gargeer. Solvent is scour (Brassicaceae) family, rod is quite a distance rocket, which is public ...

What is the purpose behind such spam? It's annoying, yes, but one assumes that the spammer has some purpose other than to simply annoy to go to the effort of doing this. I don't see any URLs or hot links in the message, and no apparent "funny" formatting that might exploit something.

Is this somehow trying to influence web crawlers? (And, if so, to what purpose?) Does it somehow exploit some sort of weakness in the forum software? What?

Added: Not really related to the original question -- more of a tangential comment, but I thought it would be worthwhile to keep it in the same place, in case someone else comes looking:

The nature of the "strange" posts on the forum I'm mainly thinking about (http://forums.finehomebuilding.com/) has largely changed. What we get now (once/twice a week) are posts that parrot details from previous posts in the thread (often a very old thread), or perhaps details gained from a web search on the thread's topic, but they are generally pointless (at best a "me too" nature) and the English, while technically proper, is a hair stilted and clearly not that of an English speaker (neither British, American, Indian, nor African, all of whose dialects I'm at least passingly familiar with).

My best guess is that these are people, probably in China, who are learning English and are using the forum as a sort of test, to see if their post goes undetected. I don't know, however, if this is simply a game, a test for an English class, or a test/practice for a wannabe spammer. (It's unlikely that they're trying to "curry favor" with the spam filter, as the thing ("Mollom") is notoriously flaky and happily lets spam through on the first try while rejecting legitimate posts.)

But wait -- there's more!!

For about the past year the forum of which I speak has been regularly (at least weekly, and sometimes several times a day -- twice so far this morning) bombarded with posts such as:

Kitchen Units For Sale. Thirty Ex Display Kitchens To Clear. www. e x d i s p l a y k i t c h e n s 1 .co.uk £ 595 Each with appliances.

(URL slightly corrupted so as to not encourage these folks.)

Apparently this is a major spammer operating out of Europe (and our forum is about 99% US-oriented), so it's pointless at best. The oddest thing is that the constant spamming has apparently "poisoned" the URL for Google (and likely other search engines) such that you have to pretty much spell out the URL to get a "hit".

(The other odd thing, of course, is that the system operators seem incapable of blocking this, even though the URL is always the same.)

Another question --

Since, as I observed earlier, the "kitchen spam" posts (seen on dozens of other BBs as well) have apparently "poisoned" the associated web site for Google, is it possible that the spam is actually intending to do this, and is instigated by someone (a competitor?) who wishes ill for that web site?

share|improve this question
1  
I wouldn't try to make sense of forum spam, I've seen some which would make a great sales pitch and not say what they were saying or provide a link of any sort. –  Inverted Llama Mar 11 '12 at 8:53

3 Answers 3

up vote 70 down vote accepted
+50

They are trying to do Bayesian poisoning.

By sending lots of correct words and a few words which are used in spam, like viagra, those words get a lower spam notification (over time).

This means that after a while they can get real spam with links through to the filter.

share|improve this answer
2  
Wow, that's actually a clever move. –  ChrisR Nov 20 '13 at 23:53

My observations are that this sort of spam has been the first few posts of a newly created user. After a few of this sort, the normal sort with links included start up.

My guesses as to the purpose are:

  1. Fooling anti-spam software that concentrates on first posts.
  2. Getting the first ten posts out of the way so they can post links. Some forum software enforces this.
  3. Search engine keyword stuffing. I don't see any obvious keywords in your sample but I have in the forums I run.
share|improve this answer
1  
Here are the words related to cannabis in the post: sativa, green, thrill, harvest, Morocco, seed, natural[ized] –  Antoine Lecaille Nov 10 '13 at 16:51

The post might rank well for a certain keyword in Google. A few days after the post is written the author can add a link to the signature of the account.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.