Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Fairly frequently, the contact form on my blog gets comments that look similar to this (each field represents a text box users can enter into the HTML form on the blog):

Name: 'ceguvzori'
Email: 'gwizwo@avbhdu.com'
Website: 'QrSkUPWK'
Comment:

vaB5LN <a href="http://pepddqfgpcwe.com/">pepddqfgpcwe</a>, 
[url=http://hvyhfrijavkm.com/]hvyhfrijavkm[/url], 
[link=http://cwiolknjxdry.com/]cwiolknjxdry[/link], http://ubcxqsgqwtza.com/

I'd consider them to be spam, but the sites they link to don't exist, so they aren't helping SEO or spreading malicious links. Not even the email host, avbhdu.com, exists. What is the purpose of these comments?

share|improve this question
2  
We get similar requests to join a wiki. The content would never be displayed publicly, but that doesn't stop them trying :-( –  Mark Hurd Apr 29 at 15:41

3 Answers 3

up vote 191 down vote accepted

They're probing your site. First, whether the comment will be published. Second, note how they use several popular syntaxes for links - it's an attempt to check which of them will result in an actual HTML link. If your site lets those posts through, expect more spam, this time more malicious.

share|improve this answer
2  
Highly interesting concept, this "probing". I, too, wondered over comments like this. It makes so much sense now, thank you! –  Florian Peschka Apr 29 at 14:30
10  
But what is the point? It seems like it is never more likely to get through on a future attempt then on the first attempt, so why not just put the real payload in on the first time? –  jjanes Apr 29 at 15:23
48  
@jjanes: They might just be building a database to later be able to offer their clients "Guaranteed 50000 different blog site entries" or so. –  PlasmaHH Apr 29 at 15:44
8  
@jjanes The problem with dropping the payload first without checking the waters is that if it gets caught in a honeypot they whole domain can be thrown away for being worthless –  Danejir May 1 at 13:33
1  
Great question, and a great answer. I didn't know spammer got as sophisticated that days. It's something even more about it: such gibberish is much easier to spot than regular spam, so if it stuck on any page, it means it's practically not moderated, maybe even abandoned, and makes a perfect target for spamming. –  РСТȢѸФХѾЦЧШЩЪЫЬѢѤЮѦѪѨѬѠѺѮѰѲѴ May 2 at 14:57

Many spam filters use Bayesian analysis to determine what is spam and what isn't. These work by comparing inbound content with "known good" and/or "known bad" examples and looking for similarities. By slowly increasing the amount of junk in the "good" pile, an attacker can lower the effectiveness of the filter.

share|improve this answer

They are trying to confuse any automatic spam filters you might be using.

Random strings are unlikely to trigger any blacklist-based filter, and when you are using a self-learning filter, these strings will train it with garbage-data, which can only reduce its efficiency.

share|improve this answer
14  
This type of garbage content actually could be easily detected by a specifically adapted filter - counting letter n-grams (pairs/triplets/quads) is simple&quick; reference frequencies for english or other languages are available, and such garbage really stands out from "normal text" like "correct horse battery staple". There are nlp libraries available for most programming languages that do that out of the box. A side effect is that it'll also classify comments in, say, chinese or russian as garbage; which may be a good or bad thing depending on your audience. –  Peteris Apr 29 at 13:29
8  
@Peteris - love the xkcd reference! –  Floris Apr 30 at 14:53
    
@Peteris You'd need to be careful of legitimate random looking links such as are typical of URL shortening services. Refusing links to non-existent domains might be more useful. –  mc0e May 4 at 13:35
    
@mc0e - most posts will have some nonlanguage gibberish - typos, weird proper names, url content. Shortened URLs will be just a small part of a post (as they're very short) - if the post has any other meanningful content, then that will overwhelm that gibberish; but if everything else is gibberish as well, then it would be safe to discard that. –  Peteris May 4 at 13:44
    
@Peteris I've seen plenty of comment spam along the lines of what the OP asked about, which has very little non-gibberish (you could choose to infer that it's a partial example, but you'd only sometimes be right). Maybe the url and link tags are useful, but they're probably not enough for most bayesian tools to work with. You could build a bayesian classifier with this in mind, making it aware of non alphanumeric tokens, and using n-grams of tokens as the basis of its classification, and maybe it'd be worthwhile. –  mc0e May 4 at 15:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.