184

Fairly frequently, the contact form on my blog gets comments that look similar to this (each field represents a text box users can enter into the HTML form on the blog):

Name: 'ceguvzori'
Email: 'gwizwo@avbhdu.com'
Website: 'QrSkUPWK'
Comment: 

vaB5LN <a href="http://pepddqfgpcwe.com/">pepddqfgpcwe</a>, 
[url=http://hvyhfrijavkm.com/]hvyhfrijavkm[/url], 
[link=http://cwiolknjxdry.com/]cwiolknjxdry[/link], http://ubcxqsgqwtza.com/

I'd consider them to be spam, but the sites they link to don't exist, so they aren't helping SEO or spreading malicious links. Not even the email host, avbhdu.com, exists. What is the purpose of these comments?

Improve this question
2
  • 2
    We get similar requests to join a wiki. The content would never be displayed publicly, but that doesn't stop them trying :-(
    – Mark Hurd
    Apr 29, 2014 at 15:41
  • 1
    I've come across a German newspaper article on intelligence services that described how parties arrange appointments on blog comment sections for "anonymous" and inconspicuous communication.
    – Aliakbar Ahmadi
    Sep 23, 2015 at 12:15

3 Answers 3

Reset to default
226

They're probing your site. First, whether the comment will be published. Second, note how they use several popular syntaxes for links - it's an attempt to check which of them will result in an actual HTML link. If your site lets those posts through, expect more spam, this time more malicious.

Improve this answer
9
  • 3
    Highly interesting concept, this "probing". I, too, wondered over comments like this. It makes so much sense now, thank you!
    – F.P
    Apr 29, 2014 at 14:30
  • 13
    But what is the point? It seems like it is never more likely to get through on a future attempt then on the first attempt, so why not just put the real payload in on the first time?
    – jjanes
    Apr 29, 2014 at 15:23
  • 59
    @jjanes: They might just be building a database to later be able to offer their clients "Guaranteed 50000 different blog site entries" or so.
    – PlasmaHH
    Apr 29, 2014 at 15:44
  • 11
    @jjanes The problem with dropping the payload first without checking the waters is that if it gets caught in a honeypot they whole domain can be thrown away for being worthless
    – Danejir
    May 1, 2014 at 13:33
  • 1
    Great question, and a great answer. I didn't know spammer got as sophisticated that days. It's something even more about it: such gibberish is much easier to spot than regular spam, so if it stuck on any page, it means it's practically not moderated, maybe even abandoned, and makes a perfect target for spamming.
    – Danubian Sailor
    May 2, 2014 at 14:57
63

Many spam filters use Bayesian analysis to determine what is spam and what isn't. These work by comparing inbound content with "known good" and/or "known bad" examples and looking for similarities. By slowly increasing the amount of junk in the "good" pile, an attacker can lower the effectiveness of the filter.

Improve this answer
31

They are trying to confuse any automatic spam filters you might be using.

Random strings are unlikely to trigger any blacklist-based filter, and when you are using a self-learning filter, these strings will train it with garbage-data, which can only reduce its efficiency.

Improve this answer
7
  • 14
    This type of garbage content actually could be easily detected by a specifically adapted filter - counting letter n-grams (pairs/triplets/quads) is simple&quick; reference frequencies for english or other languages are available, and such garbage really stands out from "normal text" like "correct horse battery staple". There are nlp libraries available for most programming languages that do that out of the box. A side effect is that it'll also classify comments in, say, chinese or russian as garbage; which may be a good or bad thing depending on your audience.
    – Peteris
    Apr 29, 2014 at 13:29
  • 8
    @Peteris - love the xkcd reference!
    – Floris
    Apr 30, 2014 at 14:53
  • @Peteris You'd need to be careful of legitimate random looking links such as are typical of URL shortening services. Refusing links to non-existent domains might be more useful.
    – mc0e
    May 4, 2014 at 13:35
  • @mc0e - most posts will have some nonlanguage gibberish - typos, weird proper names, url content. Shortened URLs will be just a small part of a post (as they're very short) - if the post has any other meanningful content, then that will overwhelm that gibberish; but if everything else is gibberish as well, then it would be safe to discard that.
    – Peteris
    May 4, 2014 at 13:44
  • @Peteris I've seen plenty of comment spam along the lines of what the OP asked about, which has very little non-gibberish (you could choose to infer that it's a partial example, but you'd only sometimes be right). Maybe the url and link tags are useful, but they're probably not enough for most bayesian tools to work with. You could build a bayesian classifier with this in mind, making it aware of non alphanumeric tokens, and using n-grams of tokens as the basis of its classification, and maybe it'd be worthwhile.
    – mc0e
    May 4, 2014 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.