For years, we've been receiving messages through our contact form in the following format:
2BLgIr <a href="http://aixfhxcynapd.com/">aixfhxcynapd</a>, [url=http://kfsriuqfsuer.com/]kfsriuqfsuer[/url], [link=http://lyiusjazrqvl.com/]lyiusjazrqvl[/link], http://hfxsdwgylvpa.com/
The contact form is a basic HTML with no anti-robot measures whatsoever (we want to maximize user-friendliness here; we don't believe we should make people who are looking for support jump through any additional hoops).
We have, over the years, received many a hundreds (thousands? we didn't count them) messages like the above. All of them follow the exact same format, string lengths may vary a bit, but other than that, format stays the same.
I've always thought that these messages send to see if a system is vulnerable for something. The URLs point to non-existing domains, so they can't check to see if any of the links get clicked. So, I thought it most likely they are checking our website to see if the unique random strings show up so that they then know that they can post spam messages or something close to that. But it doesn't make sense: if you want to post spam links, why not just post the spam directly and be done with it?
I searched online, found: What is the purpose of "gibberish" comments posted to my blog? and decided to start monitoring our traffic log files.
We have been monitoring for a month now, and the IP numbers that post those messages don't come back for anything else. From what we can tell, this is a fire-and-forget script (unless it is part of a larger bot-net of course; but it seems inefficient to delegate the checking to another node?). Also, as pointed out before, we have been receiving those message for years, so I would expect the system sending those messages to have learned that they have a 0% success rate by now...
Does anyone know anything more about those messages? Are they generated by a known bot-net? Are they generated by some sort of spam tool/package?