Comments on: five-digit spam

Question: five-digit spam

languagehat — Fri, 18 Nov 2005 12:50:12 -0800

Does anybody have any idea what's going on with this kind of comment spam? I'm getting scads of it, with no URLs but always a mention of a five-figure number. "I've managed to save up roughly $55085 in my bank account, but I'm not sure if I should buy a house or not. Do you think the market is stable or do you think that home prices will decrease by a lot?"

By: Mo Nickels

Mo Nickels — Fri, 18 Nov 2005 12:57:32 -0800

There's a bit more about it at this blog, with plenty of variations mentioned.

By: smackfu

smackfu — Fri, 18 Nov 2005 12:58:29 -0800

The number could be for tracking. You can google the number and see how many hits come up.

By: tayknight

tayknight — Fri, 18 Nov 2005 13:00:15 -0800

If it doens't have any links or anything it is probably a email address harvester seeing which addresses don't bounce back. Since your address didn't bounce back, the harvester is probably going to assume yours is a valid address.

The five digit number might be some kind of tracking for the harvester so if bounce message didn't contain the 'send to' address it would still be able to tell to which address the original mail was sent

By: nobody

nobody — Fri, 18 Nov 2005 13:03:16 -0800

(Tayknight, I think you're mistaken, as languaghat is asking about website/blog comment spam, not email spam.)

By: deadfather

deadfather — Fri, 18 Nov 2005 13:16:38 -0800

Seeing that some of them have URLs (from Mo Nickels' link), couldn't the ones without links just be ones whose links got stripped, or were ill-formatted?

By: nobody

nobody — Fri, 18 Nov 2005 13:30:07 -0800

The URL mentioned in Mo Nickels' link points to a page on a private school's website, apparently designed as a (clearly non-commercial) teaching aide. It seems very unlikely that the comment spammer actually has a business interest in this elementary school's guess the number game.

By: jeanmari

jeanmari — Fri, 18 Nov 2005 13:59:05 -0800

We were flooded with this 5 digit spam over the last 7 days on our Moveable Type powered blogs, one more than the others. I noticed it because of the strange pattern.

Yesterday? That blog got hacked. Every entry had imbedded links in it where someone had been able to mess with the HTML. The HTML code wasn't showing up in the entries. Who ever was hacking us wasn't showing up on access logs and we don't believe they cracked the code for our passwords (though we changed everything anyway). But it was a strange coincidence, timing wise.

I have no idea if there is any connection. But I remember thinking as I was on the receiving end of the 5-digit spam, "Is someone testing out our site somehow and for some purpose?" But I have little experience with spam, spammers or any kind of internet hacks...my DH programs our sites. I'm just the user researcher and one of the writers.

By: camworld

camworld — Fri, 18 Nov 2005 14:34:51 -0800

It's highly unlikely someone hacked an MT site by sending it comment spam. My theory is that the 5-digit numbers are a sammer's tracking system so they can find out whcih MT blogs are still vulnerable to their comment-spam scripts. if they get a match in Google, they then bombard the crap out of those blogs with more comment-spam scripts. This is because unattended blogs are better for the spammer to abuse then ones who cean up after an attack within minutes of it happening.

By: alexst

alexst — Fri, 18 Nov 2005 14:40:34 -0800

I think this might be an attempt to make it harder for people to distinguish between real spam comments and normal comments using content filters.

I believe it's supposed to work something like this

1. Post lots of seemingly innocent comments all over the place which annoy people.
2. Wait for them to flag it as spam and pollute their content filters
3. Spam the same blogs with real spam which now hopefully will not get rated as spam by any content filters.
4. ....
5. Profit!

I could be on crack though.

By: alexst

alexst — Fri, 18 Nov 2005 14:42:36 -0800

This is because unattended blogs are better for the spammer to abuse then ones who cean up after an attack within minutes of it happening.

Considering how easy it is to spam huge quantities of blogs in not very much time I wouldn't of thought they would be trying to optimise the process like that. It just doesn't seem worth their time or effort. If it gets deleted from somewhere it doesn't cost them anything as posting a comment is essentially free.

By: tayknight

tayknight — Fri, 18 Nov 2005 14:53:34 -0800

Oops. my bad. Thanks nobody.

By: nobody

nobody — Fri, 18 Nov 2005 15:03:43 -0800

Looking at this site might offer a clue. The "recent comments" sidebar currently shows five different instances of this sort of comment spam.

Three of them (commenting on the same entry) include the same random number, which is interesting. Another links to the guess a number game from the elementary school website, and a fifth one links to a different number guessing game on a Pearson Education owned site.

I wonder if this is simply a sort of contest among spambots, the link to the number games being a nice touch, almost funny, like wry graffiti.

By: bemis

bemis — Fri, 18 Nov 2005 20:30:23 -0800

Five digit spam with home price/morgage/buying keywords makes me think they're trying to get hits from people googling zip codes. But, why disguise them? And why no URLs? It is a mystery-

By: languagehat

languagehat — Sat, 19 Nov 2005 06:23:04 -0800

Yeah, it is a mystery, isn't it? But at least I know it's not just me. And it's fun to see the other examples: Betsy Markum and Courtney Gidts are the same "gals" who have been spamming me, the little hussies! Thanks for all suggestions, and I hope someone figures out the Answer.

By: mikel

mikel — Sat, 19 Nov 2005 07:22:39 -0800

I think there might be a couple of goals.

First would be to place a seemingly innocuous but very identifiable number on as many sites as possible in order to search for the sites that have allowed these comments and thus identify them as high-priority spam targets. We've seen this happening for quite a while now in many different formats.

Secondly, though, it might be an attempt to do a kind of Google bomb on a site that otherwise would have a very low pagerank score. This would allow a spammer to demonstrate their ability to deliver ranking via comment spamming. The elementary school site has a pagerank of 3, which is quite low but even if the spammers could demonstrate any effect at all they will have succeeded.

By: shepd

shepd — Sat, 19 Nov 2005 09:50:24 -0800

If they're all identical except the number, perhaps someone has scripted a way to check if messages are identical, and discard identical messages?

By: languagehat

languagehat — Sat, 19 Nov 2005 09:59:17 -0800

They're not; the messages are all different, they just have a five-digit number somewhere inside. I have, however, added "Gidts" to my MT-Blacklist -- what a weird "name"! Hmm... on googling, I discover it's apparently a Dutch name, but most of the hits are for our naughty Courtney.

By: growabrain

growabrain — Sat, 19 Nov 2005 11:51:36 -0800

I've been getting the same 5-digit spams from the same Courtney Gidts & others -