February 21, 2006

Unusual Spam?

I've received five comments, all on old posts, this morning from someone/thing calling itself "Shari Smith," leaving "http://www.google.com" as a site name, and stuff like this in the actual comment body:

9ffd3bce74633d1b6f269fd6d32b79d6

I love the look of hexadecimal in the morning! No, seriously: What is this and how do I get rid of it, save by manual deletion? I obviously can't blacklist by site name, email addy, or comment text . . . or can I?

Anyone else have something like this occur?

Posted by Ilyka at February 21, 2006 05:09 PM
Comments
#1

I've received quite a few of these. As far as I can see, they are simply poison pills.

The idea is that you get one, blacklist it, and then get annoyed because now you've blacklisted Google. So you stop using the blacklist, and the spammers can spam you again.

Spammers are vermin.

Posted by Pixy Misa at February 22, 2006 01:57 AM
#2

Ilyka, in addition to an attempt to poison the blacklist, this is probably also what I call signpost spam. The spammer can come back in several days/weeks and do a Google search for that unique, unusual string of characters. Any blogs they find it on are clearly not being swept for spam, and so become open targets for massive follow-up spam (or being sold as part of a list of spammable addresses.

Paul

Posted by Light & Dark at February 22, 2006 02:26 AM
#3

Never suspected Pixy's "poison pill" theory, which I am hereby calling "Thank Goodness No One Ever Recruited This One Bimbo I Kind of Know (And Pixy Does Too) to mu.nu, Because She Would So Totally Blacklist Google, No, I Mean She'd Do it Every DAY."

(I know it's long, but I LIKE IT!)

Paul, the signpost thing is what I figured they must be up to, more or less. Annoying! Luckily I caught these quick and could delete them pretty painlessly, but if they hit me with 20 or 50 of those [shudders] . . . .

Posted by ilyka at February 22, 2006 02:36 AM
#4

Paul - good point. I hadn't twigged to that being the reason for the hexadecimal string, but you're almost certainly correct.

Posted by Pixy Misa at February 22, 2006 04:56 AM
#5

Ilyka, if you do get hit with more of this, are you aware of how to use the Blacklist to remove them all at once? (Not by blacklisting, just as a tool for quick removal?)

P.

Posted by Light & Dark at February 22, 2006 03:44 PM
#6

It's pretty easy - do a comment spam search in Blacklist but leave the search field blank. It will return all comments that you have access to. Just click on the bogus ones and wipe them out at one time.

Bump up the number of comments field if you don't get all of the items you're expecting. The "Last xx" is the last xx of all mu.nu comments,not just the ones on your blog.

Posted by Jim at February 22, 2006 04:04 PM
Live Comment Preview
Post a comment









Remember personal info?