Mod note: comment spambots

[ron_newman]

We're getting an infestation of strange comment-spambots, whose purpose is mysterious to me (as they are not advertising or linking to anything). Here's how I recognize them:

- their comments are short, nonsensical, lacking in substance, strangely unresponsive to what they're commenting on (e.g. "Thanks" as a reply to a request for advice on roofers), or are partial copies of a previous comment.
- they have few or no friends, only group memberships (and sometimes not even those)
- the Location in their LJ profile is China or some other faraway country

When I see one of these, I delete the comment as spam, report the user as a possible spambot, and ban the user from our community. I think other moderators are doing the same thing. But we don't see every comment on every post in davis_square. If you see this kind of spam, please post a comment here with a link to the spam comment. Thanks.

Comments

[cos]

I think these spam bots are doing some sort of readership stats collection, possibly to gauge where to post spam most effectively. Many of them have tiny images. For example, weepty's recent spam comment, which I see you deleted, had this:

<img src="http://hdvd4u.com/images/fgyhj.gif" style="border-style:none; width:1px; height:1px;" / >

It's a 1 pixel by 1 pixel image, in other words a single tiny dot you wouldn't notice, but your browser would still load it from that site. Presumably, the spam bots use a differently-named .gif file for each place they post. Later, they can count in their web server logs how many times each image was downloaded. If fgyhj.gif was downloaded 30 times, that'd mean 30 different web browsers had viewed the post on which that comment was left.

So, I think this is spammer market research. Their version of Nielsen ratings :)

[courtney (from livejournal.com)]

Are they creating Live Journal profiles to do this?

[ron_newman]

Yes.

[courtney (from livejournal.com)]

Interesting. Thanks, Ron and Cos for the explanation.

[cos]

.... and we got one of those spam comments on this very post :)

[ron_newman]

Looks like you deleted the spam comment but didn't remember to ban andrefs. So I did.

[pierceheart.livejournal.com]

Getting bolder - now they're directly making their own posts to the community. Segrest.

[ron_newman]

I missed this. What was it? I guess another mod deleted it.

[cos]

I deleted it and banned segrest.
It was something vaguely real-estate-ad-like, around 10am today.

[ron_newman]

Thanks.

[nonelvis]

Spam comment here: http://davis-square.livejournal.com/3213210.html?thread=35194522#t35194522

[ron_newman]

Got it, thanks.

[smammy]

Here's one: http://davis-square.livejournal.com/3211355.html?thread=35176283#t35176283

[ron_newman]

Thanks. Reported, deleted, and banned.

[nonelvis]

And another one replies to me in that same post: http://davis-square.livejournal.com/3213210.html?thread=35198618#t35198618

Man, these guys are persistent.

[ron_newman]

Sigh. I'm starting to wonder if we need to change from open to moderated membership. Currently non-members must solve a CAPTCHA in order to leave comments, but the spambots now appear to be joining the community, bypassing this protection.

(This is not the same thing as having a moderated community, where moderators have to approve posts.)

[nonelvis]

Ah, I was about to ask whether you'd already restricted comments to members only, but if the spammers are joining the comm, I agree that the next step may unfortunately be moderated membership.

[ron_newman]

Requiring CAPTCHA for comments is somewhat less restrictive than requiring community membership, so I'm going to leave that setting alone for now.

However, I now have approval of three moderators to turn on moderated membership, at least temporarily. I will do so shortly. ETA: Now done, see this new post for explanation.