Insidious New Blog Spam Scheme?

Monday, November 17, 2008

I've been noticing what appears to be a new kind of comment spam appearing on my site. At face value they appear to be legitimate because they are on topic and link to personal blogs that have no advertising. For example, on my post about Everything You Know About CSS Is Wrong, I got the following comments within a few days of each other: "The book is great stuff love the title!" from Ben, and "Sounds like quite a controversy!" from Jerry.

Follow the links and you'll find personal blogs. The problem is, they don't appear to be human! The blogs all seem to be full of miscellaneous posts, lacking the personal themes that appear naturally in real blogs. Although their comments appeared to be on topic (spam is usually more general, like "nice site!"), the blogs don't contain anything to indicate their interest in CSS. The blogs have blog rolls that link to other similar blogs; they're all named after peoples' full names, and they contain hardly any personal information at all. Here are some more from comments I've deleted: http://dianapresley.com/, http://jerryloggins.com/, http://betsybuchanan.com/ and http://randyingle.com/.

So I call spam on these comments. Not sure what the game plan is, though. Are they trying to build up SEO currency before adding advertising to the sites? Or are they already performing the function by linking to things in their blog posts? It appears that they have staff to compose comments that appear to be relevant, so there's a plan there somewhere. How annoying!

26 Comments

#1
On the November 17, 2008, Johan wrote:

Yes, I have noted this as well. I have had quite a few seemingly legimit comments bit they have been too generic to be believable. They have originated from russian ip-addresses bit they are fakeable i guess.

#2
On the November 17, 2008, Ben wrote:

First if I were a spammer why would i tell you that by linking to my site the way you do helps it out for spamming purposes. But that was not my purpose when I left a comment on your site for some kind of spam or future spam. I shared your site with my friends because we are all interested in learning more about CSS and I told everyone about your book that I read and you site. If you need me to clear anything else up please do not hesitate to contact me and if your going to leave this post up calling me out as a spammer at least rel nofollow the links to my site otherwise your point is pointless even though it is wrong already!

#3
On the November 21, 2008, Joel wrote:

Interesting spot, I've been using akismet for spam reduction for a while, I wonder if they've noticed this.

#4
On the November 26, 2008, Miles Burke wrote:

Wow, that's going pretty full on, isn't it? I use Akismet, which has saved me from 394,771 spam comments in two years, it tells me.

If it weren't for Akismet, I would hav edeleted my blog to save me the drama of manually deleting spams...

#5
On the December 2, 2008, malcolm coles wrote:

I probably need to get out more. But I investigated: http://www.malcolmcoles.co.uk/blog/spam-blog-ring-exposed/

And although Ben's domain wasn't registered by the same person - Noreen - who registered the others, he does seem to be being followed about by the others.

The annoying thing is that (yes, and I know you shouldn't pay attention to toolbar pagerank) they've all got more pagerank than me. So it's clearly working when they do decide to do something with it ...

#6
On the December 2, 2008, Andrew Tetlaw wrote:

Hey, awesome work Malcolm! Yeah, even when "Ben" posted the comment above it still sounded suspicious: "I shared your site with my friends because we are all interested in learning more about CSS" just doesn't sound genuine; doesn't sound like they even know what CSS is.

#7
On the December 2, 2008, Ben wrote:

I use a Wordpress blog that uses cascading style sheets and everyone else on your fake spam list uses a Wordpress blogs to.

What you are writing is a lie and you need to take this post down and post a retraction!

#8
On the December 2, 2008, malcolm coles wrote:

Ben, as I say on my blog, happy to withdraw whichever bit you say is untrue.

Although I do note that on this page: http://www.benurrutia.com/aint-that-the-truth-nikki/ you refer to your good friend Nikki, who has a somewhat fruity site that you link to.

Nikki's blogroll includes a link to mrsmaryfioratti.wordpress.com - who has a certain jerry loggins in her blogroll.

These people are definitely following you ...

#9
On the December 2, 2008, malcolm coles wrote:

Andrew - sorry, I decided to remove my post on this subject as I didn't want to get in to a big row on my blog! So, URL above won't work now. Sorry.

#10
On the December 2, 2008, Andrew Tetlaw wrote:

@malcolm, oh well, no problem. It's an interesting situation. If I've been a total boob then so be it. I don't mind the record of my boobishness staying here :).

I'm still very suspicious though!

#11
On the December 10, 2008, JB wrote:

They are using inlinks and related services. The link selection and accounting is done on the server and is nearly impossible to tell which are paid links.

#12
On the December 12, 2008, malcolm coles wrote:

Andrew - I don't think it's boobiness. Anyone can check the whois records for the blogs you name and draw their own conclusions. Which I'm sure would be similar to yours for most of them.

I thought you might enjoy this - outing spammers can get out of hand!!!

http://www.pdxtc.com/wpblog/viruses-and-scams/peak-studios-actually-harming-clients/

#13
On the December 12, 2008, Greg wrote:

I spent several hours looking at the whois records,links to and from these blog posts and this is what I came up with!

@ Malcolm your wrong all domains are not registered by one other person check Randys and Bens blog whois

@ Andrew you would have a hard time convincing me any of these blog are spam blogs because the links they point to are not there own and go to lots of different companies and there Page Rank is low.

@ JB do you even have a clue as to what your talking about?

@ Ben check your spelling when it is not correct it makes you lose all creditability even if your right.

As for the comments they left on your blog sounds like they were on topic but one liners and should have been written with more content in them but I would have to see them all not just the couple you posted here to be able to make a sound judgement.

#14
On the December 12, 2008, malcolm coles wrote:

Dig around the sites named and you'll see networks of cross links between them all.

To be fair, I said above they weren't all registered by the same person.

Here is the whois records for three of them, all registered by the same person at the same PO address:
http://who.godaddy.com/WhoIs.aspx?domain=betsybuchanan.com&prog_id=godaddy
http://who.godaddy.com/WhoIs.aspx?domain=dianapresley.com&prog_id=godaddy
http://who.godaddy.com/WhoIs.aspx?domain=jerryloggins.com&prog_id=godaddy

#15
On the December 14, 2008, Ben wrote:

lol Andrew you listed my blog along with some others as spam blogs at the bottom of your old post but you removed that part from your old post when you posted this new post. You should be more honest with your readers! But do not worry I took a screen shot of your post and Malcolms post before he took his down and you edited yours! Look for yours on my blog tomorrow when I have some time post there.

#16
On the December 14, 2008, Andrew Tetlaw wrote:

Hi Ben, actually that 'Linkography' part is purely automated. It takes all links from the blog post and their title attributes and lists them below the post. I had 'spam blog' in the title attributes of all those links. I've simply removed the links and thus they no longer appear.

#17
On the December 14, 2008, Scarlet wrote:

I just took a look at the cache of this page and Ben is right you took out that part.

And you say in this new post "I'm pretty sure that in this post all I did was talk about some websites, using terms such as 'appear to be' and 'seem to be'"

But on your old post you called his blog a spam blog for sure!

here is the cache
http://74.125.47.132/search?q=cache:NUrm98GcsE0J:tetlaw.id.au/view/blog/insidious-new-blog-spam-scheme/+http://www.benurrutia.com&hl=en&ct=clnk&cd=3&gl=us

#18
On the December 14, 2008, Andrew Tetlaw wrote:

Oh noes! The internet is against me! I can haz an escape chute plz?

#19
On the December 15, 2008, Ben wrote:

<---- throws Andrew a chute 

But know this before you open it! Where I am from when someone calls you a liar, a cheat, a thief, or anything else that your not then you defend yourself against those false allegations, a code of honor if you will.

And last thing I want is my family or friends or co workers searching for me online and have my name come up with bad things that are not true.

But I have wasted to much time with this already and I think anyone who reads this entire post and my blog will see I am anything but what you have posted about here!

#20
On the December 15, 2008, Ben wrote:

Can you fix my last comment so it says "throws Andrew a chute" instead of "and chute"!

#21
On the December 15, 2008, Not Greg wrote:

@Greg regarding "Ben check your spelling when it is not correct it makes you lose all creditability even if your right."

I would advise you do the same, because when you try to play grammar Nazi, but have grammatical errors in your own post, you look like an even bigger fool.

Specifically, I would advise learning the difference between "there" and "their".

Greg Said: "...and there Page Rank is low."

#22
On the December 17, 2008, Ben wrote:

<<---is still looking for his escape chute!!!

#23
On the December 24, 2008, Andrew Tetlaw wrote:

@Ben, chute deployed

#24
On the April 14, 2009, Ben wrote:

I thought this post was taken down but now you put it back up, so much for the chute!

#25
On the April 14, 2009, Andrew Tetlaw wrote:

@Ben, I never took this post down. There was a period when I changed hosts/design and had to move the database. There may have been a disruption because of that. All I did was remove your site from the list of sites. I thought that was what you wanted?

#26
On the April 22, 2009, Ben wrote:

This page comes up for my site via search engines, go see for your self. Since this post was done 2 Google page rank updates have taken place and do any of those sites or mine show high page rank or lots of back links? I had taken my post down on my blog please consider doing the same on yours as well.

Random outings from a chaotic mind

The Dexagogo Rocket Australian Web Industry Association logo

Delicious

Twitter