{"id":378,"date":"2006-05-12T12:41:18","date_gmt":"2006-05-12T17:41:18","guid":{"rendered":"http:\/\/www.shamusyoung.com\/twentysidedtale\/?p=378"},"modified":"2006-05-12T12:41:18","modified_gmt":"2006-05-12T17:41:18","slug":"p0rn-storm","status":"publish","type":"post","link":"https:\/\/www.shamusyoung.com\/twentysidedtale\/?p=378","title":{"rendered":"P0rn Storm"},"content":{"rendered":"

Comment spam is indeed like weather. Yesterday I think I got one or two spam comments. Today I have several dozen before the morning coffee is gone. But these ones are “interesting”.<\/p>\n

Today’s culprit is CTYNN.com. I’m not about to click, but the spams suggest it’s a multi-service porno site, or perhaps just a porno portal made to make a quick buck with banner ads and referrals. All of the comments follow the same pattern:<\/p>\n

    \n
  1. The commenter name is some fetish or a genre of porn, and links to a related subdomain. So, I’ll get a comment from someone named SEX-WITH-SOMETHING-GROSS and they will link to SEX-WITH-SOMETHING-GROSS.CTYNN.c0m.\n<\/li>\n
  2. The comment itself is mostly harmless, and made to look like a real comment. An example, “*pass it on…post it to your journal and see what others ask YOU!*”. Not exactly Hemmingway, but it looks passable at first glance. I’d have to visit the post in question to see that it’s a non-sequitur. No two comments have the same text so far.<\/li>\n
  3. None of the comments has any links in the text, which is another way they are slipping past the filter.\n<\/li>\n
  4. The CTYNN site is not yet listed in the mu.nu blacklist<\/a>, which suggests that the site is new, or at least new to spamming.\n<\/li>\n<\/ol>\n

    But what really gets me is that every one of them is from a unique IP. These are coming from all over the place. There is no pattern to the numbers.<\/p>\n

    So what’s going on here? Suddenly, from all over the world, I’m getting spam comments that all point to the same site that follow the same methodology. None of them are dupes. They all link to different subdomains and use different comment text. All of them came within a few hours of each other. <\/p>\n

    Are these comments coming from malware-infected zombies? From a single guy who is routing his traffic through various sources? If so, has this guy been spamming for a while and I’m only now making it onto his list, or is this a new spammer? <\/p>\n

    Inquiring (and vengeful) minds want to know…<\/p>\n

    I know this topic is dull. It’s like hearing someone complain about how hot it is in August. We all feel it, we all deal with it, and bringing it up all the time gets tiresome. I can hear you saying, JUST DELETE YOUR SPAM LIKE THE REST OF US AND SHUT UP ABOUT IT ALREADY! <\/p>\n

    I don’t know why this facinates me so much, but it does. I’m bothered by the fact that we don’t know more about how spammers work.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"

    Comment spam is indeed like weather. Yesterday I think I got one or two spam comments. Today I have several dozen before the morning coffee is gone. But these ones are “interesting”. Today’s culprit is CTYNN.com. I’m not about to click, but the spams suggest it’s a multi-service porno site, or perhaps just a porno […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-378","post","type-post","status-publish","format-standard","hentry","category-rants"],"_links":{"self":[{"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/posts\/378","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=378"}],"version-history":[{"count":0,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/posts\/378\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=378"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=378"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=378"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}