{"id":38910,"date":"2017-05-31T06:00:10","date_gmt":"2017-05-31T10:00:10","guid":{"rendered":"http:\/\/www.shamusyoung.com\/twentysidedtale\/?p=38910"},"modified":"2017-05-31T03:40:24","modified_gmt":"2017-05-31T07:40:24","slug":"messages-from-spammers-part-6","status":"publish","type":"post","link":"https:\/\/www.shamusyoung.com\/twentysidedtale\/?p=38910","title":{"rendered":"Messages from Spammers Part 6"},"content":{"rendered":"

Wednesday’s usual Nan O’ War episode will appear later this week. I was going to post about the latest talk from John Carmack<\/a>, but I feel like that kind of post needs to simmer for a few days. So rather than leave this spot blank, I thought we might look at the work of a new spammer to the site. <\/p>\n

All of the messages in this post arrived from the same IP address, and all of them within a few minutes of each other. All of them bypassed the various spam filters and appeared on the site where the public could see them. (I manually took them down once I spotted them, obviously.) They managed to properly handle the “Check here if you’re not a spammer” checkbox. They managed to spoof Akismet<\/a>, which is my main software-based defense against spam. They also successfully got by the common stuff like keyword filters. One or two of them almost got past the ultimate filter, which is my human brain. That’s a pretty good night’s work for a spam bot. (Or perhaps a shameful night’s work for my spam filters.)<\/p>\n

Let’s meet our first contestant…
\n<\/p>\n

\njavascript obfuscator<\/strong>
\nVery funny. Keep up the good work!<\/p><\/blockquote>\n

The text of this comment is totally legit. It’s not word salad. It doesn’t have screwball formatting or extraneous non-English characters. It’s actually IN English. It’s even been left on a funny post, so it checks out. The giveaway here is the name. Now, on any other site the name “javascript obfuscator” would immediately get you busted as a spam bot. But around here it could plausibly be some programmer’s self-deprecating handle. Something like:<\/p>\n

Q: So what’s a javascript obfuscator?<\/p>\n

A: Anyone who writes javascript for a living, because JS is self-obfuscating.<\/p>\n

But the giveaway here was that the name “javascript obfuscator” was also in their domain name. Still, it was a nice try.<\/p>\n

So how did this bot manage to post a coherent comment in the proper context? They cheated and copied off of someone else’s work. That same comment had already appeared<\/a> on the post.<\/p>\n

192.168 ll<\/strong>
\nThe ending of Mass Effect 3 is where the problems culminated, not where they began<\/p><\/blockquote>\n

The bot tried again just three minutes later. Again, they managed to post a coherent thought. The mistake here was that they quoted the post and not another commenter. Even that might have slipped by if I was being inattentive, but then they used a gibberish name that drew attention to itself. 192.168 is the first part of the default IP of a home router, and it’s just screaming out “someone has configured their spambot incorrectly”. <\/p>\n

spanish to english<\/strong>
\nVery funny indeed<\/p><\/blockquote>\n

Two minutes later. That pattern here is pretty obvious by this point. Again, this comment is simply quoting someone else<\/a>. It would have skated right through, except “spanish to english” makes no sense as a username and it matches their URL. If they were named “The Translator” – and if it didn’t come in this rapid-fire bundle of spam – I wouldn’t have given it a second look. “Oh. This guy translates stuff for a living. Good for him.”<\/p>\n

bullet force<\/strong>
\nCan't wait for the next entry!<\/p><\/blockquote>\n

Same mistakes. The name is odd enough to grab my attention, where I notice that it matches the URLDon’t bother looking it up. It’s a garbage multiplayer shooter for mobiles.<\/span>. Also, the ripped-off comment doesn’t make sense this time. “I can’t wait for the next entry” made sense four months ago<\/a>, but that is no longer a plausible response to that post because the next entry has already been posted. 17 of them, in fact.<\/p>\n

Last one:<\/p>\n

json formatter<\/strong>
\nIt was ridiculous. Even without being able to read the code on the slides, you could tell the steps varied widely in operation count, were often split up and in different order, and just looked different.<\/p><\/blockquote>\n

Same thing again: Nonsense name that matches the URL posted too soon after other messages with the same M.O. Also, this one repeated the mistake of quoting the post rather than a comment. That’s actually a spam bot quoting me quoting John Carmack. <\/p>\n

I’ve never seen a spambot behave quite like this one before. If I look in my spam filter nearly everything falls into one of these categories:<\/p>\n

    \n
  1. Word salad gibberish.\n
  2. Giant walls of meandering text unrelated to my site or the spammer’s URL.\n
  3. Non-English.\n
  4. Just a big list of URLs.\n<\/ol>\n

    So this one was kind of refreshing. Hopefully Askismet catches up soon so I don’t have to sort through too many of these by hand.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Wednesday’s usual Nan O’ War episode will appear later this week. I was going to post about the latest talk from John Carmack, but I feel like that kind of post needs to simmer for a few days. So rather than leave this spot blank, I thought we might look at the work of a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-38910","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/posts\/38910","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=38910"}],"version-history":[{"count":0,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=\/wp\/v2\/posts\/38910\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=38910"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=38910"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.shamusyoung.com\/twentysidedtale\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=38910"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}