I've been watching the results chongqed.org is getting for the spammers' keywords. They tend to follow a certain pattern: Within the first week or two, our page rank for those keywords will rise from day to day. Then the page rank will reach a plateau and after another two or three weeks it will start to drop again. Maybe it's the 'freshness' of the links that excites Google. Maybe we are seeing spammers getting even more busy after they appeared on chongqed.org. Maybe it's a combination.

However, I doubt that anybody else would want to get a higher page rank for "chongqing spam" or "spam chongqing". But for "emmss", of course, the situation is different.

Some of our keywords never caught on in Google: "roman shades" for example. Or (from the same notorious spammer) "engagement proposals". I guess that this guy has simply been too busy to fight him with two or three single links.

There are still other keywords that will give a good rank on one day for chongqed.org and drop on the next day, oscillating between "nice" and "oh, shit". The best example is "qqfans".

If this sounds bad, please understand that most of those spammy-keyword links are on our own sites, such as this blog. Although some people are kind enough to change their sandbox spam to point to chongqed.org, there could be lots more. And of course, I don't know all the keywords that point to chongqed.org and even if I did, I could never track all of them.

Thanks for linking ... er ... I mean Thanks for chongqing!

¶ 20:12   0 comments

This probably happens every day: another wannabe SEO company goes out of business. But this time, it's hakdata, one of our favorite wiki spammers. www.hakdata.de now only displays this message: "Welcome to www.hakdata.de. This page is no longer maintained or updated". He couldn't help himself and added a link to the page on the page. So it's "Farewell, hakdata!" then, I guess.

Our all time favorite spammer emmss is still alive and kicking, though. Our search results for emmss don't look bad, but they could be a lot better. OK, not that much, all we need are two steps up the rank ladder to be number one, but I still think that it would be really nice if chongqed.org would be the first result you get when you search for emmss. On the other hand: Why search for emmss at all?

¶ 18:49   0 comments

Of course wiki spam reminds me of email spam. All you need to do is hear the word "spam" and you think of email and scumbags ruining the medium for their own profit's sake. But I think that there are more parallels:

The nerds all over the world are working on technical solutions again. They try to find ways of automatically blocking wiki spam, just like they are trying to automatically block email spam. People begin to compile black lists. People begin to use authentication on their wikis, etc.

If you follow the discussion on Slashdot, you will see people beginning to think about legal ways to fight wiki spam. Send in the lawyers! Are we going to have a Can-Spam-Wiki act in a couple of years?

The third parallel is that most people don't think about trying to get at the roots of the problem. Why do email spammers send spam? Because that's how they make their living! You could bring the email spam problem to an end if you could stop spammers' revenue. How? Tell people that buying from a spammer is anti-social behavior. Make people ashamed of buying from spammers. In short: ostracize buying from spammers.

And why do wiki spammers spam wikis? We all know that: because they want to increase their fucking page ranks. So what can we do to fight wiki spam? We could (1) come up with technical solutions like redirectors to make wiki spam worthless in terms of page rank. Or we could (2) go one step further and make wiki spam provide page ranks for anti-spam sites, like chongqed.org. Not only would the spammers not increase their page ranks, their acts of vandalism would also be out in the open for everyone to see.

¶ 14:32   0 comments

Seems like currently wiki spam is in the news more and more often. I first read the netcraft arcticle a couple of days ago. I didn't bother because there wasn't anything new in it. Joe had already blogged about the reformed spammer. So I bookmarked and forgot. But today, Slashdot had a story on that article

And while there seems to be an increase in news these days, there also seem to be a lot of spammers comming out from under the stones where they normally hide.

We had the hakdata spammer writing an email to Joe.

We had the reformed Nigritude Ultramarine spammer that Joe blogged about and that was mentionend in the stories on netcraft and Slashdot.

And today I found a spammer on the WikiSpam page of the Wards Wiki. Quote:

I just discovered WikiSpam because I am one. I freely admit to using every tool at my disposal to promote my company. Unfortunately, I don't control Google and Google has dictated inbound links as a very important component of PageRank. If you don't rank well, you don't get found. You don't get found, you don't sell stuff and all the people in the back don't have jobs anymore.

I guess this translates to "Google is forcing me to do this! If you remove my spam you are going to be responsible if people loose their jobs!"

Am I the only one that this reminds to the early days of good old email spam?

¶ 14:14   5 comments

Again, I spent some time with the spam that went out with my address on it.

border-style dot com seemed interesting enough to take a further look.

This time, I did a trace route to www.border-style.com and what I found wasn't pretty. Although the whois information points to Alaska, the connection took a pretty different route: it left Europe via Spain and immediately climbed out of the Atlantic in Brasil. Here are a few hops:

tebrasil-0-0-0-0-grtsaosi1.red.telefonica-wholesale.net [213.140.50.186]
200.207.252.237
200-148-160-198.bbone.tdatabrasil.net.br [200.148.160.198]
200-204-20-218.dial-up.telesp.net.br [200.204.20.218]
200-204-20-78.dial-up.telesp.net.br [200.204.20.78]
200.207.240.5
200-207-37-134.dsl.telesp.net.br [200.207.37.134]
Timeout
200-171-99-82.speedyterra.com.br [200.171.99.82]

Yuck. It seems that the whole deal is managed by zombie machines that connect per dial-up in Brasil. Good work, Ranndi.

¶ 18:47   1 comments

Interesting question, isn't it? Well, to me it's interesting

I browsed through some of the bounces I got, escpecially looking out for URLs. Here's an interesting one: www.priestley.sort.paprika.border-style.com. Yes, that actually is a host name you are looking at. Somebody went through all that trouble just to confuse a few bad filters. The whois information of border-style.com points to one "Ranndi Goodman" in Alaska. Ranndi? Whatever.

If you go to the above address or simply to www.border-style.com, you'll get redirected to medstoredirect.info.

What a strange trick. They actually registered a domain name that filters might not parse because it's also a commonly used HTML attribute.

Are our filters that dumb? In any case, POPFile put all of those bounces in my spam folder, at least when the original email was attached. It was messy html from top to bottom, full of obfuscation tricks, display:none statements, etc, etc.

¶ 13:05   0 comments

It happened. Some spammer asshole put one of my email addresses into his From: and Reply-to: lines. For a couple of days now, I have been getting wave after wave of bounces, out of office replies, and challenge-response crap.

Thank you very much Mr. Spammer!

To all the spammers: You already make our live a living hell. Why do you add insult to injury and use valid From: and Reply-to: addresses? To make people like me even more angry? To get a really nice sentence in your trial because you not only sent spam, but you also forged identities? To make the last moron out there realize that spam is the last thing you should reply to or buy from?

Don't you see that you aren't only ruining email for the rest of us, but that you also are digging your own grave? You don't have to dig your graves! We will happily do that for you!

At least your stupid spamming software had the decency to not include my real name. Any idiot can see that manfred.heumann@spamme.please isn't going to be named "Alisa Brisova". Or "Brian McKeighry". Or ""Eleni Papadias". Or "Alexey Demjanovich Elohov". Or "Daniel Brown". Or "Alan Yonwin". Or "Ingmar Solheim". Or "Cao Guo-fang". (Yes, these were copied and pasted from the bounces.)

Would you please stop it and then immediately go to hell? Now?

¶ 20:24   3 comments

Great. NA has managed to get granted a " broad U.S. patent for technology covering "various computer program products, systems and methods" for filtering unwanted e-mail messages, it said Tuesday.". Cool. Here is a link to the patent.

And here's a link to the only reasonable response.

All I can do is second that.

¶ 15:50   0 comments