Using the W3C for spam

Saturday, February 16 2008 @ 11:30 CET

Contributed by: Dirk

Profile spam is an old trick of the spammers. They simply create a profile on a popular forum, stuff it with their spammy links - and leave it sitting there. This usually works quite well since (lists of) profile pages are often linked prominently from the forum's main pages and therefore have a good position in search engines. You don't even have to post anything on the forum to profit from this.

This can also be combined with the "abandoned message boards" approach where the spammers leave posts on unused message boards and then spam for those posts. Which in turn point to the spammers real (and valuable) domains.

And in this combined "spam for profile pages" tactic, the spammers don't shy away from using prominent sites. I've already seen spam for SETI@home profiles, digg.com profiles, and various other well-known sites.

I didn't know you could also do this with pages of the venerable World Wide Web Consortium (W3C), though. But one spammer did just that.

So today I noticed a (rejected) spam post pointing to

http://www.w3.org/Consortium/supporters?key=<somekey>&viagra.html
Where "somekey" was 99e9239acb94a568d7430788001143.

It looks like to get on that list of supporters, you only have to fill out a form and then you're listed with all the information you entered. Nice find.

Comments (0)


Damn Spam!
http://spam.tinyweb.net/article.php/w3c-spam