figby.com

I’ve been dealing with comment spam for years here and on other weblogs (my software blocks about 400 a day) but now I’ve had a chance to deal with another aspect of this plague. A couple of people emailed me yesterday to tell me they’d received weblog comment spam that included URLs pointing to The Quotations Page. Sure enough, I found a couple of hundred of them in my own spam filters today.

The comments are the same “enjoyed your site” gibberish as usual, except that they include URLs of legitimate sites. Along with my quotation site, URLs included those of several other popular quotation sites and a couple of Linux-related sites. I didn’t find a single suspicious URL that could be that of the spammers, so this appears to strictly be an attempt to victimize popular sites.

The spam seems to use anonymous proxies or compromised machines, because it uses a wide variety of IP addresses, mostly in third-world countries. I can only guess their motivations:

1. To discredit popular sites with “spam” links and attempt to damage their rankings in Google
2. To get whitelisted by appearing as a legitimate comment (not likely, but maybe the legitimate site URLs will confuse some webmasters)
3. To pollute spam URL blacklists by getting popular sites into them
4. To further confuse the whole comment spam issue by making it look like “good” sites engage in it

Number 3 looks like the only thing that has any possibility of working, and in general I doubt this will accomplish anything at all. It’s still very annoying, though—just like running a mailing list, here’s another way that running a popular site means having to deal with people who think you’re spamming them from time to time.

Every now and then I notice a few spam messages creeping into my email inbox, which means it’s probably time to update my spam filter. SpamAssassin saves me from literally thousands of spam messages a day, but I’m still annoyed when I have to deal with a few personally.

I’ve been upgrading my local installation to SpamAssassin 3.1, and in the process I have updated my SpamAssassin Configuration Generator tool to work with version 3.0 and 3.1.

This tool is an easy way to create a SpamAssassin configuration file with some common settings. It has been linked from the documentation page for SpamAssassin for some time, and embarrassingly hasn’t worked with the current versions for the last year or so. As of now it’s finally up to date.

For those working with SpamAssassin 2.5x, the old version is still available.